Community discussions

MikroTik App
  4. RouterOS
  5. Beginner Basics

VLAN configuration issue

Locked
 
petrk
just joined
Topic Author
Posts: 13
Joined: Sat Mar 19, 2016 3:52 pm

VLAN configuration issue

Sat Mar 19, 2016 3:54 pm

Hello!

My setup is following:
  • - 24 port switch Mikrotik CRS226-24G-2S running RouterOS 6.9
  • - port 3 - WiFi AP connected (hybrid, trunk + untagged)
    • - Untagged packets go on one SSID1 - working FINE
    • - Vlan 50 goes on SSID2 - working FINE
    • - Vlan 90 goes on SSID3 - working FINE
  • - port 5 - trunk to router (pfSense based)
    • - carries VLAN 50 and 90 and 610
  • - port 7 - access port for 4g modem, should go to router via VLAN 610
    • - Ingress configured to tag everything to VLAN 610
  • - rest of the devices are all untagged and working fine
PROBLEM: Occasionally, I see my devices (connected to unconfigured ports or SSID1) get DHCP address from 4g modem - which should not happen, as I have configured ingress rules on port 7 to tag everything VLAN610 and no egress is configured apart from port 5 to the router.


Egress config:
Code: Select all
[admin@MikroTik] > /interface ethernet switch egress-vlan-tag print
Flags: X - disabled, I - invalid
 #   VLAN-ID TAGGED-PORTS
 0        10 ether3-slave-local
 1        90 ether5-slave-local
             ether3-slave-local
 2        50 ether3-slave-local
             ether5-slave-local
 3       610 ether5-slave-local
Ingress config:
Code: Select all
[admin@MikroTik] > /interface ethernet switch ingress-vlan-translation print
Flags: X - disabled, I - invalid
 0   port=ether7-slave-local service-vlan-lookup-for=untagged-or-tagged customer-vlan-lookup-for=untagged-or-tagged customer-vid=0 new-customer-vid=610 pcp-propagation=no sa-learning=no swap-vids=no
What am I missing in my configuration that would prevent the 4G modem’s traffic ever appearing on the other ports? I am also assuming that untagged packets can appear on port 5, would that be correct? (they are ignored by pfSense but would be good to clean up the broadcast domains)

EDIT: My main network is 192.168.2.x. The 4g modem has 192.168.60.x. When a device gets a lease by accident with the .60. network, it cannot actually access the 4g router. Neither can I ping the 192.168.60.1 with a machine with manually set address .60. address. Why would the DHCP packets get through while others clearly do not?
Top
 
petrk
just joined
Topic Author
Posts: 13
Joined: Sat Mar 19, 2016 3:52 pm

Re: VLAN configuration issue

Mon Mar 21, 2016 11:40 am

Is there really nothing I can do re. the above?
Top
 
becs
MikroTik Support
MikroTik Support
Posts: 499
Joined: Thu Jul 07, 2011 8:26 am

Re: VLAN configuration issue

Mon Mar 21, 2016 11:57 am

Enable MAC learning for VLAN610 on port 7 by setting "sa-learning=yes" in the Ingress VLAN Translation rule. It should prevent unwanted traffic flooding.
Top
 
petrk
just joined
Topic Author
Posts: 13
Joined: Sat Mar 19, 2016 3:52 pm

Re: VLAN configuration issue

Mon Mar 21, 2016 1:07 pm

Enable MAC learning for VLAN610 on port 7 by setting "sa-learning=yes" in the Ingress VLAN Translation rule. It should prevent unwanted traffic flooding.
Got it - will test. Could you please explain to me what was happening without the sa-learning?
Top
 
becs
MikroTik Support
MikroTik Support
Posts: 499
Joined: Thu Jul 07, 2011 8:26 am

Re: VLAN configuration issue

Mon Mar 21, 2016 1:47 pm

Ingress VLAN Translation rule with "sa-learning=no" makes CRS switch to not learn source MAC address on port 7. And if it does not learn, it does not know where to send back traffic destined to device connected to port 7. In such case switch sends traffic to all its ports except incoming.
Top
 
petrk
just joined
Topic Author
Posts: 13
Joined: Sat Mar 19, 2016 3:52 pm

Re: VLAN configuration issue

Mon Mar 21, 2016 11:40 pm

Still an issue - I've tried enabling DHCP on the device connected to port 7 and I got DHCP lease via AP on the port 3 (untagged traffic, SSID1).

