I've just tried to do some initial setup on a CRS112 with RouterOS 6.42.4 (so, bridge hw offloading).
I've tried to configure a tagged mgmt port (ether2) on the device according to https://wiki.mikrotik.com/wiki/Manual:C ... les#Tagged and this does in fact work just fine, but I'm really confused because the example configuration adds entries to the egress-vlan-tag and the /interface ethernet switch vlan table, but on my device none of it was neccessary for my tagged management connection to become reachable?
I've also done everything I believe I need to to enable port VLAN isolation by adding drop-if-invalid-or-src-port-not-member-of-vlan-on-ports for ether2 and setting forward-unknown-vlan=no globally, nevertheless I can still access the CRS just fine on my tagged mgmt IP without those egress / switch vlan entries that are noted in the example guide? Are they no longer neccessary either with 6.41+ and are just missing that distinction in the documentation?
Or did I miss something? Do I need those in place only when I begin doing VLAN translation or Q-in-Q or similar advanced L2 operations as seen in the same example guide?
Code: Select all
# jan/02/1970 07:20:53 by RouterOS 6.42.4 /interface bridge add admin-mac=64:D1:54:11:11:D9 auto-mac=no comment=defconf name=bridge add name=bridge-MGMT /interface vlan add interface=bridge-MGMT name=nwinfra vlan-id=810 /interface ethernet switch set drop-if-invalid-or-src-port-not-member-of-vlan-on-ports=ether2 forward-unknown-vlan=no /interface bridge port add bridge=bridge comment=defconf interface=ether1 add bridge=bridge comment=defconf interface=ether3 add bridge=bridge comment=defconf interface=ether4 add bridge=bridge comment=defconf interface=ether5 add bridge=bridge comment=defconf interface=ether6 add bridge=bridge comment=defconf interface=ether7 add bridge=bridge comment=defconf interface=ether8 add bridge=bridge comment=defconf interface=sfp9 add bridge=bridge comment=defconf interface=sfp10 add bridge=bridge comment=defconf interface=sfp11 add bridge=bridge comment=defconf interface=sfp12 add bridge=bridge-MGMT interface=ether2 /ip address add address=172.30.10.198/24 interface=nwinfra network=172.30.10.0
EDIT: also weird - the CRS bridge-MGMT is running RSTP, but regards itself as the root bridge. On the adjacent L2 switch on ether2 (a Cisco switch) I can confirm that the Cisco switch sends BPDUs, but has not received a single one from the CRS (and apparently the CRS seems to ignore the superior BPDUs it receives from the Cisco switch on L2).
Code: Select all
/interface bridge port monitor [ find bridge=bridge-MGMT ] interface: ether2 status: in-bridge port-number: 1 role: designated-port edge-port: yes edge-port-discovery: yes point-to-point-port: yes external-fdb: no sending-rstp: yes learning: yes forwarding: yes hw-offload-group: switch1