Winbox unreachable with VLAN filtering

RouterOS General
1

Hello all,
I am trying to make Winbox on my CRS reachable from within my created bridge, testbr. When I turn on VLAN filtering on the bridge the IP address assigned is unreachable. On top of the default config I am running the following script.

:for a from=23 to=25 do={/interface bridge port remove $a}
:for b from=0 to=15 do={/interface bridge port remove $b}
/interface bridge add name=testbr frame-types=admit-only-vlan-tagged
/interface bridge port add bridge=testbr interface=ether24 frame-types=admit-only-vlan-tagged
:foreach c in={"ether1";"ether2";"ether3";"ether4";"ether5";"ether6";"ether7";"ether8"} do={
    /interface bridge port add bridge=testbr interface=$c pvid=1003 frame-types=admit-only-untagged-and-priority-tagged
}
/interface bridge vlan add bridge=testbr tagged=ether24 vlan-ids=1003
/interface bridge set testbr frame-types=admit-only-vlan-tagged
/ip address add address=172.16.1.133/24 interface=testbr
/interface bridge set testbr vlan-filtering=yes
2

Obviously something wrong with vlan settings and/or script …
You should however be able to connect using MAC address ?

Take 1 port away from bridge if possible, apply small dhcp server and fixed ip and you can always connect.

And what would be the goal of using that script of yours ?

3

I want to be able to access the switch from the management VLAN

4

Assuming 1003 is the management VLAN. This section:


/interface bridge vlan add bridge=testbr tagged=ether24 vlan-ids=1003
/interface bridge set testbr frame-types=admit-only-vlan-tagged
/ip address add address=172.16.1.133/24 interface=testbr
/interface bridge set testbr vlan-filtering=yes

Should be changed to:


/interface vlan add interface=testbr name=vlan1003 vlan-id=1003
/ip address add address=172.16.1.133/24 interface=vlan1003
/interface bridge vlan add bridge=testbr tagged=testbr,ether24 vlan-ids=1003
/interface bridge set testbr frame-types=admit-only-vlan-tagged
/interface bridge set testbr vlan-filtering=yes

You need to add a vlan1003 VLAN interface (1st line). Set the IP address on that interface (2nd line). When adding the vlan entry under /interface bridge vlan, the “testbr” interface needs to be added to the list of tagged ports too (3rd line).

5

This worked, thank you very much, however I am confused as to why I need to add ether24 as well as testbr on the following line;

/interface bridge vlan add bridge=testbr tagged=testbr,ether24 vlan-ids=1003

My understanding was that ether24 fell under testbr, as I added it here;

/interface bridge port add bridge=testbr interface=ether24 frame-types=admit-only-vlan-tagged

However, I found after testing that if I remove ether24 from the first command my uplink stops working.

6

Within this line:


/interface bridge vlan add bridge=testbr tagged=testbr,ether24 vlan-ids=1003

You see testbr appearing twice, and the two instances represent two different things. The first occurrence is the bridge that contains the physical ports and acts like a switch with a number of ports that have been added to it under /interface bridge ports. For the second occurrence, “testbr” acts as a port. It’s the port on that “switch” that connects to the main CPU. It’s treated as a port, like ether24, and is added to the tagged list of VLAN 1003, which means it’s a trunk port for VLAN 1003, transporting tagged frames between the “switch” and the main CPU. Without “testbr” in “tagged” the CPU has no access to VLAN 1003, which means layer 3 constructs like IP address are not available to the CPU on this VLAN.

You can read this post for better explanations http://forum.mikrotik.com/t/routeros-bridge-mysteries-explained/147832/1

7

Super helpful! Thanks.