@404Network, Good Catch, I agree.
If he wants access to the RB2011 switch via the untagged interface on the trunk, then I think the following would work.
Question, what is the purpose of network=10.10.0.0 if /24 is specified? Is it needed?
But it was my fault, based on what I posted here. I was copy/pasting from some example.
It should not be ether1 since ether1 is part of the bridge. I think it should be interface BR1 if the untagged vlan on ether1 was wanted. Internally the vlan the RB2011 will associate with the untagged vlan is the bridge’s PVID, and if not specified, it will be PVID 1.
But I don’t understand why @Hibbie would want more than a single interface with an ip addresses on the RB2011. I think only one is needed if the RB2011 is being used as a switch. L3 Interfaces on the bridge are similar to an SVI (switch virtual interfaces) on a Cisco IOS switch. They are the L3 interfaces that are the CPU’s connection to specific vlans on the switch. And if there is only one, then the RB2011 won’t have the opportunity to route. Then all routing will be left up to the Untangle firewall, and it can limit who has access to the untagged base device on the Untangle eth2 (trunk/hybrid) interface.
And there are two now. MGMT associated with vlan 99, and BR1 associated by default with the untagged vlan on the bridge. @Hibbie, since this is a learning exercise, I suggest reading the links in these posts: viewtopic.php?t=183858#p917353 and for networking background viewtopic.php?t=183858#p917359
Specifically look at the Bridge VLAN Table at least down to the VLAN Tunneling setup section (which is more advanced Q-in-Q) stuff. Get the basics down first. The Background section near the top has a glossary of terms, including PVID. The PVID is just the one vlan that a standard untagged ethernet frame will be assigned to when it is received. A vlan-aware switch must classify every ethernet frame it receives and assign it to a single vlan, once it has been assigned a vlan, then it can only exit form a switch port that is configured as a member of that vlan. When a frame arrives with a vlan tag, it is easy to classify.
When a vlan-aware switch receives an untagged frame (just another name for a standard ethernet frame as would be sent by a windows PC), the switch has two choices.
discard it.
treat it like it was tagged with the vlan-id specified by the Port Vlan ID (PVID).
Strictly speaking, the PVID is only used on ingress to the port, although many vendors (like the Ubiquity ER-X) automatically untag frames that match the PVID of the port when they egress. That is the normal behavior. The Practical Networking site has good vlan-info that is generic enough to be applied to any vendor, although the examples are Cisco based.
It’s added automatically … and is calculated from IP address in CIDR notation. It is possible to manually set it to something different (handy in some border cases).
Thanks for the tips, I’m told I can be quite exhausting to help…
The 10.10.0.51 IP was an attempt at remote connecting, when the VLAN’s weren’t working. The traffic will indeed end up untagged on the trunk connection. I set both up by blindly adding the commands, I guess having two ip routes isn’t necessary either but functionally everything seems to work.
The untangle firewall has the VLAN’s defined as children of the physical interface, everything that isn’t tagged as any of these children will end up on the physical interface, which has its own DHCP server in 10.10.0.x. I can access the switch on both IP’s now, so interface=ether1 seems to be just as good as BR1. Anyway it’s no longer needed and I guess I could remove it, but it’s also not in my way.
Can anyone explain why I had to do this on my device:
add bridge=BR1 tagged=BR1,ether1 vlan-ids=99
add bridge=BR1 tagged=ether1 untagged=ether10,ether9 vlan-ids=13
add bridge=BR1 tagged=ether1 untagged=ether3 vlan-ids=11
add bridge=BR1 tagged=ether1 untagged=ether5,ether6,ether7 vlan-ids=12
to get it to work, while a config that I found in a guide on this forum, which has been there for 2 years and downloaded 1000 times advised me to do this:
set bridge=BR1 tagged=ether1 [find vlan-ids=11]
set bridge=BR1 tagged=ether1 [find vlan-ids=12]
set bridge=BR1 tagged=ether1 [find vlan-ids=13]
add bridge=BR1 tagged=BR1,ether1 vlan-ids=99
Every home is different, so is correct router config. Your VLAN layout is obviously different than layout of user asking for advice in post you’re mentioning.
Unless you at least faintly understand what you’re doing, you can’t just copy-paste some out-of-context part of random recipe (made for somebody else) and hope things will just work. The snippet you posted in post above possibly didn’t work for you because it expects some entries with vlan-ids=11 (and 12 and 13) already to exist so that it can change setting of bridge= and tagged= … if those entries don’t exist when executed, commands do absolutely nothing.
The difference between add and set: add adds configuration item and if configuration item with overlapping properties already exists, command barfs. set changes property (or properties) of already existing configuration item. Set command requires argument identifying configuration item to affect, the [ find ] construct allows to run set without explicitly passing identification (the construct provides that). If construct can’t find any item, then set command does nothing.
Your best bet is to provide an updated diagram if things have changed or a better one can be produced with more accurate detail
AND your latest confg…
As long as you keep trying we will keep helping ) But do try to learn and read as you go along, as stated just copying and pasting wastes all our time.
When I read this the first time, I took it to mean you were trying to learn networking.
Copy/pasting isn’t learning, trying to determine why something doesn’t work, and even better, being able to explain how/why it works or doesn’t is a much better measure of what you know.
When interviewing candidates, it is easy to determine the candidates that understand networking from the ones that attended a “certification bootcamp” that explained what was going to be on the test, and how to answer the questions. And I would never hire one of that type (that “learned” networking in one week). I would be more interested in someone that was self taught, but had curiosity and good troubleshooting skills.
Learning networking doesn’t need to cost much, but it does require effort and hands on experimentation. Side tour tidbit, experience and experiment are both derived from the same Latin word, and when translated to French, they are the same word. expérimenter
If you want to know if you understand something, try to explain it to someone that isn’t in the field. That will help you find the areas you don’t understand, and will help you know the best areas to focus your future study. google Feynman Technique
Well, I didn’t want to come across as lazy, I did in fact attempt to figure this all out, and got it all to work in the end. The only difference with the initial diagram is that I moved away from ths sfp port and am using ether1 as my trunk, because at some point I thought it was related to my problems. Looking back, it likely wasn’t.
Thank’s to everyone who helped, I realise some of you put considerable time into this, and the articles did in fact help me grasp this device better. But for the record, I’m aware that copy/pasting isn’t learning, but just typing some lines and watching the device not work also doesn’t help. This is why I started from an existing config and figured out what each bit did, so I could correctly modify it to my situation.
The post that I ‘copied’ from is the post that 404network recommended I go through. It describes exactly the same situation, so I also used that config and adapted with my VLAN ID’s etc. This failed, and I was able to resolve this by changing those lines to ‘add’ instead of ‘set’. Based on the ‘absolute’ meanings of the words add and set I would indeed presume that the first one adds a line, whereas the latter one updates an existing line. In that regard, it is still a mistery to me how the switch.rsc in the below post could result in a working configuration. The post is 3 years old and the config file has been downloaded 1700+ times, so I’m hesitant to say there’s an error in it. http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1
Command /export creates a beautiful text file containing most (if not all) configuration of device. And it’s all commands that, when replayed, configure device without any configuration. And that’s not default configuration, it’s no configuration.
If one starts from anything but no configuration, one has to either skip or alter some commands to get the config … decission which is it (skip or change) is not exactly trivial for a less experienced MT user.
Nicely put, I am not experienced and thus I put everything into newbie config speak.
Articles like pcunite speak a different language ( a technically correct language but foreign nonetheless…)
) But do try to learn and read as you go along, as stated just copying and pasting wastes all our time.