Interestingly, I can now ping devices on the .60. network, as well as access the internet via the 4G modem on port 7.

So what is happening that untagged traffic is flowing between ports 3 and 7. How could this happen? I've applied the sa-learning:
Code: Select all
[admin@MikroTik] > /interface ethernet switch ingress-vlan-translation print 
Flags: X - disabled, I - invalid 
 0   port=ether7-slave-local service-vlan-lookup-for=untagged-or-tagged customer-vlan-lookup-for=untagged-or-tagged customer-vid=0 new-customer-vid=610 pcp-propagation=no sa-learning=yes swap-vids=no
Top
 
skuykend
Member Candidate
Member Candidate
Posts: 274
Joined: Tue Oct 06, 2015 7:28 am

Re: VLAN configuration issue

Tue Mar 22, 2016 1:54 am

Show us what your VLAN table looks like. "/interface Ethernet switch vlan print"

That controls what vlan traffic is allowed on what ports.
Top
 
petrk
just joined
Topic Author
Posts: 13
Joined: Sat Mar 19, 2016 3:52 pm

Re: VLAN configuration issue

Tue Mar 22, 2016 3:02 am

Show us what your VLAN table looks like. "/interface Ethernet switch vlan print"

That controls what vlan traffic is allowed on what ports.
I did not do any specific setting up of the VLANs - here is my table:
Code: Select all
[admin@MikroTik] > /interface ethernet switch vlan print 
Flags: X - disabled, I - invalid 
 #   VLAN-ID PORTS                                                                        SVL SA-LEARNING FLOOD INGRESS-MIRROR QOS-GROUP                                                                        ISOLATION-PROFILE
What is the relation of the VLAN table to egress/ingress rules?
Top
 
skuykend
Member Candidate
Member Candidate
Posts: 274
Joined: Tue Oct 06, 2015 7:28 am

Re: VLAN configuration issue

Tue Mar 22, 2016 5:05 am

I think that other untagged traffic is still allowed out to your ether7 and that you need to disallow vlan0 (default untagged) traffic on ether7 and just allow vlan 610.

http://wiki.mikrotik.com/wiki/Manual:CRS_features
http://wiki.mikrotik.com/wiki/Manual:CRS_examples
What is the relation of the VLAN table to egress/ingress rules?
The VLAN table (along with general switch settings Forward Invalid VLAN or the drop if invalid entries) defines what VLANS are
available on what physical ports (including the internal cpu port if needed). By default all VLANS are available on all ports.

The egress tag table states what vlan/port combinations go out tagged. With no vlan configuration they go out like they come in tagged or untagged. Once you start modifying any VLAN setup stuff though they go out untagged unless you place an entry here stating they should go out tagged.

Ingress tags just changes the incoming tag at the port.
Top
 
petrk
just joined
Topic Author
Posts: 13
Joined: Sat Mar 19, 2016 3:52 pm

Re: VLAN configuration issue

Tue Mar 22, 2016 12:26 pm

I think that other untagged traffic is still allowed out to your ether7 and that you need to disallow vlan0 (default untagged) traffic on ether7 and just allow vlan 610.
Thank you! That sounds like what may be happening. My question is then - how do I disallow vlan0 on port 7? Also, how come that full communication was possible even though there is ingress rule set? My assumption is that yes, it may have been possible for untagged packets to go out of port 7 but any replies should be automatically tagged 610 and should not make it back to the untagged ports, is that not correct?
Top
 
skuykend
Member Candidate
Member Candidate
Posts: 274
Joined: Tue Oct 06, 2015 7:28 am

Re: VLAN configuration issue

Tue Mar 22, 2016 7:18 pm

My assumption is that yes, it may have been possible for untagged packets to go out of port 7 but any replies should be automatically tagged 610 and should not make it back to the untagged ports, is that not correct?
They get tagged but then can get untagged when they go out other ports that aren't set to tag 610. This would only happen on broadcast and other packets where the switch doesn't know where the destination Mac resides.

I'll try and give you a vlan table example when I'm at home.
Top
 
petrk
just joined
Topic Author
Posts: 13
Joined: Sat Mar 19, 2016 3:52 pm

Re: VLAN configuration issue

Tue Mar 22, 2016 8:36 pm

My assumption is that yes, it may have been possible for untagged packets to go out of port 7 but any replies should be automatically tagged 610 and should not make it back to the untagged ports, is that not correct?
They get tagged but then can get untagged when they go out other ports that aren't set to tag 610. This would only happen on broadcast and other packets where the switch doesn't know where the destination Mac resides.

