VLANs on bridges, or bridges for VLANs?

Hello! I just started working with vlans on routeros and, guess what, I have questions!

Consider this scenario: a routerboard with say, 5 eth ports. On 4 of them I want to make 3 vlans available. Should I bridge the ethernets together and then create 3 vlan interfaces on the bridge interface or create 3 vlan interfaces on each ethernet port (that is, 3x4 vlan ifs) and then create a separate bridge for each vlan id? Is one of the two ways correct or will either work?

In each case, where should the router’s IP addresses be assigned? I suppose on the bridges, where in the first case the one bridge will have 3 addresses as it belongs to 3 vlans and in the second case each bridge will have its own address, of the vlan it bridges. Right?

Now, second scenario, as an extension of the previous: say I also want to publish these vlans wirelessly. My understanding is that if I want ordinary wifi clients to go to separate vlans, I should create one virtual ap per vlan (which can only work with the second setup above). I I want to wirelessly bridge the vlans to another router, I don’t have to create virtual aps but put the physical one to WDS mode (and add it to the bridge or create the vlans on it and put those on their respective bridges). Is this correct?

If both devices are Mikrotiks, will an “AP Bridge” ↔ “Client Bridge” setup be able to transport vlans?

Last question: is a viable solution to the second scenario to create a EoIP connection over the wlan and add it to the bridge?

Any help will be much appreciated.

N.

No one? :frowning:

Hi,

Generally I would avoid using bridges as the traffic will pass thorough CPU. I would use switch chip for that (this is how it works on my CRS switch).

Check:
http://wiki.mikrotik.com/wiki/Manual:CRS_examples#VLAN
http://wiki.mikrotik.com/wiki/Manual:Interface/VLAN

Hi,

if you’re on a MikrotikRouter without VLAN capable switch chip, you should create a bridge for every VLAN an bridge the desired VLAN interfaces in this bridge. As you already wrote, the bridge interfaces must be configured with the desired IP addresses.

As kamillo already said, this setup will cause the packets going “through” the CPU, resulting in high CPU load.
I use a similar setup on a RB2011 and can push around 800MBit/s over the bridge before the CPU gets maxed out.

If you’re looking for “the best fitting solution”, you should get an Cloud Router Switch (CSR125 for example). It’s a great L2/L3 VLAN capable switch.

Ape

Thanks guys! So it is preferrable to tag at the switch chip if possible to offload the CPU, otherwise create vlan interface(s) on each physical interface and bridge the same vlan interfaces together. But what about the wireless part above?