Hello Mikrotik people.
I have bought 2 CRS-switches to my home and I want to configure 2 VLANs.
In this test I have two switches connected with a cable between eachother, then 4 cables goes out to 4 computers.
Topology
Since I’m pretty new into Mikrotik routers and switches I followed the guide here: http://wiki.mikrotik.com/wiki/Manual:CRS_examples#Port_Based_VLAN
Configuration on the switches - Please note that this is the configuration for the CRS225 side. Every time you see ether17, the same configuration is applied to the CRS125 but with port ether24 instead. Everything else is the same.
!Part 1 - Setting the trunk link to master port none and the access ports to have ether17 as master port.
/interface ethernet set ether17 master-port=none
/interface ethernet set ether13 master-port=ether17
/interface ethernet set ether14 master-port=ether17
!Part 2 - Applies tagging functionality on egress traffic and adding the switch1-cpu for tagging functionality what I have read
/interface ethernet switch egress-vlan-tag add tagged-ports=ether13,switch1-cpu vlan-id=10
/interface ethernet switch egress-vlan-tag add tagged-ports=ether14,switch1-cpu vlan-id=200
!Part 3 - Configures access ports to tag incoming traffic
/interface ethernet switch ingress-vlan-translation add ports=ether13 customer-vid=0 new-customer-vid=10 sa-learning=yes
/interface ethernet switch ingress-vlan-translation add ports=ether14 customer-vid=0 new-customer-vid=200 sa-learning=yes
!Part 4 - Makes a logic switch that enables communication between all the ports within a VLAN.
/interface ethernet switch vlan add ports=ether13,ether17, switch1-cpu vlan-id=10
/interface ethernet switch vlan add ports=ether14,ether17, switch1-cpu vlan-id=200
!Part 5 - Creates a Vlan interface on ether17 to enable VLAN traffic to travel over the trunk link (What I have read. May not be necessary)
/interface vlan add interface=ether24 name=Vlan10
/interface vlan add interface=ether24 name=Vlan200
Verification
PC1 can now make a successful ping to PC3. PC2 can also make a successful ping to PC4 as expected.
THE PROBLEM
PC1 can ping PC4 and PC2 can ping PC3 if they change the IP address to an address within each specific subnet.
Conclusion
- The Mikrotik switches is either wrongly configured and is not tagging the VLANs correctly and as a result is leaking traffic.
- The Mikrotik switches is correctly configured but acts strange and is leaking traffic.
What do I do now?
I have tried to enable a function called “/interface ethernet switch set forward-unknown-vlan=no” but that doesn’t affect this at all. All other ports on the switch that has the default configuration simply stops forwarding traffic, but since these ports have static VLANs assigned to them, these ports are classified as “not unknown” and can therefor still forward traffic. But with vlan leaking.