Wireless: vlan-mode=use-tag seemingly not working

njalo · June 6, 2024, 3:03pm

Hey, i want to have RADIUS based vlan assignment in the future, so i’m trying to set up vlan tagging properly already.
However, using vlan-mode=use-tag does not work, with or without vlan-filtering activated. Devices can connect to the wlan, but are unable to reach the dhcp server.
I need it to be tagged by the interface, since i want to have one ssid/interface tagging different devices to different vlans.
Does anyone know what the issue could be?
Here are my different configs i tried:
vlan-filtering off, vlan-mode=no-tag, bridge wlan pvid=2 - works:

# 2024-06-06 16:51:06 by RouterOS 7.15
# software id = QTS9-I7NL
#
# model = RB4011iGS+5HacQ2HnD
# serial number = XXXXXXXXXXX
/interface bridge
add admin-mac=XX:XX:XX:XX:XX:XX auto-mac=no name=LAN
/interface vlan
add interface=LAN name=vlan8-management vlan-id=8
/interface list
add name=SourcePorts
add name=UserPorts
add name=management
add name=WLANiface
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk mode=dynamic-keys name=profile1 supplicant-identity=MikroTik
/interface wireless
set [ find default-name=wlan1 ] band=5ghz-onlyac channel-width=20/40/80mhz-Ceee compression=yes country=mycountry disabled=no frequency=5640 mode=ap-bridge security-profile=profile1 ssid=SSID vlan-id=2 wireless-protocol=802.11
set [ find default-name=wlan2 ] band=2ghz-g/n compression=yes country=mycountry disabled=no frequency=auto mode=ap-bridge security-profile=profile1 ssid=SSID vlan-id=2 wireless-protocol=802.11
/interface bridge port
add bridge=LAN interface=SourcePorts pvid=7 trusted=yes
add bridge=LAN interface=UserPorts pvid=2 trusted=yes
add bridge=LAN interface=WLANiface pvid=2
/interface bridge vlan
add bridge=LAN tagged=sfp-sfpplus1,ether1,wlan1,wlan2 vlan-ids=1
add bridge=LAN tagged=sfp-sfpplus1,wlan1,wlan2 untagged=ether1 vlan-ids=2
add bridge=LAN tagged=LAN,sfp-sfpplus1,ether1,wlan1,wlan2 vlan-ids=8
/interface list member
add interface=sfp-sfpplus1 list=SourcePorts
add interface=ether1 list=UserPorts
add interface=ether2 list=UserPorts
add interface=ether3 list=UserPorts
add interface=ether4 list=UserPorts
add interface=ether5 list=UserPorts
add interface=ether6 list=UserPorts
add interface=ether7 list=UserPorts
add interface=ether8 list=UserPorts
add interface=ether9 list=UserPorts
add interface=ether10 list=UserPorts
add interface=vlan8-management list=management
add interface=wlan1 list=WLANiface
add interface=wlan2 list=WLANiface

vlan-filtering off, different bridge wlan pvid, vlan-mode=use-tag - does not work:

