Mikrotik RB2011U vlanning

mikrotiknetworkingvlan

I am having trouble getting port based vlanning/trunking working on a Mikrotik RB2011U.
I have been following the guide located here:
http://wiki.mikrotik.com/wiki/Manual:Switch_Chip_Features#Example_-_802.1Q_Trunking_with_Atheros_switch_chip_in_RouterOS_v6
The features table at the top of the wiki indicates that this device should be capable of 802.1q vlanning.

I have followed the wiki verbatim, except that I have supplied my own interface names and vlan id numbers.
When I plug a host into eth3 and assign it a static IP of 10.10.10.4 I am unable to ping 10.10.10.5 (the RB2011U); however plugging a second host into eth4 and assigning it a static IP of 10.10.10.6, I am able to ping 10.10.10.4 from 10.10.10.6 and vice versa. On the 10.10.10.4 and 10.10.10.6 side I can see that when I try to ping 10.10.10.5 I am getting the an ARP reply from the RB2011U.

The second problem is that my trunk port does not seem to be working properly either. It is wired back to a Mikrotik CRS125 which I have confirmed to be working properly. In this case, pinging the RB2011U(10.10.10.5) from the CRS125(10.10.10.2) and vice virsa also does not work, however ARP does not seem to be being relayed.

In searching for answers, I see a lot of other people using bridges instead of using the switch configuration. And I did manage to get that configuration working minus the trunk port; however I configured my CRS125 to do vlan tagging in the switch config and for consistency's sake I'd prefer to have the RB2011U do the same.

EDIT: (requested configuration information)

/interface ethernet
set [ find default-name=ether1 ] name=eth1
set [ find default-name=ether2 ] name=eth2
set [ find default-name=ether3 ] master-port=eth2 name=eth3
set [ find default-name=ether4 ] master-port=eth2 name=eth4
set [ find default-name=ether5 ] master-port=eth2 name=eth5
set [ find default-name=ether6 ] name=eth6
set [ find default-name=ether7 ] master-port=eth6 name=eth7
set [ find default-name=ether8 ] master-port=eth6 name=eth8
set [ find default-name=ether9 ] master-port=eth6 name=eth9
set [ find default-name=ether10 ] master-port=eth6 name=eth10

/interface ethernet switch port
set 2 vlan-header=add-if-missing vlan-mode=secure
set 3 default-vlan-id=1 vlan-header=always-strip vlan-mode=secure
set 4 default-vlan-id=1 vlan-header=always-strip vlan-mode=secure
set 5 default-vlan-id=0 vlan-header=always-strip vlan-mode=secure
set 11 vlan-mode=secure

/interface ethernet switch vlan
add independent-learning=yes ports=eth2,eth3,eth4,switch1-cpu switch=switch1 vlan-id=1
add independent-learning=yes ports=eth2 switch=switch1 vlan-id=3
add independent-learning=yes ports=eth2 switch=switch1 vlan-id=4
add independent-learning=yes ports=eth2 switch=switch1 vlan-id=5

/interface vlan
add interface=eth2 l2mtu=1594 name=vlan1 vlan-id=1
add interface=eth2 l2mtu=1594 name=vlan3 vlan-id=3
add interface=eth2 l2mtu=1594 name=vlan4 vlan-id=4
add interface=eth2 l2mtu=1594 name=vlan5 vlan-id=5

/ip address
add address=10.10.10.5/24 interface=vlan1 network=10.10.10.0
add address=10.30.10.5/24 interface=vlan3 network=10.30.10.0
add address=10.40.10.5/24 interface=vlan4 network=10.40.10.0
add address=10.50.10.5/24 interface=vlan5 network=10.50.10.0

Best Answer

Ok, I managed to get my hands on a spare RB to try this configuration.

It turns out that I haven't read the documentation carefully. It states that you can only access the router itself (as in management access) only from the trunk port.

http://wiki.mikrotik.com/wiki/Manual:Switch_Chip_Features#Management_IP_Configuration

Management IP Configuration

This example will show one of the possible management IP address configurations. Management IP will be accessible only through trunk port and it will have a separate VLAN with ID 99.

I went ahead and set up a test network and I was able to ping the RB on the trunk port but not on any of the access ports.

Also, I noticed that you have set the trunk port like this:

/interface ethernet switch port
set 2 vlan-header=add-if-missing vlan-mode=secure

This means that number 2 is eth3 and that will be the trunk port and not eth2 since the numbers start from 0.

Here's a sample output from my test RB.

[admin@MikroTik] > /interface ethernet switch port print 
Flags: I - invalid 
 #   NAME             SWITCH             VLAN-MODE VLAN-HEADER    DEFAULT-VLAN-ID
 0   ether1           switch1            disabled  leave-as-is               auto
 1   ether2           switch1            secure    add-if-missing            auto
 2   ether3           switch1            secure    always-strip                 1
 3   ether4           switch1            secure    always-strip                 1
 4   ether5           switch1            secure    always-strip                 1
 5   switch1-cpu      switch1            secure    leave-as-is               auto

As you can see, number 2 is ether3. I don't know if that's related to your second issue not being able to ping the router from CRS.

Related Topic