I'll try and give you a vlan table example when I'm at home.
Ok, that is a bit confusing for me - are you saying that any VLAN traffic gets automatically untagged and just goes to all of the other ports? How come that I was not seeing any other conflicts from the other subnets? (the ones that are always tagged from the router via port 5).
Top
 
skuykend
Member Candidate
Member Candidate
Posts: 274
Joined: Tue Oct 06, 2015 7:28 am

Re: VLAN configuration issue

Tue Mar 22, 2016 9:30 pm

Ok, that is a bit confusing for me - are you saying that any VLAN traffic gets automatically untagged and just goes to all of the other ports? How come that I was not seeing any other conflicts from the other subnets? (the ones that are always tagged from the router via port 5).
Not every packet. Going to get wordy here (and possibly even more confusing)

When the switch get's a packet that either doesn't have a destination MAC address (broadcast, initial DHCP request, etc) or the MAC address is not in it's internal table (through SA-LEARNING) then it has to flood it out to all ports (except the one it came in on) that allows that VLAN. (and you're allowing all vlans on all ports by default)

Once it decides what port(s) to send it out on, then for each outgoing port it will look at your egress-vlan-tag table to see if it should keep it tagged or not. If there is no entry for that VLAN and port combination it removes the tag before sending it out. (Unless there are no entries at all, then it sends them out just as it received it, yes confusing but they wanted it to work like a regular switch in that case)

So all traffic coming in on ether7 is tagged 610, then if the switch decides it doesn't know where to send it, it floods, sends it as vlan 610 to ether5 as it's marked to tag it, but sends it untagged everywhere else.

Once it knows where the destination mac is, it will just send it to the port that needs it, but will still follow the rules you've set for tagged/untagged.

How are you connecting to your swtich for management? Winbox? By IP or MAC address? I ask because to fix this you'll need to restrict what VLAN are available on what ports which can lock you out if you do it incorrectly or in the wrong sequence. I prefer Winbox via MAC address when I'm initially setting up a router/switch.
Top
 
petrk
just joined
Topic Author
Posts: 13
Joined: Sat Mar 19, 2016 3:52 pm

Re: VLAN configuration issue

Tue Mar 22, 2016 11:06 pm

That actually makes a lot of sense!

So the solution would be to add VLANs to only specific ports, thus limiting the broadcast to specific ports only.

I am connecting via SSH, via the untagged LAN.
Top
 
petrk
just joined
Topic Author
Posts: 13
Joined: Sat Mar 19, 2016 3:52 pm

Re: VLAN configuration issue

Wed Mar 23, 2016 1:09 am

..you'll need to restrict what VLAN are available on what ports which can lock you out if you do it incorrectly or in the wrong sequence. I prefer Winbox via MAC address when I'm initially setting up a router/switch.
Could you advise what exactly I need to do and in which sequence? :)
Top
 
skuykend
Member Candidate
Member Candidate
Posts: 274
Joined: Tue Oct 06, 2015 7:28 am

Re: VLAN configuration issue

Wed Mar 23, 2016 2:50 am

Could you advise what exactly I need to do and in which sequence? :)
Well I don't know if I have all the info I would need so you'll have to tweak.

Looks like the switch is not doing any routing just switching. If routing, all vlans will need access to switch1-cpu port, otherwise just the management vlan (0 in your case).
What's does VLAN10 need to access besides ether3? Looks like it goes nowhere, I left it off.
Should ether5 allow untagged (VLAN0) packets? (If so add ether5 to vlan-id=0 entry below)

Here's my best guess, but you'll have to fix port names if you've renamed them etc. This is in addition to the ingess and egress-tag entries you have already.
Code: Select all
/interface ethernet switch vlan
add ports="switch1-cpu,ether1,ether2,ether3,ether4,ether6,ether8,ether9,ether10,\
    ether11,ether12,ether13,ether14,ether15,ether16,ether17,ether18,ether19,ether20,\
	ether21,ether22,ether23,ether24,sfp-sfpplus1,sfpplus2" vlan-id=0
#Note no ether5 or 7!
add ports="ether3,ether5" vlan-id=50
add ports="ether3,ether5" vlan-id=90
add ports="ether5,ether7" vlan-id=610
#
/interface ethernet switch
# this is the command that will force use of vlan table, 
# check everything else first!, May drop you off temporarily
set forward-unknown-vlans=no
Export a configuration backup first.

