Hey all,
I’m having an issue with communication between VLANs, which is probably easy, though I just can’t figure out how I’ve gone wrong.
I have a wireless network associated with a 493G device in my living room. From there, I have a wireless bridge into my home office (directly down the hall). The wireless traffic is all untagged. My wireless bridge device is connected to port 1 of a CRS125-24G (cloud switch). I have allocated ports 19-24 for the storage VLAN. I created a bridge to include those ports. I created an IP address of 192.168.52.1 (/24) and associated it with the VLAN interface, which is also part of the bridge.
When I try to ping 192.168.52.1 from my home wireless network (192.168.50.0/24), it fails. I’ve added a route to the 493G (192.168.52.0 /24 via 192.168.50.4, which is the IP of the CRS125). I’d even enabled OSPF to let the routers figure out the routing, and verified that the routing tables are correct. I’m seeing ICMP redirects, however.
root-MacBook-Pro:~$ ping 192.168.52.1
PING 192.168.52.1 (192.168.52.1): 56 data bytes
Request timeout for icmp_seq 0
92 bytes from 192.168.50.1: Redirect Host(New addr: 192.168.50.4)
Vr HL TOS Len ID Flg off TTL Pro cks Src Dst
4 5 00 0054 ed0a 0 0000 3f 01 a6d0 192.168.50.124 192.168.52.1
Request timeout for icmp_seq 1
92 bytes from 192.168.50.1: Redirect Host(New addr: 192.168.50.4)
Vr HL TOS Len ID Flg off TTL Pro cks Src Dst
4 5 00 0054 9fa3 0 0000 3f 01 f437 192.168.50.124 192.168.52.1
Request timeout for icmp_seq 2
92 bytes from 192.168.50.1: Redirect Host(New addr: 192.168.50.4)
Vr HL TOS Len ID Flg off TTL Pro cks Src Dst
4 5 00 0054 2ac3 0 0000 3f 01 6918 192.168.50.124 192.168.52.1
Configs are below. Any thoughts on where I’ve gone wrong here???
# aug/08/2015 10:09:01 by RouterOS 6.13
# software id = UHJJ-Q7AV
#
/interface bridge
add l2mtu=1520 name=bridge1
/interface wireless security-profiles
add authentication-types=wpa-psk,wpa2-psk eap-methods="" management-protection=allowed mode=dynamic-keys name=Ripple supplicant-identity="" \
wpa-pre-shared-key=9897abcd wpa2-pre-shared-key=**********
add authentication-types=wpa2-psk eap-methods="" management-protection=allowed mode=dynamic-keys name=Nest supplicant-identity="" \
wpa2-pre-shared-key=*********
/interface wireless
set [ find default-name=wlan1 ] band=5ghz-a/n disabled=no ht-rxchains=0,1 ht-supported-mcs=\
mcs-0,mcs-1,mcs-2,mcs-3,mcs-4,mcs-5,mcs-6,mcs-7,mcs-8,mcs-9,mcs-10,mcs-11,mcs-12,mcs-13,mcs-14,mcs-15 ht-txchains=0,1 l2mtu=2290 mode=\
ap-bridge security-profile=Ripple ssid=ripple wireless-protocol=unspecified
/ip neighbor discovery
set wlan1 discover=no
/ip hotspot user profile
set [ find default=yes ] idle-timeout=none keepalive-timeout=2m mac-cookie-timeout=3d
/ip ipsec policy group
add name=remote
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-256-cbc lifetime=8h pfs-group=none
/ip pool
add name=dhcp_pool1 ranges=192.168.50.100-192.168.50.150
add name=remote ranges=192.168.51.1-192.168.51.10
/ip dhcp-server
add add-arp=yes address-pool=dhcp_pool1 disabled=no interface=bridge1 name=Home
/ip ipsec mode-config
add address-pool=remote name=remote-vpn split-include=192.168.50.0/24
/port
set 0 name=serial0
/ppp profile
add change-tcp-mss=yes dns-server=192.168.50.1 local-address=dhcp_pool1 name=RemoteVPN remote-address=remote
/system logging action
set 0 memory-lines=100
set 1 disk-lines-per-file=100
/interface bridge port
add bridge=bridge1 interface=wlan1
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=ether7
add bridge=bridge1 interface=ether9
add bridge=bridge1 interface=ether6
