VLAN Trunk port config

trode · January 3, 2025, 9:09pm

I have a few Mikrotik switches and a router that I would like to trunk a couple VLANs from my router out to other switches.The vlans are configured and working as expected on my router wall (RB4011iGS+) router os 7. However when I attempt to trunk the VLANs to my main switch CRS328-24P-4S+ traffic on that switch that is tagged for my VLANs is ending up on the untagged vlan of the switch.

My plan was to leave pvid/vlan 1 as untagged on all interfaces for both devices.
VLAN 10 and VLAN 20 are the tagged ones that I need to pass over the connection tagged between the switch and router.

Attached are configs for the router (wall) & switch (tengswitch)

How can I stop tagged vlan traffic from the switch leaking to the untagged vlan on the router?
Is it possible to use a “hybrid port” with both unagged traffic and tagged traffic to trunk the VLANs between switches?

Basic connection description
[ISP]----[ ether1 ]–[wall (RB4011iGS+)]–[sfp-sfpplus1]—[sfp-sfpplus3]–[tengswitch (CRS328-24P-4S+ )]—[sfp-sfpplus-2]

The end result I’m looking for is untagged vlan 1 and tagged vlan 10,20 working on the sfp-sfpplus-2 port of the tengsiwtch.

Thanks,
Blake
vlan_wip_3_wall.rsc (11.2 KB)
vlan_wip_3_tengswitch.rsc (4.39 KB)

anav · January 4, 2025, 3:06am

There is no need to use hybrid ports unless dealing with ubiquiti etc..

Classic error, once you go vlans, DONT mix bridge with DHCP.
Whatever subnet you have there just assign it as a vlan and then complete the config.

Ingress filtering should be yes on every port and frame types be either vlan tagged or priority and untagged.
Read the bible: http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1

In your context if all of the ports are the bridge subnet, then they would be access ports (prioririty and untagged) to dumb devices.
I dont see the trunk port to the next smart switch??? it should be vlan tagged only.

tdw · January 4, 2025, 12:12pm

What do you mean by leaking?

Is it possible to use a “hybrid port” with both unagged traffic and tagged traffic to trunk the VLANs between switches?

Yes, although some people dislike this arrangement.

anav · January 4, 2025, 1:35pm

Its not a matter of like or dislike, its a matter of meeting requirements.

trode · January 4, 2025, 7:21pm

Classic error, once you go vlans, DONT mix bridge with DHCP.
Whatever subnet you have there just assign it as a vlan and then complete the config.

Can you expand on this a bit for me? On my router things are working as expected in regards to DHCP giving out the correct network on the ports that are tagged with VLAN.

I’m only having issues on the downstream switch. Changing the ports that connect the router to the switch to a trunked port and only allowing tagged traffic seems to be my next step.

anav · January 4, 2025, 8:25pm

ROUTER:
model = RB4011iGS+
In summary sort out why the subnets you use in various places dont match the address subnets ???]

Not sure why you show ether2 being tagged for both vlans, You never noted what is connected to ether2 ???
I will asssume for now its some other kind of smart device and not a dumb device…
thus needs three vlans… I am using your HOME vlan as the trusted or management VLAN

Many things dont make any sense including trying to use forward chain rules for specific port forwarding rules… its done in dstnat,
Also you cant have destination nat rules to non existing LAN servers…
subnet 192.168.206.0 is NOT on the router ??? creates real problems as you use them in many places..
subnet 192.168.192.0 is NOT on the router ???
any service not encryped disabled.