# 2024-06-06 16:55:35 by RouterOS 7.15
# software id = QTS9-I7NL
#
# model = RB4011iGS+5HacQ2HnD
# serial number = XXXXXXXXXXX
/interface bridge
add admin-mac=XX:XX:XX:XX:XX:XX auto-mac=no name=LAN
/interface vlan
add interface=LAN name=vlan8-management vlan-id=8
/interface list
add name=SourcePorts
add name=UserPorts
add name=management
add name=WLANiface
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk mode=dynamic-keys name=profile1 supplicant-identity=MikroTik
/interface wireless
set [ find default-name=wlan1 ] band=5ghz-onlyac channel-width=20/40/80mhz-Ceee compression=yes country=mycountry disabled=no frequency=5640 mode=ap-bridge security-profile=profile1 ssid=SSID vlan-id=2 vlan-mode=use-tag wireless-protocol=802.11
set [ find default-name=wlan2 ] band=2ghz-g/n compression=yes country=mycountry disabled=no frequency=auto mode=ap-bridge security-profile=profile1 ssid=SSID vlan-id=2 vlan-mode=use-tag wireless-protocol=802.11
/interface bridge port
add bridge=LAN interface=SourcePorts pvid=7 trusted=yes
add bridge=LAN interface=UserPorts pvid=2 trusted=yes
add bridge=LAN interface=WLANiface pvid=7
/interface bridge vlan
add bridge=LAN tagged=sfp-sfpplus1,ether1,wlan1,wlan2 vlan-ids=1
add bridge=LAN tagged=sfp-sfpplus1,wlan1,wlan2 untagged=ether1 vlan-ids=2
add bridge=LAN tagged=LAN,sfp-sfpplus1,ether1,wlan1,wlan2 vlan-ids=8
/interface list member
add interface=sfp-sfpplus1 list=SourcePorts
add interface=ether1 list=UserPorts
add interface=ether2 list=UserPorts
add interface=ether3 list=UserPorts
add interface=ether4 list=UserPorts
add interface=ether5 list=UserPorts
add interface=ether6 list=UserPorts
add interface=ether7 list=UserPorts
add interface=ether8 list=UserPorts
add interface=ether9 list=UserPorts
add interface=ether10 list=UserPorts
add interface=vlan8-management list=management
add interface=wlan1 list=WLANiface
add interface=wlan2 list=WLANiface

vlan-filtering on, different bridge wlan pvid, vlan-mode=use-tag - does not work:

# 2024-06-06 16:36:59 by RouterOS 7.15
# software id = QTS9-I7NL
#
# model = RB4011iGS+5HacQ2HnD
# serial number = XXXXXXXXXXX
/interface bridge
add admin-mac=XX:XX:XX:XX:XX:XX auto-mac=no name=LAN pvid=7 vlan-filtering=yes
/interface vlan
add interface=LAN name=vlan8-management vlan-id=8
/interface list
add name=SourcePorts
add name=UserPorts
add name=management
add name=WLANiface
/interface list member
add interface=sfp-sfpplus1 list=SourcePorts
add interface=ether1 list=UserPorts
add interface=ether2 list=UserPorts
add interface=ether3 list=UserPorts
add interface=ether4 list=UserPorts
add interface=ether5 list=UserPorts
add interface=ether6 list=UserPorts
add interface=ether7 list=UserPorts
add interface=ether8 list=UserPorts
add interface=ether9 list=UserPorts
add interface=ether10 list=UserPorts
add interface=vlan8-management list=management
add interface=wlan1 list=WLANiface
add interface=wlan2 list=WLANiface
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk mode=dynamic-keys name=profile1 supplicant-identity=MikroTik
/interface wireless
set [ find default-name=wlan1 ] band=5ghz-onlyac channel-width=20/40/80mhz-Ceee compression=yes country=mycountry disabled=no frequency=5640 mode=ap-bridge security-profile=profile1 ssid=SSID vlan-id=2 vlan-mode=use-tag wireless-protocol=802.11
set [ find default-name=wlan2 ] band=2ghz-g/n compression=yes country=mycountry disabled=no frequency=auto mode=ap-bridge security-profile=profile1 ssid=SSID vlan-id=2 vlan-mode=use-tag wireless-protocol=802.11
/interface bridge port
add bridge=LAN interface=SourcePorts pvid=7 trusted=yes
add bridge=LAN interface=UserPorts pvid=2 trusted=yes
add bridge=LAN interface=WLANiface pvid=7
/interface bridge vlan
add bridge=LAN tagged=sfp-sfpplus1,ether1,wlan1,wlan2 vlan-ids=1
add bridge=LAN tagged=sfp-sfpplus1,wlan1,wlan2 untagged=ether1 vlan-ids=2
add bridge=LAN tagged=LAN,sfp-sfpplus1,ether1,wlan1,wlan2 vlan-ids=8

