Good morning,
I am running into a very weird problem. I have setup my mikrotik router with 2 vlans and I am using Port 2 to send the vlans to another building throug ethernet cable. In that building there is an unmanaged switch that distributes to 2 levell. In each of these levels, I have a TPlink multi ssip AP (that deals with vlans)… Please see picture attached.
When I configure the multi ssid AP with vlan 10 and vlan 100 and connect to vlan100 wirelessly everything works fine except I dont see Iot devices connected to the unmanaged switch (NAS). If I replace in tplink multi ssid ap the vlan 100 number by vlan 1, I still get the same IP address and then I can see the NAS, printer …etc.
For wired clients plugged to the managed switch likemy PC, everything works fine also, and it can ping the NAs also.
Here is my config if you can please have a look and tell me what I am doing wrong.
Many thanks
Image link: https://domaineschefchaouni.synology.me:5001/d/s/nnVs746pQeZ0OeLrG1jGpKKHUm7TqvLv/hwoXCx7ePtCAx-PbvAdXkL392ZDB0tIz-cr7gsFX8Wgk
Well…thank you for your reply which is a natural one, but costy as we have unmanaged switches that do work fine. I would just like ton understand shy I have to input vlan 1 in the AP instead of 100 in order to be able to ping the vlan100 devices plugged in the unmanaged switches.
The config you’re showing is a trimmed … as things are often broken due to some unexpected setting it is fair to people willing to help to publish complete setup, not only the part you think it’s important …
The quoted part says that router strips VLAN tags on egress for both VLAN ID 10 and 100 (the later is implicit untagged member of said VLAN in vlan section shown above). And adds VLAN tag to untagged frames on ingress with VID 100.
So if you configure AP to use tagged VLAN 100, it won’t accept packets from router since they will be untagged. And many vendors (including MT with default setup) use VLAN ID 1 as a placeholder for untagged …
If you struggle (it seems you do) with VLAN setup, then study this tutorial.
BTW, using dumb switches isn’t really breaking your LAN, but doesn’t help either.
Thank you very much for your reply.
Are you basiclly saying that there is nothing wron with this configuration and I just have to use vlan 1 in my AP configuration if I want to tage the vlan 100 coming from mikrotik?
Hmm, okay lets ignore the unmanaged switch then and assume it is FULLY capable of passing vlan tags, I would never assume this and thus why not advising use of unmanaged switch.
However if you are going to send both vlans to the switch then dont send them untagged. SEND THEM TAGGED, and hopefully the APs will also get them and handle them appropriately
If the unmanged switch cannot handle vlan tags, then you are stuck to using a single subnet in that other building.
No! The OP has untagged devices attached to the unmanaged switch, the main network should remain untagged on the connection from the Mikrotik to the switch.
Whilst piggybacking a tagged network on top of this setup is not ideal, as all the regular attached devices will receive the VLAN-encapsulated packets, it will usually work as most unmanaged switches will pass all ethertypes, including 802.1Q VLAN.
The AP should connect its main SSID to untagged traffic and the secondary SSID to the tagged traffic with the appropriate VLAN ID.
ONLY ONE untagged subnet can be sent from the Mikrotik device.
SO what you are saying is that ETHER2 is a hybrid port and VLAN100 is the one that other devices on the switch need access to…
Hi guys,
I have changed a bit the config as suggested. Every item which connects to one of SSIDs gets its ip and access to the internet like it should but you can access the NAS only if you put vlan 1 instead of 100 in the vlan configuration AP. Any tought why is it behaving like that?
NAS gets the correct IP address on vlan 100 and connects to the internet and everything works great. It is the wirelessly connected devices on the AP that do not see it.
Wirelss connencted devices (phones / laptops…etc) gets the correct subnet according to the ssid they connect to with no worries.
The vlan 1 in mikrotik is normally the one attached to BR1 but bizarrely, when used in AP it points to vlan100. When we use vlan100 in AP config, we get .0.x address but we don’t see the NAS. When we use vlan1 in AP config, we still get 0.x address but we do see the NAS.
I am lost
Thanks
Of course, you are setting up the access point incorrectly.
Once past the MT, there is no VLAN100 its a basic flat subnet available and hiding in that traffic is also vlan10 which only vlan aware devices will see and can make use of.
So dont declare vlan100 on the Access point, doesnt exist external to it.
Start with that subnet for the WLAn associated , and then add vlan10 after and attach it to the required WLAN…
Thank you so I have used 1 as vlan for the “mikrotik vlan 100” in the AP configuration, and it seems to see the rest of the network now.
Regarding the ehter 2 or ether 3 ports, they are defaulted to 0.x adress as per config, but when I attach an aP to one of these ports, it happens that some applications have trouble running (but most work). Is it related to the untagged vs tagged traffic?
Example: if I connect on the AP with my phone on vlan 1 (0.xaddress) everything works except let’s say one application that communicate with the outside world (like a remote surveillance site). But if i connect on vlan 10 on that AP, this same application works. As vlan10 traffic is tagged, i suspect this is causing the problem but just wondering.
Change this
/interface bridge port
add bridge=BR1 ingress-filtering=yes interface=ether2 pvid=100
to this
/interface bridge port
add bridge=BR1 interface=ether2 pvid=100
It would help if you explained what the “some applications” are that “have trouble running”, and what the symptoms are. We are not mind readers.
My guess is that it is more likely to be an issue with a firewall (possibly on the device you are connecting to) that doesn’t want to talk to a device outside its subnet, or that there is some protocol that expects to be on the same broadcast domain (mDNS) etc.
But you haven’t posted a complete config. I see nowhere that you have /interface vlan add …
If you want help, make it as easy as possible for the people trying to help. That means providing a network diagram, complete export, and an example of the error messages you are getting.
Thank you very much Anav for your answer. Removing the ingress option apparently did not help. What I notice is that the issue happens ont ether 3 APs (which are only on vlan100) and on ether 2 vlan 100 APs (on vlan10 it works).
Do you have an idea why ? MAny thanks
My guess is the unmanaged switch is not fully capable of transmitting vlan tags in such a way that this all works…
Other than that paste the lastest config of the router and the AP please.