Good Luck!
Top
 
petrk
just joined
Topic Author
Posts: 13
Joined: Sat Mar 19, 2016 3:52 pm

Re: VLAN configuration issue

Wed Mar 23, 2016 11:16 am

Code: Select all
/interface ethernet switch vlan
add ports="switch1-cpu,ether1,ether2,ether3,ether4,ether6,ether8,ether9,ether10,\
    ether11,ether12,ether13,ether14,ether15,ether16,ether17,ether18,ether19,ether20,\
	ether21,ether22,ether23,ether24,sfp-sfpplus1,sfpplus2" vlan-id=0
#Note no ether5 or 7!
add ports="ether3,ether5" vlan-id=50
add ports="ether3,ether5" vlan-id=90
add ports="ether5,ether7" vlan-id=610
#
/interface ethernet switch
# this is the command that will force use of vlan table, 
# check everything else first!, May drop you off temporarily
set forward-unknown-vlans=no
Export a configuration backup first.

Good Luck!
Here is my output when I setup the VLAN:
Code: Select all
[admin@MikroTik] > /interface ethernet switch vlan print                                
Flags: X - disabled, I - invalid 
 #   VLAN-ID PORTS                                      SVL SA-LEARNING FLOOD INGRESS-MIRROR QOS-GROUP                                      ISOLATION-PROFILE
 0         0 switch1-cpu                                no  no          no    no             none                                           promiscuous      
             ether1-master-local                       
             ether2-slave-local                        
             ether3-slave-local                        
             ether4-slave-local                        
             ether6-slave-local                        
             ether8-slave-local                        
             ether9-slave-local                        
             ether10-slave-local                       
             ether11-slave-local                       
             ether12-slave-local                       
             ether13-slave-local                       
             ether14-slave-local                       
             ether15-slave-local                       
             ether16-slave-local                       
             ether17-slave-local                       
             ether18-slave-local                       
             ether19-slave-local                       
             ether20-slave-local                       
             ether21-slave-local                       
             ether22-slave-local                       
             ether23-slave-local                       
             ether24-slave-local                       
             sfp-sfpplus1-slave-local                  
             sfpplus2-slave-local                      
 1        20 ether3-slave-local                         no  no          no    no             none                                           promiscuous      
             ether5-slave-local                        
 2        50 ether3-slave-local                         no  no          no    no             none                                           promiscuous      
             ether5-slave-local                        
 3        90 ether3-slave-local                         no  no          no    no             none                                           promiscuous      
             ether5-slave-local                        
 4       610 ether5-slave-local                         no  no          no    no             none                                           promiscuous      
             ether7-slave-local
However, when I do the above, nothing apart of the untagged traffic works - I can no longer get to the devices running on VLANs. Furthermore, when I ran this:
Code: Select all
 /interface ethernet switch set forward-invalid-vlan=no
I got locked out completely and had to restore to factory settings (I have no forward-unknown-vlans in my options).

What am I doing wrong?
Top
 
becs
MikroTik Support
MikroTik Support
Posts: 499
Joined: Thu Jul 07, 2011 8:26 am

Re: VLAN configuration issue

Wed Mar 23, 2016 2:51 pm

Here is an example for what is needed to prevent loosing access to CRS itself from specific VLAN
before setting /interface ethernet switch set forward-invalid-vlan=no:
http://wiki.mikrotik.com/wiki/Manual:CR ... figuration

Also note that /interface ethernet switch vlan entries have "learning" setting too which should be and is enabled by default in newer RouterOS versions.

You should upgrade your CRS to the latest RouterOS version to make configuration precess a little bit easier.
Top
 
petrk
just joined
Topic Author
Posts: 13
Joined: Sat Mar 19, 2016 3:52 pm

Re: VLAN configuration issue

Wed Mar 23, 2016 4:00 pm

I've upgraded to latest version 6.34.3, and setup below - seems that everything is OK so far. Have not added the last option yet (the forward-unknown-vlan).

