I have a CRS310 that has an interface on a VLAN for managing the device itself. I can SSH, wegfig, etc. All of the stuff to manage the device.
However, I am noticing that I cannot get router initiated traffic out of the device. Surely I missed something simple.
/interface bridge
add admin-mac=xxxaa auto-mac=no comment=bridge frame-types=admit-only-vlan-tagged name=br1 protocol-mode=stp vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] disabled=yes name=g1
set [ find default-name=ether2 ] disabled=yes name=g2
set [ find default-name=ether3 ] disabled=yes name=g3
set [ find default-name=ether4 ] disabled=yes name=g4
set [ find default-name=ether5 ] disabled=yes name=g5
set [ find default-name=ether6 ] disabled=yes name=g6
set [ find default-name=ether7 ] disabled=yes name=g7
set [ find default-name=ether8 ] disabled=yes name=g8
set [ find default-name=sfp-sfpplus1 ] name=t1
set [ find default-name=sfp-sfpplus2 ] name=t2
/interface vlan
add comment=Mgmt interface=br1 name=vlan128 vlan-id=128
/interface bonding
add comment="20G to CRS326" mode=802.3ad name=bond1 slaves=t1,t2
/interface list
add comment="Limit Neighbor Discovery" name=no-discovery
/snmp community
set [ find default=yes ] disabled=yes
add addresses=192.168.128.42/32 authentication-password=xxx authentication-protocol=SHA1 encryption-password=yyy encryption-protocol=AES name=zzz security=authorized write-access=yes
/system logging action
set 3 remote=192.168.128.42
add name=TCPSyslog remote=192.168.128.42 remote-log-format=syslog remote-port=601 remote-protocol=tcp syslog-facility=syslog target=remote
/user group
set full skin=Limitedaa
/interface bridge port
add bridge=br1 comment="20G to CRS326" frame-types=admit-only-vlan-tagged interface=bond1
add bridge=br1 comment=defconf interface=g1
add bridge=br1 comment=defconf interface=g2
add bridge=br1 comment=defconf interface=g3
add bridge=br1 comment=defconf interface=g4
add bridge=br1 comment=defconf interface=g5
add bridge=br1 comment=defconf interface=g6
add bridge=br1 comment=defconf interface=g7
add bridge=br1 comment=defconf interface=g8
/ip neighbor discovery-settings
set discover-interface-list=!no-discovery lldp-med-net-policy-vlan=1
/interface bridge vlan
add bridge=br1 comment=Service tagged=bond1 vlan-ids=128
add bridge=br1 comment=User tagged=bond1 vlan-ids=1
add bridge=br1 comment=Secrets tagged=bond1 vlan-ids=129
add bridge=br1 comment=Guests tagged=bond1 vlan-ids=138
add bridge=br1 comment=Sync tagged=bond1 vlan-ids=353
add bridge=br1 comment="Firewall Inside" tagged=bond1 vlan-ids=1353
add bridge=br1 comment=Outside tagged=bond1 vlan-ids=1357
/ip address
add address=192.168.128.22/24 comment=Mgmt interface=vlan128 network=192.168.128.0
/ip cloud
set update-time=no
/ip dns
set servers=192.168.128.15,192.168.128.16
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=192.168.128.1 routing-table=main suppress-hw-offload=no
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set www-ssl certificate=crs310.dmz disabled=no
set api disabled=yes
set api-ssl certificate=crs310.dmz
/ip ssh
set host-key-size=4096 strong-crypto=yes
/snmp
set contact="Admin <user@gmail.com>" enabled=yes location="Rack1, Room1, Site1" trap-community=zzz trap-interfaces=vlan128 trap-target=192.168.128.42 trap-version=3
/system clock
set time-zone-name=America/Somewhere
/system identity
set name=CRS310
/system logging
add action=TCPSyslog topics="account,bridge,clock,critical,error,event,health,info,interface,ntp,script,snmp,ssh,stp,system,update"
/system note
set note="No one but the owner of this device may access." show-at-cli-login=yes
/system ntp client
set enabled=yes
/system ntp client servers
add address=192.168.128.51
add address=192.168.128.52
/system script
add comment="VLAN Membership Scraper" dont-require-permissions=no name=LNMS_vlans owner=secureuser policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="###\n### LibreNMS \"glue\" script for routeros vlans discovery\n### https://github.com/librenms/librenms/pull/13427\n###\n\n:global vlanst [:toarray \"\"]\n:global vlansu [:toarray \"\"]\n\n:foreach i in [/interface bridge vlan find] do={\n :local intf [/interface bridge vlan get \$i bridge]\n :local vlid [/interface bridge vlan get \$i vlan-ids]\n :local vname\n\n :foreach i in [/interface vlan find where vlan-id=\$vlid] do={\n :local intname [/interface vlan get \$i name]\n :set \$vname (\$intname)\n }\n\n :foreach t in [/interface bridge vlan get \$i tagged] do={\n :set \$vlanst (\$vlanst, \"\$vlid,\$t,\$vname\")\n }\n\n :foreach u in [/interface bridge vlan get \$i current-untagged] do={\n :set \$vlansu (\$vlansu, \"\$vlid,\$u,\$vname\")\n }\n\n :foreach u in [/interface bridge port find where bridge=\$intf and pvid=\$vlid] do={\n :local iu [/interface bridge port get \$u interface]\n :local fl 0\n :foreach tmp in \$vlansu do={\n :local ar [:toarray \$tmp]\n :if (((\$ar->0) = \$vlid) && ((\$ar->1) = \$iu)) do={\n :set fl 1\n }\n }\n :if ( \$fl != 1 ) do={\n :set \$vlansu (\$vlansu, \"\$vlid,\$iu,\$vname\")\n }\n }\n}\n\n:foreach vl in [/interface vlan find ] do={\n :local intf [/interface vlan get \$vl interface]\n :local vlid [/interface vlan get \$vl vlan-id]\n :local vname [/interface vlan get \$vl name]\n :local fl 0\n\n :foreach tmp in \$vlanst do={\n :local ar [:toarray \$tmp]\n :if (((\$ar->0) = \$vlid) && ((\$ar->1) = \$intf)) do={\n :set fl 1\n }\n }\n :if ( \$fl != 1 ) do={\n :set \$vlanst (\$vlanst, \"\$vlid,\$intf,\$vname\")\n }\n}\n\n:foreach tmp in \$vlanst do={\n :put \"T,\$tmp\"\n}\n\n:foreach tmp in \$vlansu do={\n :put \"U,\$tmp\"\n}\n"
/tool bandwidth-server
set enabled=no
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=none
/tool mac-server ping
set enabled=no
