I have a MikroTik CAP ax and I am trying to set up VLANs. The configuration with CAPsMAN running as a VM on Proxmox (10.10.0.5) works well for VLAN 1110 (10.10.0.201). However, I am struggling to set up bridgeLocal with tagged VLAN 1500 to receive a DHCP lease (although this is not a necessity). I simply need VLAN 1500 to be active on bridgeLocal.
When i ignore the bridge and just jet the vlan1110 and vlan1500 i have the connection to gw and clients are able to receive leases from external dhcp server, but I’m pretty sure that the configuration is not correct.
I have untagged VLAN 1 as passive and everything else is apparent from the configuration
VLAN Interface Configuration:
0 R vlan1010 1500 enabled 1010 bridgeLocal
1 R vlan1020 1500 enabled 1020 bridgeLocal
2 R vlan1030 1500 enabled 1030 bridgeLocal
3 R vlan1040 1500 enabled 1040 bridgeLocal
4 R vlan1050 1500 enabled 1050 bridgeLocal
5 R vlan1060 1500 enabled 1060 bridgeLocal
6 R vlan1070 1500 enabled 1070 bridgeLocal
7 R vlan1080 1500 enabled 1080 bridgeLocal
8 R vlan1090 1500 enabled 1090 bridgeLocal
9 R vlan1110 1500 enabled 1110 bridgeLocal
10 R vlan1200 1500 enabled 1200 bridgeLocal
11 R vlan1500 1500 enabled 1500 bridgeLocal
12 R vlan1600 1500 enabled 1600 bridgeLocal
Got you, that could work. However, when I applied it, it didn’t. The reason is simple: possibly, I didn’t specify it deeply enough.
I have a physical switch before it where all VLANs are tagged and VLAN1 is untagged. The RADIUS server is just forwarding requests to a Debian FreeRADIUS server, and upon success, the client gets a lease from the OPNsense firewall. This is working as it’s running on the management VLAN.
My issue is that I cannot receive a lease directly on the bridge. With my current configuration, I can receive a lease on the VLANX interface when Ether1 is tagged on it. This setup is working, but I need to have the bridge tagged to get a lease on it for VLAN1500. I do not know what I am doing wrong.
No i don’t, have just one and radius is managing what Vlan will be assigned.
This piece of hw is Cap ax device as an one of AP’s as bridge for it.
As i was mentioning, vlan’s are up, dhcp working, CapsMan managing SSID’s and the rest is basically managed by OPNsense FW.
Vlan’s tagget on ether1 with 1110 and 1500 are getting the lease as Vlan interface, but i need the bridge to be tagged with 1500
Now, another problem has occurred. I get the address on the bridge interface in VLAN1500, so that’s fine. The problem is that I can’t ping the gateway. I tried running Torch to find out where the problem is, and when I turn it on for bridgeLocal with the ICMP protocol, the ping starts working, but it’s periodic—sometimes it works, and then it doesn’t. The same thing happens without Torch. I’m confused.
I thought about it, but I don’t want to assume that the issue is because the interface in OPNsense (gateway for VLAN1500) has MSS set to 1420.
I apologize for spamming with the message above; I was just confused after solving the issue with the lease for the bridge. However, after investigating and searching for what could be causing this problem, I found that the solution might be what you mentioned earlier:
I did this, but it didn’t help. I also found a post here on the forum by @kobuki, with the difference that I don’t have the problematic comment in the logs:
My current port configuration is set to “admit only VLAN tagged” for Frames Type, which matches my configuration. All bridged VLANs are set separately, but the problem persists.
Because ether1 is the trunk port, shouldn’t the PVID 1500 be set on ether2? That way you’ll have access to the management VLAN through the aforementioned port
Sorry, now I’m confused. It’s clear that ether1 is the trunk. The management VLAN is 1110, the base VLAN is 1500, and the rest are just pass-through. Ether2 is not active or in the bridge at all. Config is attached conf.rsc (11.3 KB)
You are attempting to use the bridge-to-CPU interface both untagged (by setting pvid=1500 under /interface bridge) and tagged (by having an /interface vlan with vlan-ids=1500) which leads to all sorts of unexpected behaviour.
Also setting the PVID under /interface bridge port makes no sense with frame-types=admit-only-vlan-tagged as this disables all untagged packets.
Presumably VLAN1500 is your management network. Is everything on your trunk connection tagged, or is it hybrid with untagged plus tagged?
1500 is the base VLAN with the gateway. It is tagged on the trunk port of the physical switch before ether1, just like all other VLANs.
VLAN1 is untagged and port on the switch have PVID1.
Management is VLAN1110.
There is nothing connected behind the CAP AX; it’s just an AP with SSID that distributes VLANs. The client gets tagged when authenticated by FreeRADIUS.
@tdw has given you quite a clear pointer what is the issue, but it fell through.
So I’ll try to be more straightforward than @tdw was: disable (and later delete) all rows in the /interface/vlan table except the one for the management vlan 1110. There are two ways to make the router part of the cAP ax access VLAN 1500 on the bridge part, but they cannot be used simultaneously, which is what you did.
Plus there are quite some issues in your firewall rules, albeit unrelated to the intermittent ping operation you are struggling with now.
So I feel a phone call might be a more efficient way (it would be like in the old joke about the U.S. president asking the Soviet general secretary how much does a call from Moscow to hell cost).
So I’ll delete all VLANs, assuming that’s related to external distribution. I’ll change the PVID on the bridge to 1, same as on the ports. I’ll set VLAN1110 to be tagged on ether1 and the bridge. Then I’ll accept the lease on the VLAN1110 interface.
What’s the number? From Prague, it won’t be that bad.
That a) is a change of the concept on the fly (nothing bad about that unless you lock yourself out of the device) and b) would still be a mistake if done exactly as described.
