Hi guys,
Today I setting up various vlan scenario’s between MT devices that have full hardware offloading (CRS3xx switches) and devices that either don’t support it. I have setup a small router to host vlans and transport those to my CRS326. In my first test I setup vlan filtering on my router to transport 3 vlans by setting up bridge vlan filtering. This setup worked also with ingress filtering setup on trunk and access ports.
My second try was to use the hardware offloading capabilities of the Atheros8227. This also worked right until the moment I tried to secure my trunk port to the switch. I get to secure all my interfaces with the vlan=mode=secure option. But the moment when I add this to my trunk port (ether4), I cannot ping my switch anymore.
Hope that one of you can show me where I overlooked a configuration setting. Thanks
Router export
# aug/19/2018 18:56:23 by RouterOS 6.42.6
# software id = TI3M-BEC3
#
# model = RouterBOARD 941-2nD
# serial number = 661605814243
/interface bridge
add admin-mac=E4:8D:8C:E1:44:41 auto-mac=no fast-forward=no name=bridgeLocal
/interface vlan
add interface=bridgeLocal name=vl10 vlan-id=10
add interface=bridgeLocal name=vl20 vlan-id=20
add interface=bridgeLocal name=vl30 vlan-id=30
/interface ethernet switch port
set 0 default-vlan-id=10 vlan-header=always-strip vlan-mode=secure
set 1 default-vlan-id=20 vlan-header=always-strip vlan-mode=secure
set 2 default-vlan-id=30 vlan-header=always-strip vlan-mode=secure
set 3 vlan-header=add-if-missing vlan-mode=fallback
set 4 vlan-mode=secure
/ip pool
add name=dhcp_pool0 ranges=192.168.10.2-192.168.10.254
add name=dhcp_pool1 ranges=192.168.20.2-192.168.20.254
add name=dhcp_pool2 ranges=192.168.30.2-192.168.30.254
/ip dhcp-server
add address-pool=dhcp_pool0 disabled=no interface=vl10 name=dhcp1
add address-pool=dhcp_pool1 disabled=no interface=vl20 name=dhcp2
add address-pool=dhcp_pool2 disabled=no interface=vl30 name=dhcp3
/interface bridge port
add bridge=bridgeLocal interface=ether1
add bridge=bridgeLocal interface=ether2
add bridge=bridgeLocal interface=ether3
add bridge=bridgeLocal interface=ether4
/ip neighbor discovery-settings
set discover-interface-list=all
/interface ethernet switch vlan
add ports=ether1,ether4,switch1-cpu switch=switch1 vlan-id=10
add ports=ether2,ether4,switch1-cpu switch=switch1 vlan-id=20
add ports=ether3,ether4,switch1-cpu switch=switch1 vlan-id=30
/interface wireless cap
set bridge=bridgeLocal discovery-interfaces=ether1 interfaces=wlan1
/ip address
add address=192.168.10.1/24 interface=vl10 network=192.168.10.0
add address=192.168.30.1/24 interface=vl30 network=192.168.30.0
add address=192.168.20.1/24 interface=vl20 network=192.168.20.0
add address=10.10.10.10/24 interface=bridgeLocal network=10.10.10.0
/ip dhcp-client
add dhcp-options=hostname,clientid disabled=no interface=wlan1
/ip dhcp-server network
add address=192.168.10.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.10.1
add address=192.168.20.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.20.1
add address=192.168.30.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.30.1
/system clock
set time-zone-name=Europe/Amsterdam
/system identity
set name="Test vlan"
/system routerboard settings
set auto-upgrade=yes silent-boot=no
Switch export
# jan/02/1970 06:06:18 by RouterOS 6.42.6
# software id = KDRY-IV9X
#
# model = CRS326-24G-2S+
# serial number = 763C07655DFF
/interface bridge
add fast-forward=no name=bridge vlan-filtering=yes
/interface vlan
add interface=bridge name=vl10 vlan-id=10
/interface list
add name=MAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/interface bridge port
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged \
ingress-filtering=yes interface=ether1 pvid=10
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged \
ingress-filtering=yes interface=ether2 pvid=20
add bridge=bridge interface=ether3 pvid=30
add bridge=bridge interface=ether4
add bridge=bridge interface=ether5
add bridge=bridge interface=ether6
add bridge=bridge interface=ether7
add bridge=bridge interface=ether8
add bridge=bridge interface=ether9
add bridge=bridge interface=ether10
add bridge=bridge interface=ether11
add bridge=bridge interface=ether12
add bridge=bridge interface=ether13
add bridge=bridge interface=ether14
add bridge=bridge interface=ether15
add bridge=bridge interface=ether16
add bridge=bridge interface=ether17
add bridge=bridge interface=ether18
add bridge=bridge interface=ether19
add bridge=bridge interface=ether20
add bridge=bridge interface=ether21
add bridge=bridge interface=ether22
add bridge=bridge interface=ether23
add bridge=bridge frame-types=admit-only-vlan-tagged ingress-filtering=yes \
interface=ether24
add bridge=bridge interface=sfp-sfpplus1
add bridge=bridge interface=sfp-sfpplus2
/ip neighbor discovery-settings
set discover-interface-list=MAN
/interface bridge vlan
add bridge=bridge tagged=bridge,ether24 untagged=ether1 vlan-ids=10
add bridge=bridge tagged=ether24 untagged=ether2 vlan-ids=20
add bridge=bridge tagged=ether24 untagged=ether3 vlan-ids=30
/interface list member
add interface=vl10 list=MAN
/ip address
add address=192.168.10.10/24 interface=vl10 network=192.168.10.0
add address=10.10.10.30/24 interface=bridge network=10.10.10.0
/system identity
set name="Test vlan switch"
/system routerboard settings
set auto-upgrade=yes boot-os=router-os silent-boot=no