Here is what I got to:
Code: Select all
[admin@MikroTik] /interface ethernet switch> /interface ethernet print
Flags: X - disabled, R - running, S - slave 
 #    NAME                                     MTU MAC-ADDRESS       ARP        MASTER-PORT                                   SWITCH                                  
 0 R  ether1-master-local                     1500 4C:5E:0C:92:B7:A1 enabled    none                                          switch1                                 
 1  S ether2-slave-local                      1500 4C:5E:0C:92:B7:A2 enabled    ether1-master-local                           switch1                                 
 2 RS ether3-slave-local                      1500 4C:5E:0C:92:B7:A3 enabled    ether1-master-local                           switch1                                 
 3 RS ether4-slave-local                      1500 4C:5E:0C:92:B7:A4 enabled    ether1-master-local                           switch1                                 
 4 RS ether5-slave-local                      1500 4C:5E:0C:92:B7:A5 enabled    ether1-master-local                           switch1                                 
 5 RS ether6-slave-local                      1500 4C:5E:0C:92:B7:A6 enabled    ether1-master-local                           switch1                                 
 6 RS ether7-slave-local                      1500 4C:5E:0C:92:B7:A7 enabled    ether1-master-local                           switch1                                 
 7 RS ether8-slave-local                      1500 4C:5E:0C:92:B7:A8 enabled    ether1-master-local                           switch1                                 
 8  S ether9-slave-local                      1500 4C:5E:0C:92:B7:A9 enabled    ether1-master-local                           switch1                                 
 9 RS ether10-slave-local                     1500 4C:5E:0C:92:B7:AA enabled    ether1-master-local                           switch1                                 
10  S ether11-slave-local                     1500 4C:5E:0C:92:B7:AB enabled    ether1-master-local                           switch1                                 
11 RS ether12-slave-local                     1500 4C:5E:0C:92:B7:AC enabled    ether1-master-local                           switch1                                 
12  S ether13-slave-local                     1500 4C:5E:0C:92:B7:AD enabled    ether1-master-local                           switch1                                 
13 RS ether14-slave-local                     1500 4C:5E:0C:92:B7:AE enabled    ether1-master-local                           switch1                                 
14  S ether15-slave-local                     1500 4C:5E:0C:92:B7:AF enabled    ether1-master-local                           switch1                                 
15 RS ether16-slave-local                     1500 4C:5E:0C:92:B7:B0 enabled    ether1-master-local                           switch1                                 
16 RS ether17-slave-local                     1500 4C:5E:0C:92:B7:B1 enabled    ether1-master-local                           switch1                                 
17  S ether18-slave-local                     1500 4C:5E:0C:92:B7:B2 enabled    ether1-master-local                           switch1                                 
18 RS ether19-slave-local                     1500 4C:5E:0C:92:B7:B3 enabled    ether1-master-local                           switch1                                 
19  S ether20-slave-local                     1500 4C:5E:0C:92:B7:B4 enabled    ether1-master-local                           switch1                                 
20 RS ether21-slave-local                     1500 4C:5E:0C:92:B7:B5 enabled    ether1-master-local                           switch1                                 
21 RS ether22-slave-local                     1500 4C:5E:0C:92:B7:B6 enabled    ether1-master-local                           switch1                                 
22 RS ether23-slave-local                     1500 4C:5E:0C:92:B7:B7 enabled    ether1-master-local                           switch1                                 
23 RS ether24-slave-local                     1500 4C:5E:0C:92:B7:B8 enabled    ether1-master-local                           switch1                                 
24  S sfp-sfpplus1-slave-local                1500 4C:5E:0C:92:B7:B9 enabled    ether1-master-local                           switch1                                 
25  S sfpplus2-slave-local                    1500 4C:5E:0C:92:B7:BA enabled    ether1-master-local                           switch1
Vlan table:
Code: Select all
[admin@MikroTik] /interface ethernet switch> /interface ethernet switch vlan print
Flags: X - disabled, I - invalid, D - dynamic 
 #   VLAN-ID PORTS                                                       SVL LEARN FLOOD INGRESS-MIRROR QOS-GROUP                                                     
 0 D    4095 switch1-cpu                                                 no  no    no    no             none                                                          
 1        20 ether3-slave-local                                          no  yes   no    no             none                                                          
             ether5-slave-local                                         
 2        50 ether3-slave-local                                          no  yes   no    no             none                                                          
             ether5-slave-local                                         
 3        90 ether3-slave-local                                          no  yes   no    no             none                                                          
             ether5-slave-local                                         
 4       610 ether5-slave-local                                          no  yes   no    no             none                                                          
             ether7-slave-local                                         
 5         0 switch1-cpu                                                 no  yes   no    no             none                                                          
             ether1-master-local                                        
             ether2-slave-local                                         
             ether3-slave-local                                         
             ether4-slave-local                                         
             ether6-slave-local                                         
             ether8-slave-local                                         
             ether9-slave-local                                         
             ether10-slave-local                                        
             ether11-slave-local                                        
             ether12-slave-local                                        
             ether13-slave-local                                        
             ether14-slave-local                                        
             ether15-slave-local                                        
             ether16-slave-local                                        
             ether17-slave-local                                        
             ether18-slave-local                                        
             ether19-slave-local                                        
             ether20-slave-local                                        
             ether21-slave-local                                        
             ether22-slave-local                                        
             ether23-slave-local                                        
             ether24-slave-local                                        
             sfpplus2-slave-local                                       
             sfp-sfpplus1-slave-local
Egress tagging:
Code: Select all
[admin@MikroTik] /interface ethernet switch> /interface ethernet switch egress-vlan-tag print
Flags: X - disabled, I - invalid, D - dynamic 
 #   VLAN-ID TAGGED-PORTS                                                                                                                                             
 0        20 ether3-slave-local                                                                                                                                       
             ether5-slave-local                                                                                                                                       
 1        90 ether3-slave-local                                                                                                                                       
             ether5-slave-local                                                                                                                                       
 2        50 ether3-slave-local                                                                                                                                       
             ether5-slave-local                                                                                                                                       
 3       610 ether5-slave-local                                                                                                                                       
 4 D    4095
Ingress rules:
Code: Select all
[admin@MikroTik] > /interface ethernet switch ingress-vlan-translation print                                                                          
Flags: X - disabled, I - invalid, D - dynamic 
 0   ports=ether7-slave-local service-vlan-format=any customer-vlan-format=any customer-vid=0 new-customer-vid=610 pcp-propagation=no sa-learning=yes 

