I've noticed something that has been bothering/driving me a bit mad.
I'm not 100% sure but the Mikrotik 250GS switch seems to be based on the same Atheros switch chip that is in the RB450G.
However, with Router OS, a very important option appears to be missing. Please read on if you are interested:).

The below assumes the switch ports are assigned a master-port, so that the slave ports behave like a normal switch.

1)If you go to /interface ethernet switch vlan, you must assign VLAN-ID 0 to every access port (untagged port). This is stated as such in the manual.
2)In the /interface ethernet switch port menu, you can set a port's VLAN-MODE to secure.

Normally, hosts attached to access ports may not send tagged frames. And in order to allow an access port to accept untagged frames it must be assinged a VLAN-ID of 0 in the /interface ethernet switch vlan menu.

So by default all access ports can ping each other. You have no way of indicating they are in different VLANs. So the important option that is missing is usually called PVID (port vlan-id).
With SWos this option is present, and I quote from the manual (the important bit is bolded):

Default VLAN ID: Switch will treat untagged ingress packets as they are tagged with this VLAN-ID. VLAN tag itself will be added only if there is VLAN Header = add if missing specified on egress port

If this option were present with ROS, you could actually put a port in VLAN x (x= a number for a VLAN-ID) at the /interface ethernet switch vlan menu. You should then set this ports' default VLAN-ID equal to the VLAN-ID you have just assigned to it in the /interface ethernet switch vlan menu.


Has this option been left out deliberatey to discourage using the router as a VLAN-switch?