Hi,

I need to connect to my ISP trough SFP but the providers PPPoe Server requires a tagged Vlan (802.Q). I tryed adding a Vlan to the SFP interface adding "service tag" but didn't work. I tried with a bridge adding SFP with SPID needed and Tag on SFP port but didn't work. I saw that this last feater was added recently. Is there something not working yet or what could be the problem?

Thank you in advance.
Roland M.

Just create a normal VLAN and add the PPPoE on that VLAN interface and not on SFP

Hi,

this is the first step I tried but it's not working. Maybe no tag is added in this case or where do you flag tagged or not?

bye
Roland M.

Hi,

here the actual settings:

# NAME MTU ARP VLAN-ID INTERFACE
0 R vlanPPPoE 1500 enabled 11 sfp-wan

# NAME TYPE ACTUAL-MTU L2MTU MAX-L2MTU
0 R ether1 - wan2 ether 1500 1598 8156
1 RS ether2 - lan1 ether 1500 1598 8156
2 R ether3 - lan2wifi ether 1500 1598 8156
3 RS ether4 - lan1 ether 1500 1598 8156
4 S ether5 - lan1 ether 1500 1598 8156
5 ether6 ether 1500 1598 8156
6 ether7 ether 1500 1598 8156
7 ether8 ether 1500 1598 8156
8 ether9 ether 1500 1598 8156
9 ether10 - wan ether 1500 1598 8156
10 R sfp-wan ether 1500 1600 8158
11 X Bcom pppoe-out
12 R SSTPchipware sstp-out 1500
13 R bridge-lan bridge 1500 1598
14 R bridge-sfp bridge 1500 65535
15 R vlanPPPoE vlan 1500 1596

sfp-wan is the sfp connected to the fiber of the ISP. VlanPPPoE is the Vlan of the interface 10 sfp-wan.


/interface vlan
add interface=sfp-wan name=vlanPPPoE vlan-id=11
/interface pppoe-client
add add-default-route=yes default-route-distance=2 interface=vlanPPPoE \
keepalive-timeout=disabled name=xxx password=xxxxxxx service-name=\
Bcom user=xxxxx

Bye
Roland M.

This should work OK, I use it all the time. But of course every detail must be correct according to your ISP specification!

Hi,

unfortunately it does not work. I don't think the vlan configured in this way sends the 802.Q tag. I tried the connection with a managed switch and also there no tag arrived. To connect with the switch I had to create a bridge and switch on vlan filtering dn add a tagged vlan port.

I think connection through PPPoe client do not forward the tag in this way. Maybe someone knows how it works.

Thanks.
Roland M.

Hi,

it's a RB3011UiAS. The ISP say's thant no traffic arrives to his enviroment.

Here the complete config:

# sep/21/2019 13:43:11 by RouterOS 6.45.6
# software id = 7RU1-FTD9
#
# model = RouterBOARD 3011UiAS
# serial number = 8EED090C6443
/interface bridge
add name=bridge-lan
add disabled=yes name=bridge-sfp vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] name="ether1 - wan2"
set [ find default-name=ether2 ] name="ether2 - lan1"
set [ find default-name=ether3 ] name="ether3 - lan2wifi"
set [ find default-name=ether4 ] name="ether4 - lan1"
set [ find default-name=ether5 ] name="ether5 - lan1"
set [ find default-name=ether10 ] auto-negotiation=no name="ether10 - wan" \
speed=100Mbps
set [ find default-name=sfp1 ] advertise="10M-half,10M-full,100M-half,100M-ful\
l,1000M-half,1000M-full,2500M-full,5000M-full,10000M-full" \
auto-negotiation=no name=sfp-wan speed=100Mbps
/interface vlan
add interface=sfp-wan name=vlanPPPoE vlan-id=11
/interface pppoe-client
add add-default-route=yes default-route-distance=2 disabled=no interface=\
vlanPPPoE keepalive-timeout=disabled name=Bcom service-name=Bcom user=\
22000155650@ppp.brennercom.net
/interface ethernet switch port
set 5 default-vlan-id=0 vlan-mode=fallback
set 6 default-vlan-id=0 vlan-mode=fallback
set 7 default-vlan-id=0 vlan-mode=fallback
set 8 default-vlan-id=0 vlan-mode=fallback
set 9 default-vlan-id=0 vlan-mode=fallback
set 11 default-vlan-id=0 vlan-mode=fallback
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp_pool1 ranges=192.168.15.2-192.168.15.254
add name=dhcp_pool2 ranges=192.168.14.2-192.168.14.254
/ip dhcp-server
add address-pool=dhcp_pool1 disabled=no interface="ether3 - lan2wifi" name=\
dhcp2
add address-pool=dhcp_pool2 disabled=no interface=bridge-lan name=dhcp1
/interface sstp-client
add connect-to=89.46.76.231 disabled=no name=SSTPchipware profile=\
default-encryption user=pranives verify-server-address-from-certificate=\
no
/queue simple
add max-limit=4M/10M name=lan2-wifi target="ether3 - lan2wifi"
/interface bridge port
add bridge=bridge-lan interface="ether2 - lan1"
add bridge=bridge-lan interface="ether4 - lan1"
add bridge=bridge-lan interface="ether5 - lan1"
/interface bridge settings
set use-ip-firewall-for-pppoe=yes
/interface bridge vlan
add bridge=bridge-sfp disabled=yes tagged=*20,sfp-wan vlan-ids=11
/ip address
add address=192.168.14.1/24 interface=bridge-lan network=192.168.14.0
add address=192.168.15.1/24 interface="ether3 - lan2wifi" network=\
192.168.15.0
add address=10.0.71.253 interface=SSTPchipware network=10.0.71.253
/ip dhcp-client
add dhcp-options=hostname,clientid disabled=no interface="ether1 - wan2"
add add-default-route=no dhcp-options=hostname,clientid disabled=no
/ip dhcp-server network
add address=192.168.14.0/24 gateway=192.168.14.1
add address=192.168.15.0/24 gateway=192.168.15.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
/ip firewall address-list
add address=185.230.81.104 list=chipware
add address=chipware.3cx.it list=chipware
add address=89.46.76.231 list=chipware
/ip firewall filter
add action=accept chain=input src-address=89.46.76.231
add action=accept chain=input in-interface="ether1 - wan2" src-address-list=\
chipware
add action=accept chain=input in-interface=all-ppp
add action=drop chain=input in-interface="ether1 - wan2"
add action=accept chain=output out-interface=all-ppp
add action=accept chain=output out-interface=vlanPPPoE
add action=drop chain=input disabled=yes in-interface="ether1 - wan2"
add action=drop chain=input connection-state=invalid disabled=yes \
in-interface="ether1 - wan2"
add action=accept chain=forward out-interface=all-ppp
add action=accept chain=forward out-interface=vlanPPPoE
add action=drop chain=forward connection-state=invalid in-interface=\
"ether1 - wan2"
add action=accept chain=forward connection-state=established,related \
in-interface="ether1 - wan2"
add action=accept chain=forward connection-state=new in-interface=\
"ether1 - wan2"
add action=drop chain=forward disabled=yes in-interface="ether3 - lan2wifi" \
out-interface=bridge-lan
/ip firewall nat
add action=masquerade chain=srcnat out-interface="ether1 - wan2"
# no interface
add action=masquerade chain=srcnat out-interface=*19
add action=masquerade chain=srcnat out-interface=all-ethernet
add action=masquerade chain=srcnat
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set irc disabled=yes
set h323 disabled=yes
set sip disabled=yes
set pptp disabled=yes
set udplite disabled=yes
set dccp disabled=yes
set sctp disabled=yes
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/lcd
set backlight-timeout=never default-screen=stats read-only-mode=yes \
touch-screen=disabled
/system clock
set time-zone-name=Europe/Rome
/system identity
set name=HCGherdeina
/system logging
add topics=pppoe
add topics=interface
add topics=ppp
/system ntp client
set enabled=yes primary-ntp=212.45.144.3 secondary-ntp=37.247.53.178
/tool e-mail
set address=smtp.gmail.com from=<info@chipware.it> port=568 start-tls=yes \
user=mail.chipware@gmail.com

