I am confused from the get go, (coming out of my mothers womb), but what the heck does this mean…..
I am using the CRS510 in switch mode??? The config provided shows you discussing LAN and WAN which is router speak???
Your diagram gives NO indication of where the internet connection is located, I can only assume that an upstream router is connected to the CISCO switch. Thus we should expect a trunk port from the CISCO switch to the CRS510??
Then there is the problem of your ports, Which one is the 10/100 Managment port ( is that identified as ether1 on this device??? Also if its a 510 it has 8 spf28 ports (25 gig) and 2 Qspf ports (100gig).
Why does your config show ( in /interface ethernet settings), 8 Qsfp ports??
I dont have one of these units but will consider the actual two ports to be named
qsfp28-1-1 and qsfp28-2-1 to match actual config usage ( as seen in /interface bridge vlans )
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
I am used to configs for the CRS3, series, and if its the same for CR5, the following comments apply:
- Regardless of the scenario, I highly recommend, especially when using vlan bridge filtering, is to create a safe spot, to both config the device, and to do any emergency access to the device that is INDEPENDENT of the bridge. AKA an off bridge dedicated port. In this case the mgmt port 10/100 is perfect for this idea. Use one of the spf28 ports to connect to the cisco, and for example purposes will use spf28-7 seeing as you want to use this a local admin port, but basically a useless idea especially seeing as you also have spf28-8 also being used as access port for the admin vlan.
/interface ethernet
set [ find default-name=ether1?? ] name=OffBridgeMgmt
/ip address
add address=192.168.55.1/30 interface=OffBridgeMgmt network=192.168.55.0
Make sure the interface has access to the config etc ( part of trusted interface list ).
Simply plug in PC to the mgmt port, change IPV4 settings to 192.168.55.2 and with username and password you should be in. No more losing connection when you make changes!!!
Now onto the config……….
Understand from above that vlan4 is your management vlan where ALL smart devices on your network get their IP address. You will be able connect to the CRS510 from any location on your network that has vlan4 accesss ( like a PC off the cisco switch for example ). If the bridge burps on you, no problem, you have the off bridge port on the device itself for emerg access later.
Use winbox to configure any MT device, so much easier!!
spf28-7, connects to the CISCO, this should be a TRUNK PORT ALL VLANS Tagged.
(2,3,4).
Gi35 on the CISCO should be trunk port ALL Tagged (2,3,4) going to the mikrotik.
Ingress filtering should be applied to all trunk and access ports, so fixed.
Both qsfp ports contradict their own settings, so for now will assume they are trunk ports
Only vlan4 requires the bridge local to be tagged…………….
All trunk ports aka going to smart devices needs to be tagged with vlan 4 ( thats where/how all smart devices get their IP address!! )
++++++++++++++++++++++++++++++++++++++++++++++++
```
model = CRS510-8XS-2XQ
/interface bridge
add admin-mac=F4xx auto-mac=no name=bridgeLocal
vlan-filtering=no { Turn ON after completing config from offbridge location }
/interface ethernet
set [ find default-name=ether1 ] name=OffBridgeMgmt
set [ find default-name=qsfp28-1-1 ] auto-negotiation=no
speed=10G-baseSR-LR comment="Trunk Port"
set [ find default-name=qsfp28-2-1 ] auto-negotiation=no comment=
speed=10G-baseSR-LR comment="Trunk Port"
