Example:
ether1 = Trunk - VLAN1
ether2 = Downstream network - VLAN5
ether24 = Canary Device - VLAN1
With the above, I would notice that ether2 and ether24 get the same Tx bandwidth, as if they were being mirrored. And when I would packet sniff on ether24, I'd see data bound for ether2. I figured this was a leaking/isolation issue, as something on ether24 shouldn't see anything bound for ether2, due to the different vlans. I read somewhere on here that someone found a fix for this (/interface ethernet switch port set [find] learn-restricted-unknown-sa=yes) in 6.11, but it is not working in 6.13?
I saw that 6.12 overhauled a lot of the CRS VLAN code, but due to the reboot crashing ("Starting services") error with 6.12 I waited until 6.13 to work on this. In looking at the new VLAN code, namely the "Port-level Isolation" section of the newly updated CRS VLAN examples wiki page, I noticed that there are now options for said port-level isolation, like this:
Code: Select all
/interface ethernet switch port
set ether2 isolation-leakage-profile-override=0
/interface ethernet switch port
set ether5 isolation-leakage-profile-override=1
set ether6 isolation-leakage-profile-override=1
/interface ethernet switch port-isolation
add port-profile=1 ports=ether2 type=dst