add bridge=bridge1 interface=ether8
add bridge=bridge1 interface=ether3
add bridge=bridge1
/interface l2tp-server server
set authentication=mschap2 default-profile=RemoteVPN enabled=yes
/ip address
add address=******** comment="outside" interface=ether1 network=*********
add address=192.168.50.1/24 interface=ether2 network=192.168.50.0
/ip dhcp-server network
add address=192.168.50.0/24 dns-server=192.168.50.1 domain=home.local gateway=192.168.50.1 netmask=24
/ip dns
set allow-remote-requests=yes servers=8.8.4.4,8.8.8.8,4.2.2.1,4.2.2.2
/ip dns static
add address=192.168.88.1 name=router
add address=192.168.50.10 name=vcenter
/ip firewall filter
add chain=input connection-state=new dst-port=500 in-interface=ether1 protocol=udp
add chain=input connection-state=new dst-port=4500 in-interface=ether1 protocol=udp
add chain=input dst-port=1701 in-interface=ether1 protocol=udp
add action=drop chain=input disabled=yes dst-address=198.0.154.161 dst-port=53 protocol=udp
add action=drop chain=input dst-address=198.0.154.160/29 dst-port=53 protocol=udp
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1
/ip ipsec peer
add enc-algorithm=3des exchange-mode=main-l2tp generate-policy=port-strict nat-traversal=yes secret=*******
add auth-method=pre-shared-key-xauth generate-policy=port-strict mode-config=remote-vpn nat-traversal=yes passive=yes policy-group=remote \
secret=*********
/ip ipsec policy
add disabled=yes dst-address=192.168.51.0/24 group=remote src-address=192.168.50.0/24 template=yes
add dst-address=192.168.50.0/24 group=remote src-address=192.168.51.0/24 template=yes
/ip route
add distance=1 gateway=198.0.154.166
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www address=192.168.50.0/24,192.168.51.0/24
set api disabled=yes
/ip upnp
set allow-disable-external-interface=no
/ppp secret
add name=jared password=************* profile=RemoteVPN service=l2tp
/routing ospf network
add area=backbone network=192.168.50.0/24
/system clock
set time-zone-name=America/New_York
/system clock manual
set dst-delta=-01:00 dst-end="nov/02/2014 02:00:00" dst-start="mar/09/2014 02:00:00" time-zone=-05:00
/system ntp client
set enabled=yes mode=unicast primary-ntp=173.255.238.118
[jared@MikroTik-CRS] > /export
# aug/08/2015 10:11:48 by RouterOS 6.30.2
# software id = 4WMX-3Q00
#
/interface bridge
add mtu=1500 name=br-vlan-storage
/interface ethernet
set [ find default-name=ether1 ] name=ether1-master-local
set [ find default-name=ether2 ] master-port=ether1-master-local name=ether2-slave-local
set [ find default-name=ether3 ] master-port=ether1-master-local name=ether3-slave-local
set [ find default-name=ether4 ] master-port=ether1-master-local name=ether4-slave-local
set [ find default-name=ether5 ] master-port=ether1-master-local name=ether5-slave-local
set [ find default-name=ether6 ] master-port=ether1-master-local name=ether6-slave-local
set [ find default-name=ether7 ] master-port=ether1-master-local name=ether7-slave-local
set [ find default-name=ether8 ] master-port=ether1-master-local name=ether8-slave-local
set [ find default-name=ether9 ] master-port=ether1-master-local name=ether9-slave-local
set [ find default-name=ether10 ] master-port=ether1-master-local name=ether10-slave-local
set [ find default-name=ether11 ] master-port=ether1-master-local name=ether11-slave-local
set [ find default-name=ether12 ] master-port=ether1-master-local name=ether12-slave-local
set [ find default-name=ether13 ] master-port=ether1-master-local name=ether13-slave-local
set [ find default-name=ether14 ] master-port=ether1-master-local name=ether14-slave-local
