Disclaimer: I am a MikroTik ROS noob… so independently verify what I recommend below.
Looking at the block diagram of the RB2011, it has two switch chips, one for the 5 lower ports (1Gbps capable), one for the 5 upper ports (only 100Mbps).
So the first question is: What kind of performance are you expecting? Does your Untangle firewall have all Gb ports? Are they individual ports (for example Qotom or Protectli), or something with a integrated switch? The reason I ask is because your graphic shows the connection from the rightmost port of the Untangle FW to the PC labelled as “VLAN 10”, and that isn’t what I would expect on a FW with dedicated ports. Unless Untangle is using a bridge device, any vlan 10 associated with that port would not be in the same broadcast domain as a vlan 10 on the trunk port (which isn’t mentioned).
What sort of environment is this in? I am just trying to understand what the reason for different vlans is.
Is this for learning about ROS? Then by all means keep playing.
Trying to repurpose old equipment? (if this is the case, how much is your time worth?)
How secure does the switch have to be?
- A home where you have good control of physical access to the devices, but generally the area is “trusted”.
- A business where the equipment is secured, and you don’t want anyone on vlans 11, 12 or 13 to have any chance of logging into the switch, even if they could guess the password?
If this is in a home, you want good performance on all the vlans, and you don’t really care about learning how to configure the RB2011, my suggestion would be to buy an 8 port vlan-aware switch. These are available on Amazon around $30 (TL-SG108E), but be aware that the “smart” switches are not business class, and by design there is no possible way to prevent any client using standard untagged ethernet frames from gaining access to the web interface of the switch, regardless of what vlan they are connected to. You can set a password, but that’s the only thing you can do; the web interface uses http only (no secure protocols), and there is no telnet or ssh. And the firmware has known buffer overrun bugs. See Not So Smart: TP-Link TL-SG105E V3.0 5-Port Gigabit Easy Smart Switch
I do own 3 of the TL-SG108E and use them at home, but I would never use them in a business, And never connected directly to the internet (even at home), although if you set the ip address to a static RFC1918 address, it would provide some protection.
So getting a dedicated switch would be my recommendation to someone that wanted to have a “trusted” vlan, a camera vlan, and an IoT/Guest vlan at home without having to learn ROS. For more money you can get better switches. I also have two MikroTik CSS106-5G-1S switches, and they are more feature rich than the TL-SG108E, but still no secure protocols for management or anything but web interface to SwOS (no support for WinBox either, but it is my current goto for a network tap for wireshark).
If you made it this far, I will assume you do want to learn how to get the RB2011 to work as a switch, and performance isn’t your highest goal.
You need to decide which VLAN can be put on the 100M switch. I would put the trunk and other two vlans on the lower ports (the 1Gbps) capable half.
Your cisco IOS knowledge isn’t going to transfer to the ROS way of doing things in a straight forward way. And as others have mentioned, if you use the bridge method everything is going to be done in software (slowly). That’s less of a concern for traffic that is going between vlans (because that will have to be routed anyway) but for two ports in the same vlan, normally all L2 traffic could be handled by a switch ASIC at near “wire” speed, but that won’t be what you see on the RB2011 if you use the bridge. For that, a TL-SG108E would give you better performance.
Here’s a webpage with some hints about Cisco to MikroTik – Switching and VLANs, although it is really aimed more at replacing with a CRS switch, not a RB2011.
Also, I am going to disagree with 404Networks suggestion to create multiple vlan interfaces, one for each vlan. That’s going to complicate things, because now the RB2011 will want to route between the vlans, and my guess is that you want to have all intervlan routing done by your Untangle firewall. Yes, you could put in firewall rules to prevent the inter-vlan routing by the RB2011, but the easiest way is to make that impossible. Without ip addresses, you wouldn’t be able to connect to them with ip, but perhaps with mac using winbox. Edit: I wasn’t thinking clearly, because the RB2011 won’t be able to route without having ip addressess associated with those interfaces, so as long as there is only a single interface with an ip address, then the RB2011 won’t try to route.
Study material: See the links in these posts: http://forum.mikrotik.com/t/issue-with-dhcp-server-and-vlans-and-console-access/156327/1 and for networking background http://forum.mikrotik.com/t/issue-with-dhcp-server-and-vlans-and-console-access/156327/1
.