New to the Mikrotik world

AWSb · Thu Sep 26, 2019 1:41 am

Hi,

I started to set up my CRS328-24P-4S+. I followed the instructions on wiki page but now I got stuck.
On ether1 (E1WAN) I connect my internet gateway. On ether2 (E2TEST) I connected a laptop to test VLAN20 (VL20PC). I don't why but my laptop doesn't get any IP address from the DHCP. The ethernet port is untagged.

Thanks

/caps-man configuration
add country=germany datapath.local-forwarding=yes datapath.vlan-id=10 \
    datapath.vlan-mode=use-tag hide-ssid=yes name=meinsMO \
    security.authentication-types=wpa2-psk security.passphrase=password ssid=\
    meinsMO
add country=germany datapath.local-forwarding=yes datapath.vlan-id=20 \
    datapath.vlan-mode=use-tag hide-ssid=yes name=meinsPC \
    security.authentication-types=wpa2-psk security.passphrase=password \
    ssid=meinsPC
add country=germany datapath.local-forwarding=yes datapath.vlan-id=30 \
    datapath.vlan-mode=use-tag hide-ssid=yes name=meinsHA \
    security.authentication-types=wpa2-psk security.passphrase=password \
    ssid=meinsHA
/interface bridge
add admin-mac=74:4D:28:31:27:54 auto-mac=no name=BRVL pvid=99 vlan-filtering=\
    yes
/interface ethernet
set [ find default-name=ether1 ] l2mtu=9018 name=E1WAN poe-out=off
set [ find default-name=ether2 ] l2mtu=9018 name=E2TEST
set [ find default-name=ether10 ] l2mtu=9018 name=E10ROUTPC
set [ find default-name=ether12 ] l2mtu=9018 name=E12APEG
set [ find default-name=ether14 ] l2mtu=9018 name=E14APOG
set [ find default-name=ether16 ] l2mtu=9018 name=E16ROUTGA
set [ find default-name=ether17 ] l2mtu=9018 name=E17SOANNA
set [ find default-name=ether18 ] l2mtu=9018 name=E18SOTOM
set [ find default-name=ether19 ] l2mtu=9018 name=E19SOALOIS
set [ find default-name=ether21 ] l2mtu=9018 name=E21OCTO
set [ find default-name=ether23 ] l2mtu=9018 name=E23HA
set [ find default-name=ether24 ] l2mtu=9018 name=E24SWWO
set [ find default-name=sfp-sfpplus1 ] l2mtu=9018 name=SFP1PC
set [ find default-name=sfp-sfpplus2 ] l2mtu=9018 mac-address=\
    74:4D:28:31:27:6C name=SFP2PC
set [ find default-name=sfp-sfpplus3 ] l2mtu=9018 name=SFP3SERVER
set [ find default-name=sfp-sfpplus4 ] l2mtu=9018 mac-address=\
    74:4D:28:31:27:6E name=SFP4SERVER
set [ find default-name=ether3 ] l2mtu=9018
set [ find default-name=ether4 ] l2mtu=9018
set [ find default-name=ether5 ] l2mtu=9018
set [ find default-name=ether6 ] l2mtu=9018
set [ find default-name=ether7 ] l2mtu=9018
set [ find default-name=ether8 ] l2mtu=9018
set [ find default-name=ether9 ] l2mtu=9018
set [ find default-name=ether11 ] l2mtu=9018
set [ find default-name=ether13 ] l2mtu=9018
set [ find default-name=ether15 ] l2mtu=9018
set [ find default-name=ether20 ] l2mtu=9018
set [ find default-name=ether22 ] l2mtu=9018
/interface vlan
add interface=BRVL mtu=9000 name=VL10MO vlan-id=10
add interface=BRVL mtu=9000 name=VL20PC vlan-id=20
add interface=BRVL mtu=9000 name=VL30HA vlan-id=30
add interface=BRVL mtu=9000 name=VL40GA vlan-id=40
add interface=BRVL mtu=9000 name=VL99GW vlan-id=99
/interface bonding
add mode=802.3ad name=SFPPC slaves=SFP1PC,SFP2PC
add mode=802.3ad name=SFPSERVER slaves=SFP3SERVER,SFP4SERVER
/caps-man configuration
add channel.band=2ghz-b/g/n channel.extension-channel=Ce channel.frequency=\
    2417 country=germany datapath.bridge=BRVL datapath.local-forwarding=yes \
    datapath.vlan-id=40 datapath.vlan-mode=use-tag mode=ap name=meinsGA2G \
    security.authentication-types=wpa2-psk security.passphrase=\
    password ssid=meinsGA