set [ find default-name=ether15 ] master-port=ether1-master-local name=ether15-slave-local
set [ find default-name=ether16 ] master-port=ether1-master-local name=ether16-slave-local
set [ find default-name=ether17 ] master-port=ether1-master-local name=ether17-slave-local
set [ find default-name=ether18 ] master-port=ether1-master-local name=ether18-slave-local
set [ find default-name=ether19 ] name=ether19-slave-local
set [ find default-name=ether20 ] name=ether20-slave-local
set [ find default-name=ether21 ] name=ether21-slave-local
set [ find default-name=ether22 ] name=ether22-slave-local
set [ find default-name=ether23 ] name=ether23-slave-local
set [ find default-name=ether24 ] name=ether24-slave-local
set [ find default-name=sfp1 ] master-port=ether1-master-local name=sfp1-slave-local
/interface vlan
add interface=br-vlan-storage l2mtu=1580 mtu=9000 name=storage vlan-id=10
/interface bonding
add link-monitoring=none mode=802.3ad name=synology slaves=ether19-slave-local,ether20-slave-local
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/interface bridge port
add bridge=br-vlan-storage interface=ether24-slave-local
add bridge=br-vlan-storage interface=ether23-slave-local
add bridge=br-vlan-storage interface=ether22-slave-local
add bridge=br-vlan-storage interface=ether21-slave-local
add bridge=br-vlan-storage interface=synology
add bridge=br-vlan-storage interface=storage
/interface ethernet switch port
set 0 dscp-based-qos-dscp-to-dscp-mapping=no
set 1 dscp-based-qos-dscp-to-dscp-mapping=no
set 2 dscp-based-qos-dscp-to-dscp-mapping=no
set 3 dscp-based-qos-dscp-to-dscp-mapping=no
set 4 dscp-based-qos-dscp-to-dscp-mapping=no
set 5 dscp-based-qos-dscp-to-dscp-mapping=no
set 6 dscp-based-qos-dscp-to-dscp-mapping=no
set 7 dscp-based-qos-dscp-to-dscp-mapping=no
set 8 dscp-based-qos-dscp-to-dscp-mapping=no
set 9 dscp-based-qos-dscp-to-dscp-mapping=no
set 10 dscp-based-qos-dscp-to-dscp-mapping=no
set 11 dscp-based-qos-dscp-to-dscp-mapping=no
set 12 dscp-based-qos-dscp-to-dscp-mapping=no
set 13 dscp-based-qos-dscp-to-dscp-mapping=no
set 14 dscp-based-qos-dscp-to-dscp-mapping=no
set 15 dscp-based-qos-dscp-to-dscp-mapping=no
set 16 dscp-based-qos-dscp-to-dscp-mapping=no
set 17 dscp-based-qos-dscp-to-dscp-mapping=no
set 18 dscp-based-qos-dscp-to-dscp-mapping=no
set 19 dscp-based-qos-dscp-to-dscp-mapping=no
set 20 dscp-based-qos-dscp-to-dscp-mapping=no
set 21 dscp-based-qos-dscp-to-dscp-mapping=no
set 22 dscp-based-qos-dscp-to-dscp-mapping=no
set 23 dscp-based-qos-dscp-to-dscp-mapping=no
set 24 dscp-based-qos-dscp-to-dscp-mapping=no
set 25 dscp-based-qos-dscp-to-dscp-mapping=no
/interface ethernet switch vlan
add learn=no ports=ether19-slave-local,ether20-slave-local,ether21-slave-local,ether22-slave-local,ether23-slave-local,ether24-slave-local vlan-id=10
/ip address
add address=192.168.50.4/24 comment="default configuration" interface=ether1-master-local network=192.168.50.0
add address=192.168.52.1/24 interface=storage network=192.168.52.0
/ip dns
set servers=8.8.4.4,8.8.8.8
/ip proxy
set cache-path=web-proxy1
/ip route
add distance=1 gateway=192.168.50.1
/routing ospf area range
add area=ospf-area-storage range=192.168.51.0/24
/routing ospf interface
add interface=ether1-master-local network-type=broadcast
/routing ospf network
add area=backbone network=192.168.50.0/24
add area=backbone network=192.168.52.0/24
/system clock
set time-zone-name=America/New_York
/system identity
set name=MikroTik-CRS
/system leds
set 0 interface=sfp1-slave-local
/tool romon port