/interface vlan
add interface=bridge name=appletalk vlan-id=20
add interface=ether1 name=clink vlan-id=201
add interface=bridge name=guestnet vlan-id=10
and interface=bridge name=Home5 vlan-id=5 comment=“internal”
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
add comment=TRUSTED
/ip dhcp-server
add address-pool=internal interface=Home5 lease-time=5m name=internal
server-address=192.168.200.1
add address-pool=guestnet comment=“guest network” interface=guestnet
lease-time=5m name=guestnet server-address=192.168.1.1
add address-pool=appletalk comment=“Mac Lab” interface=appletalk lease-time=
5m name=appletalk
/interface bridge port
add bridge=bridge ingress-filtering=yes frame-types=admit-only-vlan-tagged interface=ether2 comment=“trunk to smart device”
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether3 pvid=5
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether4 pvid=5
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether5 pvid=5
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether6 pvid=5
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether7 pvid=5
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether8 pvid=5
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether9 pvid=5
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether10pvid=5
add bridge=bridge ingress-filtering=yes frame-types=admit-only-vlan-tagged interface=sfp-sfpplus1 comment=“trunk to switch”
/ip neighbor discovery-settings
set discover-interface-list=TRUSTED
/interface bridge vlan
add bridge=bridge tagged=bridge,ether2,sfp-sfpplus1 untagged=ether3,ether4,ether5,ether6,ether7,ether8,ether9,ether10 vlan-id=5 comment=“home subnet”
add bridge=bridge tagged=bridge,ether2,sfp-sfpplus1 vlan-id=10 comment=“guest net”
add bridge=bridge tagged=bridge,ether2,sfp-sfpplus1 vlan-id=20 comment=“apple talk”
/interface list member
add comment=defconf interface=ether1 list=WAN
add comment=defconf interface=bridge list=LAN
add interface=Home5 list=LAN
add interface=appletalk list=LAN
add interface=guestnet list=LAN
add interface=Home5 list=TRUSTED
/ip address
add address=192.168.200.1/23 comment=defconf interface=Home5 network=
192.168.200.0
add address=198.168.1.1/24 comment=“guestnet router” interface=guestnet
network=198.168.1.0
add address=192.168.0.1/24 comment=“appletalk router” interface=appletalk
network=192.168.0.0
/ip firewall filter
add action=jump chain=forward comment=“jump to kid-control rules”
jump-target=kid-control
add action=accept chain=input comment=
“defconf: accept established,related,untracked” connection-state=
established,related,untracked
add action=drop chain=input comment=“defconf: drop invalid” connection-state=
invalid
add action=accept chain=input comment=“defconf: accept ICMP” protocol=icmp
add action=accept chain=input comment=
“defconf: accept to local loopback (for CAPsMAN)” dst-address=127.0.0.1
add action=accept chain=input comment=“admin access” in-interface-list=TRUSTED
add action=accept chain=input comment=“users to services” in-interface-list=LAN dst-port=53 protocol=udp
add action=accept chain=input comment=“users to services” in-interface-list=LAN dst-port=53 protocol=tcp
add action=drop chain=input comment=“drop all else” { put this rule in last }
++++++++++++++++++++++++++++++++++++++++++++++++++++
add action=accept chain=forward comment=“defconf: accept in ipsec policy”
ipsec-policy=in,ipsec
add action=accept chain=forward comment=“defconf: accept out ipsec policy”
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment=“defconf: fasttrack”
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=
“defconf: accept established,related, untracked” connection-state=
established,related,untracked
add action=drop chain=forward comment=“defconf: drop invalid”
connection-state=invalid
add action=accept chain=forward comment=“internet traffic” in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment=“port forwarding” connection-nat-state=dstnat
add action=drop chain=forward comment=“drop all else”
/ip firewall nat
add action=masquerade chain=srcnat comment=“defconf: masquerade”
ipsec-policy=out,none out-interface=pppoe-clink
add action=dstnat chain=dstnat in-interface=pppoe-clink dst-port=80
protocol=tcp to-address=192.168.200.18 src-address-list=cloudflare
add action=dst-nat chain=dstnat in=interface=pppoe-clink dst-port=387
protocol=udp to address=192.168.0.66 comment=“global apple?? talk”
/ip service
set telnet address=disabled
set ftp address=disabled
set www address=disabled
set ssh address=192.168.192.0/20,192.168.200.0/23
set www-ssl address=192.168.192.0/20
set api address=disabled
set winbox address=192.168.192.0/20,192.168.200.0/23
set api-ssl address=192.168.192.0/20
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list**=TRUSTED**

anav · January 4, 2025, 8:48pm

Remove router serial number and switch serial number from posts made of configs.

