I've just tried to do some initial setup on a CRS112 with RouterOS 6.42.4 (so, bridge hw offloading).
I've tried to configure a tagged mgmt port (ether2) on the device according to https://wiki.mikrotik.com/wiki/Manual:C ... les#Tagged and this does in fact work just fine, but I'm really confused because the example configuration adds entries to the egress-vlan-tag and the /interface ethernet switch vlan table, but on my device none of it was neccessary for my tagged management connection to become reachable?
I've also done everything I believe I need to to enable port VLAN isolation by adding drop-if-invalid-or-src-port-not-member-of-vlan-on-ports for ether2 and setting forward-unknown-vlan=no globally, nevertheless I can still access the CRS just fine on my tagged mgmt IP without those egress / switch vlan entries that are noted in the example guide? Are they no longer neccessary either with 6.41+ and are just missing that distinction in the documentation?
Or did I miss something? Do I need those in place only when I begin doing VLAN translation or Q-in-Q or similar advanced L2 operations as seen in the same example guide?
Code: Select all
# jan/02/1970 07:20:53 by RouterOS 6.42.4
/interface bridge
add admin-mac=64:D1:54:11:11:D9 auto-mac=no comment=defconf name=bridge
add name=bridge-MGMT
/interface vlan
add interface=bridge-MGMT name=nwinfra vlan-id=810
/interface ethernet switch
set drop-if-invalid-or-src-port-not-member-of-vlan-on-ports=ether2 forward-unknown-vlan=no
/interface bridge port
add bridge=bridge comment=defconf interface=ether1
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=ether6
add bridge=bridge comment=defconf interface=ether7
add bridge=bridge comment=defconf interface=ether8
add bridge=bridge comment=defconf interface=sfp9
add bridge=bridge comment=defconf interface=sfp10
add bridge=bridge comment=defconf interface=sfp11
add bridge=bridge comment=defconf interface=sfp12
add bridge=bridge-MGMT interface=ether2
/ip address
add address=172.30.10.198/24 interface=nwinfra network=172.30.10.0EDIT: also weird - the CRS bridge-MGMT is running RSTP, but regards itself as the root bridge. On the adjacent L2 switch on ether2 (a Cisco switch) I can confirm that the Cisco switch sends BPDUs, but has not received a single one from the CRS (and apparently the CRS seems to ignore the superior BPDUs it receives from the Cisco switch on L2).
Code: Select all
/interface bridge port monitor [ find bridge=bridge-MGMT ]
interface: ether2
status: in-bridge
port-number: 1
role: designated-port
edge-port: yes
edge-port-discovery: yes
point-to-point-port: yes
external-fdb: no
sending-rstp: yes
learning: yes
forwarding: yes
hw-offload-group: switch1
