Community discussions

MikroTik App
 
g4m3r7ag
just joined
Topic Author
Posts: 2
Joined: Thu Oct 27, 2022 5:02 am

CRS317 access port help

Thu Oct 27, 2022 5:04 am

Hello, I have a CRS317 that is being used as a 10Gb switch essentially. It provides connections to some ESXi servers that are running a virtualized pfSense router/firewall. pfSense has a single virtual NIC with three VLANs, 2 (LAN), 3 (WAN), and 4 (Guests). I currently have a Juniper switch configured with an access port on VLAN 3, and have my AT&T modem connected to that port and everything works correctly. I am trying to configure the ether1 port on the CRS317 as an access port on VLAN 3 to connect the AT&T modem directly to it so that traffic does not have to flow from the Mikrotik > Juniper > AT&T modem and just goes directly Mikrotik > AT&T modem. I have configured it as follows, but whenever I unplug the AT&T modem from the Juniper and plug it into ether1 I lose internet connectivity. Currently SFPplus16 is the trunk to the Juniper. There is a static IP from AT&T configured on vmx0.3 of the pfSense VM and the Gateway IP is hosted on the AT&T Modem.

I feel like from all the examples I've seen, this should be working, but it doesn't and I am at a loss as to what is missing. Is RouterOS 7 more user-friendly? How hard is the upgrade? Thank you for any help that can be provided.
[admin@MikroTik] > export 
# oct/25/2022 21:35:44 by RouterOS 6.49.3
# software id = 80U7-LN5J
#
# model = CRS317-1G-16S+
# serial number = XXXXXXXXXXX
/interface bridge
add admin-mac=B8:69:F4:7F:DD:67 auto-mac=no comment=defconf name=bridge priority=0x1000 protocol-mode=mstp vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] comment=wan l2mtu=1592
set [ find default-name=sfp-sfpplus1 ] comment="" l2mtu=1592
set [ find default-name=sfp-sfpplus2 ] l2mtu=1592
set [ find default-name=sfp-sfpplus3 ] l2mtu=1592
set [ find default-name=sfp-sfpplus4 ] l2mtu=1592
set [ find default-name=sfp-sfpplus5 ] advertise="" comment=esxi01-01 l2mtu=10218 mtu=9000
set [ find default-name=sfp-sfpplus6 ] comment=esxi01-02 l2mtu=10218 mtu=9000
set [ find default-name=sfp-sfpplus7 ] comment=esxi01-03-vmotion l2mtu=10218 mtu=9000
set [ find default-name=sfp-sfpplus8 ] comment=esxi01-04-iscsi l2mtu=10218 mtu=9000
set [ find default-name=sfp-sfpplus9 ] comment=esxi02-01 l2mtu=10218 mtu=9000
set [ find default-name=sfp-sfpplus10 ] comment=esxi02-02 l2mtu=10218 mtu=9000
set [ find default-name=sfp-sfpplus11 ] comment=esxi02-03-vmotion l2mtu=10218 mtu=9000
set [ find default-name=sfp-sfpplus12 ] comment=esxi02-04-iscsi l2mtu=10218 mtu=9000
set [ find default-name=sfp-sfpplus13 ] comment=nas01-01 l2mtu=10218 mtu=9000
set [ find default-name=sfp-sfpplus14 ] comment=nas01-02-iscsi l2mtu=10218 mtu=9000
set [ find default-name=sfp-sfpplus15 ] l2mtu=1592
set [ find default-name=sfp-sfpplus16 ] l2mtu=1592
/interface vlan
add comment=vlan2-mgmt interface=bridge name=vlan2 vlan-id=2
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/user group
set full policy=local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,password,web,sniff,sensitive,api,romon,dude,tikapp
/interface bridge port
add bridge=bridge comment=wan interface=ether1 pvid=3
add bridge=bridge comment="" interface=sfp-sfpplus1
