Example with CRS326. All ports in a flat VLAN 1 except three special ports:
ether9 should have VLANs 2030 and 2031 tagged, nothing untagged.
ether10 should have VLANs 2030 and 2032 tagged, nothing untagged.
ether11 should have VLANs 2031 and 2032 tagged, nothing untagged.
These three ports should not accept anything untagged (so ingress-filtering=yes frame-types=admit-only-vlan-tagged) and should not send anything untagged. They should not participate in VLAN 1 in any way, they should not be able to see any device on the other ports at all.
There doesn't seem to be a way to unset pvid on a port, so I've given each port a unique pvid (1001, 1002, 1003) just in case (it would be nice if you could omit pvid on a port that is only admitting vlan tagged, since it is irrelevant).
Yet still untagged traffic is leaking between all ports. The simplest evidence for this is that they can see all the other attached devices under "/ip neighbor print", whereas they should not because they do not have any VLANs in common.
Am I missing something?
Code: Select all
/interface bridge add admin-mac=64:D1:54:zz:zz:zz auto-mac=no name=bridge1 vlan-filtering=yes /interface bridge port add bridge=bridge1 interface=ether2 add bridge=bridge1 interface=ether3 add bridge=bridge1 interface=ether4 add bridge=bridge1 interface=ether5 add bridge=bridge1 interface=ether6 add bridge=bridge1 interface=ether7 add bridge=bridge1 interface=ether8 add bridge=bridge1 frame-types=admit-only-vlan-tagged ingress-filtering=yes interface=ether9 pvid=1001 add bridge=bridge1 frame-types=admit-only-vlan-tagged ingress-filtering=yes interface=ether10 pvid=1002 add bridge=bridge1 frame-types=admit-only-vlan-tagged ingress-filtering=yes interface=ether11 pvid=1003 add bridge=bridge1 interface=ether12 add bridge=bridge1 interface=sfp-sfpplus1 add bridge=bridge1 interface=sfp-sfpplus2 add bridge=bridge1 interface=ether1 /interface bridge vlan add bridge=bridge1 tagged=ether9,ether10 vlan-ids=2030 add bridge=bridge1 tagged=ether9,ether11 vlan-ids=2031 add bridge=bridge1 tagged=ether10,ether11 vlan-ids=2032
bridge vlan print confirms VLAN 1 should not be appearing on these three ports:
Code: Select all
/interface bridge vlan> print Flags: X - disabled, D - dynamic # BRIDGE VLAN-IDS CURRENT-TAGGED CURRENT-UNTAGGED 0 bridge1 2030 ether9 ether10 1 bridge1 2031 ether9 ether11 2 bridge1 2032 ether10 ether11 3 D bridge1 1001 ether9 4 D bridge1 1002 ether10 5 D bridge1 1003 ether11 6 D bridge1 1 bridge1 ether3 ether4 ether5 ether6 ether7 ether8 ether1
I also note that ports appear in current-untagged long after they have been removed, so yes I have done a reboot in between to clear this.