SWITCH

model = CRS328-24P-4S+

serial number = DNACHSOS4

/interface bridge
add admin-mac=08:55:31:20:4A:06 auto-mac=no comment=defconf
ingress-filtering=yes name=bridge vlan-filtering=yes
/interface vlan
add interface=bridge name=Trusted5[/b] vlan-id=5
/interface list
add name=TRUSTED
/interface bridge port
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether1 pvid=5
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether2 pvid=5
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether3 pvid=5
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether4 pvid=5
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether5 pvid=5
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether6 pvid=5
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether7 pvid=5
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether8 pvid=5
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether9 pvid=5
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether10-porch-cam pvid=5
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether11 pvid=5
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether12-loft-bottom pvid=5
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether13 pvid=5
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether14 pvid=5
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether15 pvid=5
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether16-periscope pvid=5
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether17 pvid=5
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether18 pvid=5
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether19-HDHR pvid=5
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether20 pvid=5
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether21-cloudkey pvid=5
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether22-media-room-AP pvid=5
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether23-loft-AP pvid=5
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether24 pvid=5
add bridge=bridge ingress-filtering=yes frame-types=admit-only-vlan-tagged interface=sfp-sfpplus1
add bridge=bridge ingress-filtering=yes frame-types=admit-only-vlan-tagged interface=sfp-sfpplus2-16P-switch
add bridge=bridge ingress-filtering=yes frame-types=admit-only-vlan-tagged interface=sfp-sfpplus3-wall
add bridge=bridge ingress-filtering=yes frame-types=admit-only-vlan-tagged interface=sfp-sfpplus4-umac
/ip neighbor discovery-settings
set discover-interface-list=TRUSTED
/ip address
add address=192.168.200.XX/23 interface=Trusted5 network comment=“static IP of switch on trusted subnet”
/interface bridge vlan
add bridge=bridge tagged=bridge,sfpplus-3-wall,sfp-sfpplus4-umac,sfp-sfpplus2-16P-switch,sfp-sfpplus1 vlan-ids=5
add bridge=bridge tagged=sfp-sfpplus3-wall,sfp-sfpplus4-umac,sfp-sfpplus2-16P-switch,sfp-sfpplus1 vlan-ids=10
add bridge=bridge tagged=sfp-sfpplus3-wall,sfp-sfpplus4-umac,sfp-sfpplus2-16P-switch,sfp-sfpplus1 vlan-ids=20
/interface list member
add interface=Trusted5 list=TRUSTED
/ip dns
set server=192.168.200.1
/ip route
add dst-address=0.0.0.0/0 gateway=192.168.200.1
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=TRUSTED

trode · January 4, 2025, 11:20pm

Ok thanks for that config example. So basically, this sets up a new VLAN 5 and moves what was my untagged “home” network onto VLAN 5. That enables us to use the ingress filtering and true trunked ports. Then rebuilding the admin interfaces so they work on the new config. I wasn’t able to get this working on my attempt this afternoon.

I have reset to my previous config from backups via serial console for now.

The ether2 on the router is my test system so I can validate if the vlans are working at the router. Basically just a DHCP client for untagged and tagged.

It really seems like with my current config If I can have the switch pass tagged and untagged traffic to the router it should just work as is. Right now any traffic that is on vlan 10 on the switch arrives on the router untagged. This is what I was referring to as “leaking” previously.