 1 D ports="" service-vlan-format=any customer-vlan-format=any new-customer-vid=4095 pcp-propagation=no sa-learning=no
Where is the 4095 suddenly coming from?
Top
 
skuykend
Member Candidate
Member Candidate
Posts: 274
Joined: Tue Oct 06, 2015 7:28 am

Re: VLAN configuration issue

Wed Mar 23, 2016 5:39 pm

Where is the 4095 suddenly coming from?
That's a dynamic VLAN channel that Mikrotik uses to talk to the switch. It's normal.
Top
 
petrk
just joined
Topic Author
Posts: 13
Joined: Sat Mar 19, 2016 3:52 pm

Re: VLAN configuration issue

Wed Mar 23, 2016 7:34 pm

Where is the 4095 suddenly coming from?
That's a dynamic VLAN channel that Mikrotik uses to talk to the switch. It's normal.
Ok, cool, will ignore then - just that it was not there before.

Two questions - what is the set forward-unknown-vlans=no going to do? And what is the benefit as if I understand correctly, the VLAN table already limits where the packet can go?

Second question - what is the SVL column in the VLAN table?

Thank you very much for all the help!
Top
 
skuykend
Member Candidate
Member Candidate
Posts: 274
Joined: Tue Oct 06, 2015 7:28 am

Re: VLAN configuration issue

Thu Mar 24, 2016 2:58 am

Two questions - what is the set forward-unknown-vlans=no going to do? And what is the benefit as if I understand correctly, the VLAN table already limits where the packet can go?
Not from my experience.

From the CRS examples wiki:
Unknown/Invalid VLAN filtering

VLAN membership is defined in the VLAN table. Adding entries with VLAN id and ports makes that VLAN traffic valid on those ports. After valid VLAN configuration unknown/invalid VLAN forwarding can be disabled in global switch settings.
Option 1: disable invalid VLAN forwarding on specific ports:
/interface ethernet switch
set drop-if-invalid-or-src-port-not-member-of-vlan-on-ports=ether2,ether6,ether7,ether8

Option 2: disable invalid VLAN forwarding on all ports:
/interface ethernet switch
set forward-unknown-vlan=no
Second question - what is the SVL column in the VLAN table?
Not really an expert on any of this, but this has to do with MAC address SA-LEARNING and whether each VLAN is learned independently or shared across VLANS. Don't know when it would need to be changed/used.
Top
 
petrk
just joined
Topic Author
Posts: 13
Joined: Sat Mar 19, 2016 3:52 pm

Re: VLAN configuration issue

Tue Mar 29, 2016 8:54 pm

A progress report - I've also set forward-unknown-vlan=no and it all seems to be working - time to turn back DHCP server on the 4g modem to see if any leases will seep through.

Quick question - is there any reason why untagged network is 0 in Mikrotik CRS and 1 in Netgear's config utility?
Top
Locked

Who is online

Users browsing this forum: qatar2022, und3rd06012 and 121 guests
  4. RouterOS
  5. Beginner Basics