While I’m new to Mikrotik I have a fair amount of networking experience, it’s just a little old now. I’ve only done higher level networking operations over the last 10 years or so, and apparently I’m a little rusty. Trying to reconcile the terminology between vendors isn’t making it any easier. If anyone has some time to look over what I’m doing here on the Mikrotik side and let me know if there’s something I’m still not getting I’d appreciate it.
This is an office with less than 50 users at peak, with very slow predictable growth. There are phones (voip) and a lot of BYOD activity (phones and more), but it’s generally a small network with relatively predictable usage patterns. The biggest challenge for this network is that it makes fairly heavy use of video chat – which is why we’re actually migrating to this new setup vs the off-the-shelf hardware that was in use before. Because of this, I am trying to keep the design as simple as possible.
Office Network Plan.png
My hope was that I could create a small “switch” between the two trunked uplinks from the ProCurve switches for local traffic, while allowing traffic destined out of the network to go directly out. (I don’t have stacking modules for the ProCurves). I configured the router like so:
/interface bridge
add name=br-internet
add name=br-legacy priority=0xC8
add name=br-office-lan priority=0x64
/interface vlan
add interface=br-legacy l2mtu=65527 name=DEFAULT vlan-id=1
add interface=br-office-lan l2mtu=65519 name=OFFICE vlan-id=2
add interface=br-office-lan l2mtu=65519 name=VOICE vlan-id=4
/interface bonding
add mode=802.3ad name=ProCurve1 slaves=sfp3,sfp4
add mode=802.3ad name=ProCurve2 slaves=sfp5,sfp6
/interface bridge port
add bridge=br-legacy interface=sfp1
add bridge=br-legacy interface=DEFAULT
add bridge=br-office-lan interface=OFFICE
add bridge=br-office-lan interface=VOICE
add bridge=br-office-lan interface=ProCurve1
add bridge=br-office-lan interface=ProCurve2
add bridge=br-office-lan interface=sfp12
add bridge=br-internet interface=sfp2
/ip address
add address=10.0.0.1/23 interface=DEFAULT network=10.0.0.0
add address=10.0.2.1/23 interface=OFFICE network=10.0.2.0
add address=10.0.4.1/23 interface=VOICE network=10.0.4.0
/ip dhcp-client
dhcp-options=hostname,clientid interface=br-internet
/ip firewall nat
add action=masquerade chain=srcnat out-interface=br-internet src-address=10.0.0.0/23
add action=masquerade chain=srcnat out-interface=br-internet src-address=10.0.2.0/23
add action=masquerade chain=srcnat out-interface=br-internet src-address=10.0.4.0/23
As I understand it, this should create a small switch between the two trunks on 3&4 and 5&6 that will carry tagged traffic for the relevant VLANs between them, as anytime a packet comes in destined for the other trunk it’ll end up going out a VLAN interface, so it’ll be tagged for that VLAN. So, SFP12 should also function as an access port for those VLANs.
Have I understood this correctly? I suspect my problem is probably on the ProCurve side, so I want to eliminate the router as a possible cause. Specifically right now, I have only the one switch (SFP3&4) hooked up, and I cannot ping the router from the switch through the bonded ports (even though both sides show those ports and the LACP as up).