add bridge=bridge interface=sfp-sfpplus2
add bridge=bridge interface=sfp-sfpplus3
add bridge=bridge interface=sfp-sfpplus4
add bridge=bridge comment=esxi01-01 interface=sfp-sfpplus5
add bridge=bridge comment=esxi01-02 interface=sfp-sfpplus6
add bridge=bridge comment=esxi01-03-vmotion interface=sfp-sfpplus7
add bridge=bridge comment=esxi01-04-iscsi interface=sfp-sfpplus8
add bridge=bridge comment=esxi02-01 interface=sfp-sfpplus9
add bridge=bridge comment=esxi02-02 interface=sfp-sfpplus10
add bridge=bridge comment=esxi02-03-vmotion interface=sfp-sfpplus11
add bridge=bridge comment=esxi02-04-iscsi interface=sfp-sfpplus12
add bridge=bridge comment=nas01-01 interface=sfp-sfpplus13
add bridge=bridge comment=nas01-02-iscsi interface=sfp-sfpplus14
add bridge=bridge comment=defconf interface=sfp-sfpplus15
add bridge=bridge comment=defconf interface=sfp-sfpplus16
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/interface bridge vlan
add bridge=bridge comment=lan tagged=sfp-sfpplus1,sfp-sfpplus5,bridge,sfp-sfpplus6,sfp-sfpplus9,sfp-sfpplus10,sfp-sfpplus13,sfp-sfpplus16 vlan-ids=2
add bridge=bridge comment=guests tagged=sfp-sfpplus1,sfp-sfpplus5,sfp-sfpplus6,sfp-sfpplus9,sfp-sfpplus10,sfp-sfpplus16 vlan-ids=4
add bridge=bridge comment=wan tagged=sfp-sfpplus5,sfp-sfpplus6,sfp-sfpplus9,sfp-sfpplus10,sfp-sfpplus16 untagged=ether1 vlan-ids=3
add bridge=bridge comment=iscsi tagged=sfp-sfpplus8,sfp-sfpplus12,sfp-sfpplus14 vlan-ids=5
add bridge=bridge comment=smb tagged=sfp-sfpplus5,sfp-sfpplus6,sfp-sfpplus9,sfp-sfpplus10,sfp-sfpplus13 vlan-ids=6
add bridge=bridge comment=vmotion tagged=sfp-sfpplus7,sfp-sfpplus11 vlan-ids=7
/ip address
add address=192.168.1.2/24 interface=vlan2 network=192.168.1.0
/ip dns
set servers=192.168.1.1
/ip route
add distance=1 gateway=192.168.1.1
/ip ssh
set forwarding-enabled=remote
/system clock
set time-zone-name=America/New_York
/system ntp client
set enabled=yes primary-ntp=192.168.1.1
/system routerboard settings
set boot-os=router-os
/system swos
set address-acquisition-mode=static allow-from-ports=p1,p4,p17 identity="MikroTik CRS317-" static-ip-address=192.168.100.109
[admin@MikroTik] >  
 
User avatar
mkx
Forum Guru
Forum Guru
Posts: 11593
Joined: Thu Mar 03, 2016 10:23 pm

Re: CRS317 access port help

Thu Oct 27, 2022 6:54 pm

Some ISP CPEs are sensitive to STP/LLDP ... so you may want to set ether1 port to edge=yes under bridge port settings ....
 
g4m3r7ag
just joined
Topic Author
Posts: 2
Joined: Thu Oct 27, 2022 5:02 am

Re: CRS317 access port help

Sat Nov 05, 2022 8:42 am

Some ISP CPEs are sensitive to STP/LLDP ... so you may want to set ether1 port to edge=yes under bridge port settings ....
I finally got some time to investigate and try this. Looking at the STP stats on the Juniper, it appears that my AT&T modem/gateway was advertising a root bridge priority of 0 and designating itself the root bridge. I was not aware that was even a possibility as I thought 4096 was the lowest possible priority and is what was configured on the CRS317. I set ether1 as an edge port and moved the WAN connection to it and after a few seconds I was able to ping out to the internet, so it was indeed being caused by STP. Thank you for the help.

Who is online

Users browsing this forum: Ahrefs [Bot], samcard1999 and 81 guests