set [ find default-name=sfp28-1 ] auto-negotiation=no speed=10G-baseSR-LR
set [ find default-name=sfp28-2 ] auto-negotiation=no speed=10G-baseSR-LR
set [ find default-name=sfp28-3 ] auto-negotiation=no speed=10G-baseSR-LR
set [ find default-name=sfp28-4 ] auto-negotiation=no speed=10G-baseSR-LR
set [ find default-name=sfp28-5 ] auto-negotiation=no speed=10G-baseSR-LR
set [ find default-name=sfp28-6 ] auto-negotiation=no speed=10G-baseSR-LR
set [ find default-name=sfp28-7 ] auto-negotiation=no comment="TRUNK to CISCO"
set [ find default-name=sfp28-8 ] auto-negotiation=no comment="Access admin port"
/interface vlan
add comment=MGMT-4 interface=bridgeLocal l3-hw-offloading=no name=MGMT-4
vlan-id=4
/interface list
add name=TRUSTED
/ip neighbours discovery
set interface-list=TRUSTED
/interface bridge port
add bridge=bridgeLocal ingress-filtering=yes frame-types=
admit-only-vlan-tagged interface=qsfp28-1-1
mvrp-applicant-state=non-participant mvrp-registrar-state=fixed
add bridge=bridgeLocal ingress-filtering=yes frame-types=
admit-only-vlan-tagged interface=qsfp28-2-1
mvrp-applicant-state=non-participant mvrp-registrar-state=fixed
add bridge=bridgeLocal ingress-filtering=yes frame-types=admit-only-vlan-tagged
interface=sfp28-1 mvrp-applicant-state=non-participant
mvrp-registrar-state=fixed
add bridge=bridgeLocal ingress-filtering=yes frame-types=admit-only-vlan-tagged
interface=sfp28-2 mvrp-applicant-state=non-participant
mvrp-registrar-state=fixed unknown-unicast-flood=no
add bridge=bridgeLocal ingress-filtering=yes frame-types=admit-only-vlan-tagged
interface=sfp28-3 mvrp-applicant-state=non-participant
mvrp-registrar-state=fixed
add bridge=bridgeLocal ingress-filtering=yes frame-types=admit-only-vlan-tagged
interface=sfp28-4 mvrp-applicant-state=non-participant
mvrp-registrar-state=fixed
add bridge=bridgeLocal ingress-filtering=yes frame-types=admit-only-vlan-tagged
interface=sfp28-5 mvrp-applicant-state=non-participant
mvrp-registrar-state=fixed
add bridge=bridgeLocal ingress-filtering=yes frame-types=admit-only-vlan-tagged
interface=sfp28-6 mvrp-applicant-state=non-participant
mvrp-registrar-state=fixed
add bridge=BridgeLocal ingress-filtering=yes frame-types=admin-only-vlan-tagged
interface=sfp28-7 mvrp-applicant-state=non-participant
mvrp-registrar-state=fixed comment="TRUNK PORT TO CISCO"
add bridge=bridgeLocal comment=defconf interface=sfp28-8
mvrp-applicant-state=non-participant mvrp-registrar-state=fixed
ingress-filtering=yes frame-types=admit-priority-and untagged pvid=4
/ipv6 settings
set disable-ipv6=yes
/interface bridge vlan
add bridge=bridgeLocal tagged=bridgeLocal,sfp28-7,qsfp28-1-1,qsfp28-2-1,sfp28-1,
sfp28-2,sfp28-3,sfp28-4,sfp28-5,sfp28-6, untagged=sfp28-8 vlan-ids=4
add bridge=bridgeLocal comment=vlan-test-3 tagged="bridgeLocal,sfp28-7,qsfp28-1-1,
qsfp28-2-1,sfp28-2,sfp28-4,sfp28-6 vlan-ids=3
add bridge=bridgeLocal comment=vlan-test-2 tagged=bridgeLocal,sfp28-7,qsfp28-1-1,
qsfp28-2-1,sfp28-1,sfp28-3,sfp28-5 vlan-ids=2
/interface list member
add interface=MGMT-4 list=TRUSTED
add interface=OffBridgeMgmt list=TRUSTED
/ip address
add address=xx.9/24 comment=Admin interface=MGMT-4 network=xx.0
add address=192.168.55.1/30 interface=OffBridgeMgmt network=192.168.55.0
/ip dns
set servers=xx.1/24
/ip route
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=xx.1
routing-table=main suppress-hw-offload=no
/system clock
set time-zone-name=Europe/Paris
/system identity
set name=MikroTik-01
/system routerboard settings
set enter-setup-on=delete-key
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=TRUSTED
```