matrixfueller · June 22, 2024, 11:30am

So my understanding is that “use-tag” got removed with the conversation from the “wireless” to the “wifi-qcom”/“wifi-qcom-ac” package. I am struggling to enable WiFi with VLANs as well. I have decided to open a dedicated topic for this as our problems are a bit different I believe: http://forum.mikrotik.com/t/wireless-vlans-on-ros-7-15-0/176857/2

jm86ar · August 11, 2024, 3:33pm

I’m having the same problem, the use case documented is outdated or missing something in newer versions, it’s not working.
I’m struggling as well to set up vlans on a mikrotik RB4011iGS+5HacQ2HnD.
I did ask for help in this post http://forum.mikrotik.com/t/wifi-vlan-dhcp-offering-not-working/177901/3 without specific indications related to what I’m asking, aside for the corrections in fwd rules and security issues, it’s still an issue.
I’m running qos with fqcodel + vlans on wifi ifaces as follows
After several tests I’ve found if you set up “use-tag” you have to forcefully setup wifi ifaces as trunks, disabling bridge-mode (couldn’t tell the difference I understand it’s only to station-bridge setups).
If you set them as access ports it won’t work. The documentation specify as “use-tag” as important.

/interface wireless
set [ find default-name=wlan1 ] antenna-gain=0 band=5ghz-n/ac bridge-mode=disabled channel-width=
20/40/80mhz-eeCe country=no_country_set default-forwarding=no disabled=no frequency=5220
frequency-mode=manual-txpower mode=ap-bridge security-profile=profile1 skip-dfs-channels=all
ssid=JML station-roaming=enabled vlan-id=39 vlan-mode=use-tag wmm-support=enabled wps-mode=
disabled
set [ find default-name=wlan2 ] antenna-gain=0 band=2ghz-g/n bridge-mode=disabled channel-width=
20/40mhz-Ce country=no_country_set default-forwarding=no disabled=no frequency-mode=
manual-txpower mode=ap-bridge security-profile=profile1 skip-dfs-channels=all ssid=JML-2.4Ghz
station-roaming=enabled vlan-id=49 vlan-mode=use-tag wireless-protocol=802.11 wmm-support=
enabled wps-mode=disabled

/interface vlan
add interface=bridge-vlans name=vlan-mgmt-99 vlan-id=99
add interface=bridge-vlans name=vlan-wifi39 vlan-id=39
add interface=bridge-vlans name=vlan-wifi49 vlan-id=49
add interface=bridge-vlans name=vlan10-lan vlan-id=10

/interface bridge vlan
add bridge=bridge-vlans tagged=bridge-vlans untagged=ether3,ether2 vlan-ids=10
add bridge=bridge-vlans tagged=bridge-vlans vlan-ids=2
add bridge=bridge-vlans tagged=bridge-vlans untagged=ether6 vlan-ids=99
add bridge=bridge-vlans tagged=bridge-vlans,wlan1 vlan-ids=39
add bridge=bridge-vlans tagged=bridge-vlans,wlan2 vlan-ids=49

/interface bridge port
add bridge=bridge-vlans broadcast-flood=no frame-types=admit-only-untagged-and-priority-tagged
hw=no interface=ether3 internal-path-cost=10 path-cost=10 pvid=10
add bridge=bridge-vlans frame-types=admit-only-untagged-and-priority-tagged hw=no interface=
ether6 pvid=99
add bridge=bridge-vlans frame-types=admit-only-untagged-and-priority-tagged hw=no interface=
ether2 pvid=10
add bridge=bridge-vlans frame-types=admit-only-vlan-tagged interface=wlan1 pvid=39
add bridge=bridge-vlans frame-types=admit-only-vlan-tagged interface=wlan2 pvid=49

This way works, gets an ip, and internet traffic flows untagged.
Still when I reboot the router, it takes at least three attempts until wifi39 (5ghz) vlan clients get an ip.

There’s something missing or something else messing up not well documented.