Community discussions

MikroTik App
 
freebird1384
just joined
Topic Author
Posts: 2
Joined: Fri Aug 17, 2018 9:25 pm

CRS Egress Tag Removal

Fri Aug 17, 2018 10:16 pm

After really digging into this for two days I believe I've found the source of the issue but I do not have the solution. After following https://wiki.mikrotik.com/wiki/Manual:C ... AN_Routing I've found that packets which cross the routing CPU (packets going from one VLAN to another) or traveling through the WAN are delivered to the destination interface without the tag being stripped.

Using the example from the link above that means if the computer A connected to ether6 on VLAN200 tries to ping the computer B connected to ether7 on VLAN300 computer B receives packets with the VLAN ID 300 still in tact. If we add another port and computer to VLAN200 say on ether10 called computer C, it can ping computer A and the tags are removed on Egress. If any of these computers ping a public website like 8.8.8.8 the return packets are received by the computer with the tag in tact and can be seen using Wireshark.

Oddly this is not an issue when I'm booted into Windows, as I understand it Win ignores VLAN tags but when I'm in Linux (as I am most of the time) or for any of the other hardware (security cameras, Linux servers, SmartTV) the system is brought to it's knees. I've seen other similar posts, some people say rebooting helps (hasn't helped me) I've tried:

/interface ethernet switch port set egress-vlan-mode=untagged numbers=x (this seams to have no effect at all)
/interface ethernet switch vlan add vlan-id=0 ports=etherX (I end up with two tags on received packets, one for the VLAN ID and one with ID 0)
/interface ethernet switch egress-vlan-translation> add new-customer-vid=0 customer-vlan-format=any ports=etherX (again I end up with two tags on received packets, one for the VLAN ID and one with ID 0)

I really don't want to abandon VLANs on this switch, I love the hardware but this is a game killer. Advice or suggestions are very welcome.
 
idlemind
Forum Guru
Forum Guru
Posts: 1147
Joined: Fri Mar 24, 2017 11:15 pm
Location: USA

Re: CRS Egress Tag Removal

Sun Aug 19, 2018 4:05 am

If you are using the current branch or newer you'll want to use the new(ish) VLAN aware bridge and not configure anything in the Ethernet switch menu.
 
Samot
Member Candidate
Member Candidate
Posts: 109
Joined: Sat Nov 25, 2017 10:01 pm

Re: CRS Egress Tag Removal

Sun Aug 19, 2018 5:46 am

If you are using the current branch or newer you'll want to use the new(ish) VLAN aware bridge and not configure anything in the Ethernet switch menu.
Except that the CRS1XX/2XX actually use a special switch menu and they do not support Bridge VLAN Filtering. We are working with him on this in the IRC channel and we found some issues with the configuration that we've offered corrections on and are waiting for an update.
 
idlemind
Forum Guru
Forum Guru
Posts: 1147
Joined: Fri Mar 24, 2017 11:15 pm
Location: USA

Re: CRS Egress Tag Removal

Sun Aug 19, 2018 4:37 pm

If you are using the current branch or newer you'll want to use the new(ish) VLAN aware bridge and not configure anything in the Ethernet switch menu.
Except that the CRS1XX/2XX actually use a special switch menu and they do not support Bridge VLAN Filtering. We are working with him on this in the IRC channel and we found some issues with the configuration that we've offered corrections on and are waiting for an update.
Huh? Everything 6.41+ support VLAN aware bridging and will automatically toggle the hardware on and off based on feature consumption and what MikroTik has coded. The development direction is to drop switch chip configs.
 
proximus
Member Candidate
Member Candidate
Posts: 113
Joined: Tue Oct 04, 2011 1:46 pm

Re: CRS Egress Tag Removal

Sun Aug 19, 2018 4:59 pm

Current (6.41+) CRS documentation is to configure CRS1xx/CRS2xx VLANs via the switch menu. CRS3xx on the bridge menu.
https://wiki.mikrotik.com/wiki/Manual:CRS_Router

Also, this thread with MT input discusses the VLAN filtering differences.
viewtopic.php?t=133129

I wish MT would developed a unified VLAN configuration menu and everything would be handled "under the hood".
 
freebird1384
just joined
Topic Author
Posts: 2
Joined: Fri Aug 17, 2018 9:25 pm

Re: CRS Egress Tag Removal

Fri Aug 24, 2018 2:33 am

I want to make sure to thank the IRC channel for all their help. I can't say exactly what stopped the egress tagging as we went through several default restores but I can say Samot was correct, the CRS1xx\2xx does not support hardware offloading for Bridge VLAN filtering while the CRS3xx will.

Off the topic of this post but while using the default config and applying the wiki examples for CRS1xx\2xx we discovered while machines were able to pass traffic over the VLAN and could even ping addresses across the NAT they could not browse the Internet or use other protocols until we disabled FastTrack on the Filter chain of the firewall. Thanks Frank__TV.

Again, big thanks to everyone who contributed.

Who is online

Users browsing this forum: anav, medharrak, welan, ysha and 76 guests