Hi. I replaced my old Draytek router with a Mikrotik RB4011iGS+ running 6.46 and have run into a problem. I have two switches connected to the Mikrotik. I have not changed the config on either of the switches. The first works fine and is on a default ether2 port. My problem is with the switch which sits over a tagged vlan100 connection from ether5 on the router side. I am fairly convinced I am not tagging the ether5 port correctly.
Switch1 192.168.50.2 – untagged – ether2 on router 192.168.50.1. All works, Everything hanging off the switch comes up to the router and out on the CPE
Switch2 192.168.100.1 – tagged vlan 100 – ether5 on router 192.168.100.254. I can’t ping the router from switch2 or the switch2 from the router. Stuck at 1st base!
The commands I’ve entered to set this up are after reading the basic vlan setup manual pages
– not required as already present
– interface bridge add name=bridge1
interface bridge port add interface=ether5 bridge=bridge1
interface vlan add name=vlan-100 interface=bridge1 vlan-id=100
ip address add address=192.168.100.254/24 interface=vlan-100
– tagged bridge1 after reading some feedback in another post on this forum
interface bridge vlan add bridge=bridge1 tagged=bridge1,ether5 vlan-ids=100
interface bridge set bridge1 vlan-filtering=yes
Have I missed a step? Or completely misunderstood?
Switch2 config snippet for completeness. Router is on port 2
2930F-Core1# sh vlans 100
Status and Counters - VLAN Information - VLAN 100
VLAN ID : 100
Name : management
Status : Port-based
Voice : No
Jumbo : No
Private VLAN : none
Associated Primary VID : none
Associated Secondary VIDs : none
Port Information Mode Unknown VLAN Status
2 Tagged Learn Up
5 Tagged Learn Up
6 Tagged Learn Up
7 Tagged Learn Up
Thanks. Tried that suggestion but get the following error
[admin@MikroTik] /interface bridge vlan> /interface bridge vlan add bridge=bridge1 tagged=bridge1,ether5,switch1-cpu vlan-ids=100
input does not match any value of interface
After some feedback from a colleague I’m wondering if it’s firewall… looking at that now! Thanks for all your help so far.
Yes, there are two ways of doing it, they are mostly interchangeable but are distinct enough to make things hard.
The old way was to do it via /interface ethernet switch configuration subtree and was device specific (some even don’t support VLANs this way, RB4011 is supposedly one of them).
The new way is via /interface bridge configuration subtree and is universaly available on all ROS-driven devices. The drawback is that traffic is handled by CPU on all but CRS3xx devices and some devices’ CPUs are weak causing performance bottleneck. Some devices feature powerful CPUs that are able near-wirespeed bridging (RB4011 is one of them), the switch-chip to CPU interconnect might be a bottleneck.