RouterOS7 - Most correct VLAN setup

RouterOS General
1

Hello,

I’m wanting input on what is the current “most correct” solution for deploying VLANs on a Mikrotik router running Router OS 7.12.

From what I can tell there are a few possible ways to do it. Beginning with the end in mind, this is what I want to accomplish.

I have inherited a small manufacturing facility with a Cisco core switch and multiple fiber media converters going to unmanaged switches in other buildings. The entire facility is a flat network on VLAN1. My goal is to to place the media converters with Hex PoE routers (acting as switches); VLAN-1 will remain untagged to the unmanaged switches so the wired LAN does not change, but I want to also carry new tagged VLANs to support corporate and guest wireless user vlans.

Before:
Cisco Core → [Copper:FiberMediaConverter:Fiber] → [Fiber:FiberMediaConverter:Copper] → Unmanaged switch

After
Cisco Core:SFP → Fiber → SFP:HexPoE → [ETH1-UnmanagedSwitch:VLAN1-untagged ; (ETH5-AccessPoint:VLAN5-untagged VLAN10,15-tagged)]

So on the Cisco side we will basically have something like this…

int g1/0/x
description “EngMezz:Hex:SFP”
switchport mode trunk
switchport trunk allowed vlan 1,5,10,15
switchport native vlan 1
exit


What is the most correct way to implement this in ROS7?

I’m leaning towards creating a bridge for each VLAN…

BR-VL-1
BR-VL-5
BR-VL-10
BR-VL-15


Then do a bridge VLAN for each bridge…

BR-VL-1, vlan ID =1, tagged = SFP, untagged = SFP,Eth1
BR-VL-5, vlan ID =5, tagged = SFP,Eth5, untagged = Eth5
BR-VL-10, vlan ID =10, tagged = SFP,Eth5
BR-VL-15, vlan ID =15, tagged = SFP,Eth5



But I know there are several other methods that can be used including adding VLANs to each interface and then putting them in bridges.
Example “SFP & Eth1 are members of BR-VL-1”, “vlan5 - Ap Mgmt - ETH5 and vlan5 - Ap Mgmt - SFP are members of BR-VL-5”.

2

The thing to be careful of here is that hardware acceleration is often only available on the first bridge. The way I to go about it is to create a single bridge and handle the VLANs internally. For the example you give, I would do this:


/interface bridge
add name=interfaceBridge vlan-filtering=yes
/interface/bridge/port
add bridge=interfaceBridge interface=SFP
add bridge=interfaceBridge interface=Eth1
add bridge=interfaceBridge interface=Eth5
/interface/bridge/vlan
add bridge=interfaceBridge vlan-ids=1 untagged=interfaceBridge,SFP,Eth1,Eth5
add bridge=interfaceBridge vlan-ids=5 tagged=interfaceBridge,SFP,Eth5
add bridge=interfaceBridge vlan-ids=10 tagged=interfaceBridge,SFP,Eth5
add bridge=interfaceBridge vlan-ids=15 tagged=interfaceBridge,SFP,Eth5
/interface/vlan
add interface=interfaceBridge name=interfaceVlan5 vlan-id=5
add interface=interfaceBridge name=interfaceVlan10 vlan-id=10
add interface=interfaceBridge name=interfaceVlan15 vlan-id=15

Adding interfaceBridge to the tagged/untagged list in the bridge VLANs and creating VLAN interfaces are only necessary if you intend to bind an address to VLAN interfaces on the switch. VLAN 1 is native to the bridge, so if you want to bind an address to VLAN 1, just bind it to interfaceBridge.

I’m also assuming that SFP, Eth1 and Eth5 are what you’ve named the interfaces on your router. That may need to be adjusted accordingly.

3

http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1

4

As hEX PoE use the QCA8337 switch chip which does not support hardware-offloaded vlan-aware bridges use a single bridge and configure the switch chip to handle the VLAN filtering, see the examples https://help.mikrotik.com/docs/display/ROS/Switch+Chip+Features#SwitchChipFeatures-SetupExamples

5

Follow only official docs:
https://help.mikrotik.com/docs/display/ROS/Basic+VLAN+switching

6

I suggest not ignoring this textbox, so that you don´t waste as much time as I did with my Hex PoE first :slight_smile::

https://help.mikrotik.com/docs/display/ROS/Basic+VLAN+switching#:~:text=On QCA8337,is%20assigned%20to.

“On QCA8337 and Atheros8327 switch chips, a default vlan-header=leave-as-is property should be used. The switch chip will determine which ports are access ports by using the default-vlan-id property. The default-vlan-id should only be used on access/hybrid ports to specify which VLAN the untagged ingress traffic is assigned to.”