I just added the CCTV into the Hap AC2, previously it was on a port from a CRS328 running switch OS that I now need for something else.
**Problem:**I need to set the PVID on ether5 to CCTV vlan (lets call it 5) so all packets entering from camera are tagged, and traffic leaving is untagged back to the camera.
[user@MikroTik] > interface ethernet switch print
Flags: I - invalid
# NAME TYPE MIRROR-SOURCE MIRROR-TARGET SWITCH-ALL-PORTS
0 switch1 Atheros-8327 none none
I do not want to VLAN the other ports or VLAN the management interface, I just want to tag traffic on ether5 to the vlan and make sure it exits ether1 tagged to the upstream switch.
Setting DEFAULT-VLAN-ID in “interface ethernet switch port” does not do this, and I have ether1 and ether 5 in the VLAN-ID in “Interface ethernet switch vlan”
/interface ethernet switch port
set 0 vlan-mode=secure
set 1 vlan-mode=secure
set 2 vlan-mode=secure
set 3 vlan-mode=secure
set 4 vlan-mode=secure
set 5 default-vlan-id=5 vlan-header=always-strip vlan-mode=secure
/interface ethernet switch vlan
add independent-learning=no ports="switch1-cpu,ether1,ether5" switch=switch1 vlan-id=5
Thanks P1chl, I had the same issue with that as I did with the tutorial in the manual, once I enable secure on ether1 (uplink) I lose connection to the hap ac2.
Can’t solve from my desk now will need to take a laptop to where the router is located as can’t connect even with winbox/Mac address.
When you do things like this, ALWAYS enable “safe mode” before
I copied this from a working environment, where there are several VLANs and one of them is made untagged this way.
However, I realize that in that router there is no “default untagged VLAN” (commonly called “vlan 1”) and I do not remember
if it has to be created in the VLAN listing as well for this to work.
It is always a bit risky to start without VLAN and then add VLAN for 1 network and keep all the rest as-it-was, because the
behavior is not always the same. You are lucky you have the 8327 because the 8227 cannot even do that.
So it is better to move your “plain old network” to a VLAN first (I mean a VLAN at the router side, then untagged ports) so
both of your networks have a VLAN tag on the router side and on any trunks.
Yes I assumed that is what is happening, its really frustrating because all I want to do is tag that port and leave the rest open on vlan1. I do not tag all traffic at the moment just some of the vlan’s for cctv, IOT etc.
It would be helpful if the manual actually had a definition of what “secure”, “check” and “fallback” actually meant for vlan-mode?
(also the tutorial on vlan switch should mention safe mode?!)
I have:
RB3011 → CRS328 → Hap Ac2
The CRS328 is running SwOS and previously the camera was plugged into a direct run and PVID was set - easy. I need that cable for another use (PoE) so I want to loop the camera into the Hap Ac2 and just tag the port. Hap is in the garage and also running WiFi with no vlan. So I could go fully tagged out to the CRS328 but that means changing everything else (there are a few things like raspberry pi in the hap as well wired) and makes it complex when I just want to change something else later.
Is there really no way in ROS to tag one port without fully tagging all traffic and the wifi?
“safe mode” is just basic RouterOS knowledge, it is useful for all configuration changes that risk connectivity issues.
Of course you need to know about it, but there are tons of other things you need to know.
It is not impossible to operate a router with an untagged default VLAN and then some tagged VLAN in addition to it, but you should be prepared for differences in behavior on different models.
Also you can decide to use the “bridge” functionality instead of the switch. It is a little easier to get grips on, it is better documented, but it is (on router models) processed by the CPU, not the switch chip.
(in cases where you add functionality like VLAN tagging)
did you ever solved this?
I have similar issues, but already using the bridge vlan method on my Atheros8327 (RB750GL).
Means /interfaces/vlan, /interfaces/bridge/ports and /interfaces/bridge/vlans
The same configuration works on another device but here the “Current Tagged” and “Current Untagged” entries are empty.
At least the bridge, or the port (untagged) should appear here :-/
