Community discussions

MikroTik App
 
supercioni
just joined
Topic Author
Posts: 11
Joined: Fri Jan 22, 2016 9:20 pm

SWITCHING AND MANAGEMENT VLAN

Wed Dec 29, 2021 1:10 pm

Hello,
Following documentation i'm trying to setup an rb750Gr3 as a local switch with management on vlan 30.
Management not working and i can't figure out why.
this is the config:

# jan/02/1970 00:45:19 by RouterOS 6.49.2

#
# model = RouterBOARD 750G r3

/interface bridge
add name=BR0 protocol-mode=none vlan-filtering=yes
/interface vlan
add interface=BR0 name=vlan30.BR0 vlan-id=30
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/interface bridge port
add bridge=BR0 interface=ether1
add bridge=BR0 interface=ether2
add bridge=BR0 interface=ether3 pvid=10
add bridge=BR0 interface=ether4 pvid=10
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/interface bridge vlan
add bridge=BR0 tagged=ether1,ether2 untagged=ether3,ether4 vlan-ids=10
add bridge=BR0 tagged=ether1,ether2 vlan-ids=20
add bridge=BR0 tagged=ether1,ether2 vlan-ids=30
/ip address
add address=192.168.130.5/24 interface=vlan30.BR0 network=192.168.130.0
/ip route
add distance=1 gateway=192.168.130.1

Thanks in advance for help
 
ConnyMercier
Forum Veteran
Forum Veteran
Posts: 725
Joined: Tue Dec 17, 2019 1:08 pm

Re: SWITCHING AND MANAGEMENT VLAN  [SOLVED]

Wed Dec 29, 2021 2:55 pm

Almost !!!
Very small mistake in the Bridge VLAN-Filtering


Here is you mistake:
You need to add the bridge-Interface as "Tagged"
If you want the Mikrotik-Device to be able to Talk with the VLAN

Simply replace or edit this part :
/interface bridge vlan
add bridge=BR0 tagged=ether1,ether2 untagged=ether3,ether4 vlan-ids=10
add bridge=BR0 tagged=ether1,ether2 vlan-ids=20
add bridge=BR0 tagged=ether1,ether2 vlan-ids=30
with this and you will be good =)
/interface bridge vlan
add bridge=BR0 tagged=ether1,ether2 untagged=ether3,ether4 vlan-ids=10
add bridge=BR0 tagged=ether1,ether2 vlan-ids=20
add bridge=BR0 tagged=BR0,ether1,ether2 vlan-ids=30
 
supercioni
just joined
Topic Author
Posts: 11
Joined: Fri Jan 22, 2016 9:20 pm

Re: SWITCHING AND MANAGEMENT VLAN

Wed Dec 29, 2021 3:02 pm

Thanks, i've missed it !
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 19322
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: SWITCHING AND MANAGEMENT VLAN

Wed Dec 29, 2021 3:39 pm

Solved my ass, Conny was sloppy as shit ;-)
Seriously your setup seems off.
There are evidently three vlans in play.

VLAN30, VLAN20 and VLAN10, where VLAN30 is the management vlan.

THE GOOD
(1) the switch has an IP address on the managment vlan subnet
(2) the switch has a route to the gateway of management vlan

THE BRIDGE
based on interface bridge ports
(3) you have trunk ports on ether1 and ether2, assuming ether1 is from the router and ether2 is too another smart device
(4) you have access ports on ether3 and ether4, assuming going to dumb devices such as PCs or printers (on vlan10)
based on interface vlan settings
(5) Vlan 10 goes to all bridge etherports
(6) VLAN20 goes to the two trunk ports only
(7) VLAN30 goes to the two trunk ports only

THE BAD
(5) In all cases on interface bridge vlan settings you forget to TAG the BRIDGE which in your case is BR0
add bridge=BR0 tagged=BR0,ether1,ether2 untagged=ether3,ether4 vlan-ids=10
add bridge=BR0 tagged=BR0,ether1,ether2 vlan-ids=20
add bridge=BR0 tagged=BR0,ether1,ether2 vlan-ids=30

(6) You are MISSING the definition of the vlans for VLAN10 and VLAN20 ???????
/interface vlan
add interface=BR0 name=vlan30.BR0 vlan-id=30
add interface=BR0 name=vlan10.BR0 vlan-id=10
add interface=BR0 name=vlan20.BR0 vlan-id=20


(7) DISCOVERY Should be set to the management vlan.
/ip neighbor discovery-settings
set discover-interface-list=MANAGE

(8) BUT first do this, to go along with discovery setting - create the necessary list and enter the correct member.
/interface list
add name=MANAGE
/interface list members
add interface=vlan30.BR0 list=MANAGE

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Finally consider if you have an extra port (lets say ether5) to create an entry into the switch that is not dependent upon the switch.
Typically if one makes an error during configuration it locks one out of the bridge configuration/setup. Always handy to be able to reach the router regardless of bridge status.
If interested.
Ensure ether5 is not on the bridge.
Give it a name such as ether5-access
Give it an IP address of 192.168.5.2 network 192.168.5.0
Add it to the MANAGE list add interface=ether5-access list=MANAGE

Then connect your desktop/laptop etc to ether5 and set IPV4 settigns to an IP of lets say 192.168.5.5 gateway 192.168.5.1 netmask 255.255.255.0 and you should have access.

Who is online

Users browsing this forum: actomobile, infabo, massinia, rmenkveld and 36 guests