add channel.band=5ghz-a/n/ac channel.control-channel-width=10mhz \
    channel.extension-channel=Ce channel.frequency=5500 country=germany \
    datapath.bridge=BRVL datapath.local-forwarding=yes datapath.vlan-id=40 \
    datapath.vlan-mode=use-tag mode=ap name=meinsGA5G \
    security.authentication-types=wpa2-psk security.passphrase=\
    password ssid=meinsGA
/caps-man interface
add configuration=meinsGA2G datapath.bridge=BRVL disabled=no mac-address=\
    00:00:00:00:00:00 master-interface=none name=CAPGA2G radio-mac=\
    00:00:00:00:00:00 radio-name=""
add configuration=meinsGA5G disabled=no mac-address=02:00:00:00:00:00 \
    master-interface=CAPGA2G name=CAPGA5G radio-mac=00:00:00:00:00:00 \
    radio-name=""
/interface list
add name=WAN
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip pool
add name=DHCPPO10MO ranges=222.222.210.2-222.222.210.254
add name=DHCPPO20PC ranges=222.222.220.2-222.222.220.254
add name=DHCPPO30HA ranges=222.222.230.2-222.222.230.254
add name=DHCPPO40GA ranges=222.222.240.2-222.222.240.254
/ip dhcp-server
add add-arp=yes address-pool=DHCPPO10MO disabled=no interface=VL10MO \
    lease-time=23h59m59s name=DHCP10MO
add add-arp=yes address-pool=DHCPPO20PC disabled=no interface=VL20PC \
    lease-time=23h59m59s name=DHCP20PC
add address-pool=DHCPPO30HA disabled=no interface=VL30HA lease-time=23h59m59s \
    name=DHCP30HA
add address-pool=DHCPPO40GA disabled=no interface=VL40GA lease-time=23h59m59s \
    name=DHCP40GA
/caps-man manager
set ca-certificate=auto certificate=auto enabled=yes
/caps-man manager interface
set [ find default=yes ] forbid=yes
add disabled=no interface=E1WAN
/interface bridge port
add bridge=BRVL interface=E1WAN pvid=99
add bridge=BRVL interface=E2TEST pvid=20
add bridge=BRVL interface=E12APEG
add bridge=BRVL interface=E14APOG
add bridge=BRVL interface=E16ROUTGA
add bridge=BRVL interface=E17SOANNA pvid=30
add bridge=BRVL interface=E18SOTOM pvid=30
add bridge=BRVL interface=E19SOALOIS pvid=30
add bridge=BRVL interface=E21OCTO pvid=30
add bridge=BRVL interface=E23HA pvid=30
add bridge=BRVL interface=E24SWWO pvid=30
add bridge=BRVL interface=E10ROUTPC
add bridge=BRVL interface=SFPPC pvid=20
add bridge=BRVL interface=SFPSERVER pvid=20
/interface bridge vlan
add bridge=BRVL tagged=E10ROUTPC,E12APEG,E14APOG,E16ROUTGA vlan-ids=10
add bridge=BRVL tagged=E10ROUTPC,E12APEG,E14APOG,E16ROUTGA untagged=\
    SFP3SERVER,SFP4SERVER,E2TEST,SFPPC vlan-ids=20
add bridge=BRVL tagged=E10ROUTPC,E12APEG,E14APOG,E16ROUTGA untagged=\
    E17SOANNA,E18SOTOM,E19SOALOIS,E21OCTO,E23HA,E24SWWO vlan-ids=30
add bridge=BRVL tagged=E10ROUTPC,E12APEG,E14APOG,E16ROUTGA vlan-ids=40
/interface list member
add interface=E1WAN list=WAN
add interface=BRVL list=LAN
/ip address
add address=222.222.210.1/24 interface=VL10MO network=222.222.210.0
add address=222.222.220.1/24 interface=VL20PC network=222.222.220.0
add address=222.222.230.1/24 interface=VL30HA network=222.222.230.0
add address=222.222.240.1/24 interface=VL40GA network=222.222.240.0
/ip dhcp-client
# DHCP client can not run on slave interface!
add dhcp-options=hostname,clientid disabled=no interface=E1WAN
/ip dhcp-server network
add address=222.222.210.0/24 dns-server=192.168.0.254,8.8.8.8,8.8.4.4 \
    gateway=222.222.210.1
add address=222.222.220.0/24 dns-server=192.168.0.254,8.8.8.8,8.8.4.4 \
    gateway=222.222.220.1
add address=222.222.230.0/24 dns-server=192.168.0.254,8.8.8.8,8.8.4.4 \
    gateway=222.222.230.1
add address=222.222.240.0/24 dns-server=192.168.0.254,8.8.8.8,8.8.4.4 \
    gateway=222.222.240.1