Hi,

the bridge I used for test but it's deactivated. There is a small traffic on the sfp and this is what log shows:

vlanPPPoE: sent PADI to FF:FF:FF:FF:FF:FF
session ID=0x0000
host-uniq=0x7503b300
service name=Bcom

than after a while:
Bcom: CCP close
Bcom: BCP close
Bcom: IPCP close
Bcom: IPV6CP close
Bcom: MPLSCP close
Bcom: terminating... - disconnected
Bcom: LCP lowerdown
Bcom: LCP down event in initial state
Bcom: disconnected
Bcom: initializing ....

and so on...

Hi,

I noted now that there is only TX traffic and no RX traffic on the sfp. The ISP said I have to set sfp to 100Mbit. To have a "link on" on the sfp I had to disable auto negotation and put the sfp to 100Mbit FD manually. On the status tab of the sfp it still shows connection at 1Gbit full duplex. Is that correct or how can I drop down to 100Mbit?

bye
Roland M.

Hi,

the sfp is in state "link on" but it shows 1Gb full duplex speed and that is not correct as the ISP have a switch 10/100Mbit. Autonegotiation does not work but the sfp shows TX Power and RX Power but no Mac Adress (last field). The sfp is this model: Mikrotik S-35LC20D.

Maybe it's not working correctly?

Bye
Roland M.

Hi,

on the ISP's tecnical data sheet it's written that the wavelenght for TX should be 1310nm and for RX 1550nm. The sfp should be type "BIDI" and the connection 100BASE-BX (FE). Maybe this sfp is not working for this purpose? Should I try with the one mentioned by you?

Bye
Roland M.

I'm a bit aware, why those ISP use Fiber connection and give you sync speed on 100Mbps! It's fucking wrong to use SFP to 100Mbps!

Hi,

is there not way to force sfp to work with 100Mbit?

bye
Roland M.

I'm a bit aware, why those ISP use Fiber connection and give you sync speed on 100Mbps! It's fucking wrong to use SFP to 100Mbps!

simple , Provider is www.brenx.it located in Northern of Italy (Southtirol). POP infrastructure is 100 M Sfp Switchs and also they cant use 1000M sfp , they had to replace all switchs in any POP to upgrade to 1G.
Even with 100 M sfp isnt possible to get connection working. Vlan id is 10 to be used, but pppoe not connects....
other Providers here use edgecore switches, but Brennercom stays on 100M ....

Code: Select all

interface vlan add vlan-id=20 interface=sfp1 name=vlan20
interface pppoe-client add interface=vlan20 name=PPPoE_Out user=xxxxx password=yyyyyy use-peer-dns=yes add-default-route=yes

Thank You!
It’s work.

Code: Select all

interface vlan add vlan-id=20 interface=sfp1 name=vlan20
interface pppoe-client add interface=vlan20 name=PPPoE_Out user=xxxxx password=yyyyyy use-peer-dns=yes add-default-route=yes

Thanks! Works for me too.
Don't forget /ip firewall nat add chain=srcnat out-interface=PPPoE_Out action=masquerade
If you are using queues, make sure you have Target set to PPPoE_Out