One CCR with 3 interfaces in bridge. This bridge has rstp enabled and gets mac address of interface with the lowest mac.
This bridge now actually transparently passes several vlan’s from AP’s towards concentrator (rb1000) that performs dhcp-server (and later PPoE server)
Since the CCR has one other port (not part of the bridge) that is connected to internet I have to make sure that after traffic from clients (from AP’s) that has been given IP and def. route these clients can connect to WAN-port of CCR.
So for each vlan transparantly passing the bridge in CCR I make one vlan interface (same ID and service tag enabled) that has as its ‘parent interface’ the bridge.
All bridges everwhere have rtsp enabled.
All vlans have arp=proxy-arp or ‘reply-only’ enabled
After associating to AP the client now connects via vlan to concentrator and gets IP address and a gateway address. This last is actually the IP of the vlan residing on the CCR-bridge. In the CCR routing to a new def. gateway now takes care for internet access. (with firewall, src and dst nat and public IP assignments etc…)
It all works… it looks like. Traffic flows, clients are connected… no prob.
BUT: Traffic flow is irregularly halted. ALL traffic flow from all vlans seems to get halted at times. But ping from any router in the network towards same CCR (via physical routed or partially bridged, network) does hardly show lost packages. Only when a traffic halt is severe, it is reflected in a small ping drop towards the CCR. Most internet traffic is not affected by it. Streaming radio, video, it all runs without interrupts. Only a handfull of clients complain about broken video streams and indeed I can see ‘disconnects’ on a ping stream toward their wifi routers.
So, something is wrong. But what?
What I am not 100% sure off, and where little info is to be found, is the mac addresses of the individual vlans and the needed arp setting in the vlan interface. Basically up to know I just ‘played around’ until I think it works and copy similar setting to new vlan…
Each individual vlan that is residing on the bridge (for the moment I have 8 vlans) gets the same mac address as that bridge.
As we saw before, that bridge already has the same mac as physical interface with the lowest mac.
Each individual vlan’s ‘exit’ (here actually traffic from vlan should exit the bridge to get routed to the internet.) gets its own individual IP address from its own individual IP-network. Because it is the def. gateway address for that specific vlan.
So, now from the client’s perspective, a router ‘sees’ through the vlan tunnel an end point with a certain mac (or not if only proxy-arp/reply-only is enabled?) with its def. gateway IP address.
But it also ‘sees’ a mac from the bridge?
And it sees 7 other IP-mac combinations, all the same mac address, but in reality all on different vlans. All they (“should”) share is the bridge.
I am wondering if this is now the right procedure?
These vlan’s, should they have ‘proxy-arp’ or ‘reply-only’ on their arp setting? Or disabled/enabled? Explanation please…
Should I give each vlan a new, unique, mac address? (And in case ‘yes’ can I just ‘up’ the last digit one digit?)
Or should I put all the def. gateway addresses for each vlan on the bridge itself? (I tried, traffic stops immediate. But ok, maybe the arp and routing tables need time to update. I don’t dare to try afraid of denying internet to loads of clients…)
(I’ll try to make a drawing/sketch of it…)