AWSb · Thu Sep 26, 2019 1:23 pm

This is how my network should look in the end. Does this make sense?

Network.jpg

Amm0 · Fri Sep 27, 2019 2:21 am

I looked at your configuration, and nothing jumps out as what's wrong with your approach.

When you use vlan-filtering=yes , how ports get tagged/untagged is effected by both the PVID set under Bridge > Ports and the Bridge > VLANs entries. There is a dense note in wiki that describe the relationship, and that's where your configuration in Bridge > VLANs need to tweaked to align with the PVIDs you set...see https://wiki.mikrotik.com/wiki/Manual:Interface/Bridge

You don't have to add access ports as untagged ports, they will be added dynamically as untagged port with the VLAN ID that is specified in PVID, you can specify just the trunk port as tagged port. All ports that have the same PVID set will be added as untagged ports in a single entry. You must take into account that the bridge itself is a port and it also has a PVID value, this means that the bridge port also will be added as untagged port for the ports that have the same PVID. You can circumvent this behaviour by either setting different PVID on all ports (even the trunk port and bridge itself), or to use frame-type set to accept-only-vlan-tagged.

Assuming a device is plugged into a port, the "Currently Untagged" and "Currently Tagged" columns in Bridge > VLANs show what actually being applied by RouterOS. I typically fiddle with the interface lists/PVIDs until that looks right first.

Focusing on ether2(E2TEST), if it's showing as "Currently Untagged", then I'd be looking to see if you need to add the bridge interface itself under Bridge > VLANs. I may not be explaining part well, it's kinda esoteric/confusing BUT the Interface > VLAN is listening on the bridge interface (and the DHCP server interface), so thus the bridge is a relevant "port" to "vlan-filtering" feature. If not, I'd try removing ether2(E2TEST) as an "untagged" interface in VLAN 20's entry in Bridge > VLANs.

Some else maybe able tell you the couple magic lines that need to get changed, but that little note from the wiki was key for me to understand this logic.

Amm0 · Fri Sep 27, 2019 2:33 am

Also, in your configuration you have:

/ip dhcp-client
# DHCP client can not run on slave interface!
add dhcp-options=hostname,clientid disabled=no interface=E1WAN

Since your WAN is ether1, you need to have not as a bridge port (and adjust your diagram) or create/use VLAN 99 as an VLAN interface like your other ones, with the DHCP Client listening to the VLAN interface.

AWSb · Tue Oct 01, 2019 1:16 am

Thanks Amm0. I tried to fix it over the weekend and finally got it up and running today.

New to the Mikrotik world

New to the Mikrotik world

Re: New to the Mikrotik world

Re: New to the Mikrotik world

Re: New to the Mikrotik world

Re: New to the Mikrotik world

Who is online