tdw · January 5, 2025, 3:06pm

The switch VLAN setup looks OK - sfpplus1-4 are untagged with VLAN 10 and VLAN 20 tagged, ether1-24 are untagged only. There are some unnecessary entries in the switch configuration which I would suggest removing:
/interface vlan
add interface=sfp-sfpplus3-wall name=appletalk vlan-id=20
add interface=sfp-sfpplus3-wall name=netjibbing vlan-id=10
/interface list
add name=WAN
add name=LAN
/interface bridge vlan
add bridge=bridge tagged=sfp-sfpplus4-umac,sfp-sfpplus3-wall,sfp-sfpplus2-16P-switch,sfp-sfpplus1,bridge vlan-ids=10
add bridge=bridge tagged=sfp-sfpplus4-umac,sfp-sfpplus1,sfp-sfpplus3-wall,sfp-sfpplus2-16P-switch,bridge vlan-ids=20
/interface list member
add interface=ether1 list=WAN
add interface=ether2 list=LAN
add interface=ether3 list=LAN
add interface=ether4 list=LAN
add interface=ether5 list=LAN
add interface=ether6 list=LAN
add interface=ether7 list=LAN
add interface=ether8 list=LAN
add interface=ether9 list=LAN
add interface=ether10-porch-cam list=LAN
add interface=ether11 list=LAN
add interface=ether12-loft-bottom list=LAN
add interface=ether13 list=LAN
add interface=ether14 list=LAN
add interface=ether15 list=LAN
add interface=ether16-periscope list=LAN
add interface=ether17 list=LAN
add interface=ether18 list=LAN
add interface=ether19-HDHR list=LAN
add interface=ether20 list=LAN
add interface=ether21-cloudkey list=LAN
add interface=ether22-media-room-AP list=LAN
add interface=ether23-loft-AP list=LAN
add interface=ether24 list=LAN
add interface=sfp-sfpplus1 list=LAN
add interface=sfp-sfpplus2-16P-switch list=LAN
add interface=sfp-sfpplus3-wall list=LAN
add interface=sfp-sfpplus4-umac list=LAN

If the issue is with clients attached to the APs connected to ether22&23 the VLAN membership on these ports and the SSID-to-VLAN association on the APs should be looked at.

trode · January 8, 2025, 3:21am

Thanks for that switch config review. I have go back through both switch and router to see if I could just may the hybrid trunk port work with untagged and tagged traffic flowing between switches. At best any tagged traffic from the switch just shows up as untagged on the router and things like dhcp addresses come from the interface that is untagged on the router bridge.

For now just waiting for another bit of time to take my whole home network down and reconfigure the vlans on the switch so that the trunk ports are only tagged traffic.

anav · January 8, 2025, 3:57pm

The only times that one needs to use a hybrid port is if the offending attached device
a. accepts ONLY the untagged data for the main connection and a tagged connection for other connections.
( an internet phone where the untagged data is for the phone and the tagged data is for a connected PC )
b. accepts by default ( can be changed ) where the untagged is the management subnet and the rest tagged data vlans.
(ubiquiti type device).

Otherwise, one should use trunk ports or access ports.

flintham12 · January 10, 2025, 7:19pm

Ensure that VLAN 10 and VLAN 20 are configured identically (tagged) on both the router (RB4011iGS+) and the main switch (CRS328-24P-4S+). Check VLAN IDs, tagging modes, and port configurations to ensure they match on both devices.
Port Configuration on Router and Switch:

On the router (RB4011iGS+), configure the ports connected to the switch (CRS328-24P-4S+) as “trunk ports”. Trunk ports carry tagged traffic for multiple VLANs.
Set VLAN 1 as untagged (PVID) and VLAN 10, VLAN 20 as tagged on these ports.

Port Isolation and VLAN Filtering:

Ensure that VLAN 1 remains untagged on all ports as planned, including the trunk ports between the router and the switch.
Use VLAN filtering or isolation features on both devices to prevent VLAN leakage:
On MikroTik devices, this typically involves setting up VLAN interfaces (/interface vlan), VLAN filtering rules (/interface ethernet switch vlan), and ensuring proper VLAN membership (/interface ethernet switch egress-vlan-tag).

By following these steps and ensuring consistent VLAN configuration between your MikroTik devices, you should be able to prevent tagged VLAN traffic from leaking into the untagged VLAN and successfully trunk VLANs between switches.

trode · February 17, 2025, 12:42am

Circling back on this one. I eventually discoverd that static DHCP reservations where getting assigned to my test system from the incorrect address range for the VLAN it was connected on. Once I cleared these static DHCP assigments things started working well. In the end I was able to trunk traffic correctly with untagged and tagged traffic on the uplink between switches.