Do I get this right?
My configuration is using CPU to do tagging as it occurs on bridge even though ether2-ether5 are switched?
Traffic flow between ether2 - ether5 are switched or are they also processed by CPU?
/interface bridge
add l2mtu=1594 name=bridge-VLAN20
/interface ethernet
set [ find default-name=ether3 ] master-port=ether2
set [ find default-name=ether4 ] master-port=ether2
set [ find default-name=ether5 ] master-port=ether2
/interface vlan
add interface=ether1 l2mtu=1594 name=vlan20 vlan-id=20
/interface bridge port
add bridge=bridge-VLAN20 interface=vlan20
add bridge=bridge-VLAN20 interface=ether2
/ip address
add address=192.168.20.2/24 interface=bridge-VLAN20 network=192.168.20.0
/ip route
add distance=1 gateway=192.168.20.1
many thanks.
as soon as your traffic is going over a bridge it’s processed by the cpu. if you just want a trunk port (ether1) with tagged traffic and port ether2-ether5 simple untagged traffic which belongs to VLAN20 you can let the switchchip do all the work. i configured something like this on my rb2011 lab device. i also added a 2nd vlan with id 666 which is tagged on port 1 put not reachable from any other port
this is the export ( i cut out what is not relevant for you "problem’ )
/interface ethernet
set 1 master-port=ether1
set 2 master-port=ether1
set 3 master-port=ether1
set 4 master-port=ether1
/interface vlan
add interface=ether1 l2mtu=1594 name=vlan20 vlan-id=20
add interface=ether1 l2mtu=1594 name=vlan666 vlan-id=666
/interface ethernet switch port
set 1 default-vlan-id=3000 vlan-header=add-if-missing vlan-mode=secure
set 2 default-vlan-id=20 vlan-header=always-strip vlan-mode=secure
set 3 default-vlan-id=20 vlan-header=always-strip vlan-mode=secure
set 4 default-vlan-id=20 vlan-header=always-strip vlan-mode=secure
set 5 default-vlan-id=20 vlan-header=always-strip vlan-mode=secure
set 11 vlan-mode=secure
/interface ethernet switch vlan
add independent-learning=yes
ports=ether1,ether2,ether3,ether4,ether5,switch1_cpu switch=switch1
vlan-id=20
add independent-learning=yes ports=ether1,switch1_cpu switch=switch1
vlan-id=666
/ip address
add address=192.168.20.2/24 interface=vlan20 network=192.168.20.0