Switch-chip config RB951Ui-2HnD

RouterOS General
1

Hello dear sirs,

trying hard (and failing hard too) to use switch chip functionality on RB951Ui-2HnD (without logical bridge interface). I need to switch some vlans between ports using switch chip and do inter-vlan routing on other vlans too. I stripped all the mess to one vlan id=100 in the config below. PC connected to ether2 can’t even ping ether1.100 address.

# dec/24/2020 15:50:03 by RouterOS 6.46.8
# software id = H75K-QJ4R
#
# model = 951Ui-2HnD
# serial number = 4AC704B705E3
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX disabled=no distance=indoors frequency=auto installation=indoor mode=ap-bridge ssid=MikroTik-706472 \
    wireless-protocol=802.11
/interface vlan
add interface=ether1 name=ether1.100 vlan-id=100
/interface ethernet switch port
set 0 vlan-mode=secure
set 1 default-vlan-id=100 vlan-header=always-strip vlan-mode=secure
set 2 vlan-mode=fallback
set 3 vlan-mode=fallback
set 4 vlan-mode=fallback
set 5 vlan-header=add-if-missing vlan-mode=secure
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp disabled=no name=defconf
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface ethernet switch vlan
add ports=ether1,ether2,switch1-cpu switch=switch1 vlan-id=100
/interface list member
add comment=defconf list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf network=192.168.88.0
add address=192.168.100.2/24 interface=ether1.100 network=192.168.100.0
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input dst-port=22 protocol=tcp
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" disabled=yes in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
/system clock
set time-zone-name=Asia/Novokuznetsk
/system identity
set name=Test-GW
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

And I don’t even see host MACs:

[admin@Test-GW] > interface ethernet switch host print
Flags: D - dynamic, I - invalid
 #   SWITCH                                                         MAC-ADDRESS       PORTS                                                         TIMEOUT DROP MIRROR VLAN-ID
[admin@Test-GW] >

Am I going in the right direction or I have to user bridge functionality with hardware offload on that board?

Thanks in advance for your help.

Regards,
Konstantin

2

The VLAN definition and port 1 configuration is OK.
The other ports, not so much.

3

I’m pretty sure that ether1.100 is configured OK as I’m using it for CLI access :slight_smile: What’s the problem with other config then?

4

I mean the other switchports. Those configs are likely not what you want. Port 1 is configured for untagged VLAN 100.

5

If I got switch chip concept right all the VLAN interfaces on ether1 is internally connected to switch-cpu port. So, in switch config ether1 and switch-cpu are tagged (or trunk in Cisco lingo) and ether2 is untagged with default VLAN 100 (or access in Cisco lingo).

VLAN header for ether1 set to ‘leave-as-is’, tried ‘add-if-missed’ - no luck.

[admin@Test-GW] > interface ethernet switch port print
Flags: I - invalid
 #   NAME                                                            SWITCH                                                            VLAN-MODE VLAN-HEADER    DEFAULT-VLAN-ID
 0   ether1                                                          switch1                                                           secure    leave-as-is                  0
 1   ether2                                                          switch1                                                           secure    always-strip               100
 2   ether3                                                          switch1                                                           fallback  leave-as-is                  0
 3   ether4                                                          switch1                                                           fallback  leave-as-is                  0
 4   ether5                                                          switch1                                                           fallback  leave-as-is                  0
 5   switch1-cpu                                                     switch1                                                           secure    add-if-missing               0
6

You have to create a bridge with vlan-filtering=no to use the switch chip, see https://wiki.mikrotik.com/wiki/Manual:Switch_Chip_Features#VLAN_Example_1_.28Trunk_and_Access_Ports.29, https://wiki.mikrotik.com/wiki/Manual:Switch_Chip_Features#Management_access_configuration and https://wiki.mikrotik.com/wiki/Manual:Switch_Router

7

Thanks for detailed answer! I’ll give it a shot.

So, as I wrote in a starting post - we can’t do this without creating logical bridge.


8

Yes. The switch chip is always used, creating a bridge and adding ports with hardware offload reconfigures the switch chip at which point the 802.1Q VLAN setup can be made. Without a bridge being configured port-based VLANs are used to multiplex the physical ethernet ports to the logical interfaces visible in Winbox / CLI as there is only a single ethernet interface between the switch chip and the CPU - this configuration is not visible to the user.