802.1Q trunking

mrjoli021 · Wed Aug 21, 2013 4:17 am

I have an 1100AH router and I would like to configure it in the following way.
cisco switch -----TRUNK 802.1Q-----> MT on port10

MT has three VLANS
10 Native
Port 10

20 Phones
Ports 1-4,9

30 Workstations
Ports 5-8

I have read on creating a bridge and assigning the native VLAN to the bridge as untagged and all other VLAN's as tagged. That will work, except how do I add the ports to VLAN's you can only assign a vlan to one interface either the bridge or the "etherX", but not to both.

Please help

efaden · Wed Aug 21, 2013 4:57 am

I have an 1100AH router and I would like to configure it in the following way.
cisco switch -----TRUNK 802.1Q-----> MT on port10

MT has three VLANS
10 Native
Port 10

20 Phones
Ports 1-4,9

30 Workstations
Ports 5-8

I have read on creating a bridge and assigning the native VLAN to the bridge as untagged and all other VLAN's as tagged. That will work, except how do I add the ports to VLAN's you can only assign a vlan to one interface either the bridge or the "etherX", but not to both.

Please help

See below. Make sure you don't have any setup as master/slave. You can make it wire speed if you have a switch chip... but that depends on the hardware you are using. Basically the below will put vlan10/20/30 on ether10 as tagged packets, and the ether ports you stated as untagged packets.

ros code

/interface vlan
add name="vlan-native" vlan-id=10 interface=ether10
add name="vlan-phones" vlan-id=20 interface=ether10
add name="vlan-workstations" vlan-id=30 interface=ether10

/interface bridge 
add name="bridge-native"
add name="bridge-phones"
add name="bridge-workstations"

/interface bridge port
add bridge=bridge-native interface=vlan-native

add bridge=bridge-phones interface=vlan-phones
add bridge=bridge-phones interface=ether1
add bridge=bridge-phones interface=ether2
add bridge=bridge-phones interface=ether3
add bridge=bridge-phones interface=ether4
add bridge=bridge-phones interface=ether9

add bridge=bridge-workstations interface=vlan-workstations
add bridge=bridge-workstations interface=ether5
add bridge=bridge-workstations interface=ether6
add bridge=bridge-workstations interface=ether7
add bridge=bridge-workstations interface=ether8

mrjoli021 · Wed Aug 21, 2013 4:39 pm

Thx
that is exactly what I was looking for. Now final question if I want to route between each vlan how will I do that. I would like to make this as a L3 switch?

Rudios · Wed Aug 21, 2013 4:58 pm

Thx
that is exactly what I was looking for. Now final question if I want to route between each vlan how will I do that. I would like to make this as a L3 switch?

Since the RouterBoard is a router, it will do that by default.

efaden · Wed Aug 21, 2013 6:00 pm

Thx
that is exactly what I was looking for. Now final question if I want to route between each vlan how will I do that. I would like to make this as a L3 switch?
Since the RouterBoard is a router, it will do that by default.

Kind of... you need to have an address in each network and make sure you have the appropriate routes...

Rudios · Wed Aug 21, 2013 6:22 pm

That's correct.
And as long as you want to route directly connected networks, routes will be there automatically.
For other networks, you should create routes manually.

mrjoli021 · Thu Aug 22, 2013 3:52 pm

I have added the ip's and routes below. I am not able to ping 10.105.10.197 from ether5, but I am able to ping 10.105.20.197 which is on a different vlan. On the cisco switch same senerio. I am not able to ping 10.105.10.197. The default gateway for my network is 10.105.21.254.
Is icmp blocked on the trunk vlan?

/ip address 
add address=10.105.10.197/24 interface=vlan-native
add address=10.105.20.197/24 interface=vlan-phones
add address=10.105.30.197/24 interface=vlan-workstations

/ip route 
add gateway=10.105.10.254
add dst-address=10.105.20.0/24 gateway=10.105.40.197
add dst-address=10.105.30.0/24 gateway=10.105.30.197

Rudios · Thu Aug 22, 2013 4:33 pm

As I mentioned before, you should configure the IP's on the bridges, not on the VLAN interfaces.

mrjoli021 · Thu Aug 22, 2013 8:15 pm

if i put the native vlan ip on interface ether1 it works and i am able to ping, just on that vlan. Now when I place the same IP on the bridge interface I can ping anything from inside the router except all the sub int inside the router. and from a workstation I cant ping anything.

Rudios · Thu Aug 22, 2013 8:35 pm

I think something is wrong with your routes. You've created routes for a network which is directly connected. That makes no sense to me.

mrjoli021 · Thu Aug 22, 2013 8:54 pm

If I dont put the routes in there I cant even ping each interface from within the router.

efaden · Thu Aug 22, 2013 9:33 pm

Post your export.

Sent from my SCH-I545 using Tapatalk 4

mrjoli021 · Fri Aug 23, 2013 2:33 am

If I plug directly into ether2 I am placed in vlan 40 and get DHCP from the DHCP server in the other switch. I am also able to get to the internet. But I am not able to ping any of the MikroTik's IP from a different switch connected to vlan 40 or 21. Now if I place a different IP directly on ether10 I am able to ping it. Also I can not ping other 21.197 or 30.197 I can only ping 40.197.

this is my entire config. I have reset the router to factory default and uploaded this

/interface vlan
add name=vlan-native vlan-id=21 interface=ether10
add name=vlan-phones vlan-id=40 interface=ether10
add name=vlan-workstations vlan-id=30 interface=ether10
 
/interface bridge
add name=bridge-native
add name=bridge-phones
add name=bridge-workstations
 
/interface bridge port
add bridge=bridge-native interface=vlan-native
 
add bridge=bridge-phones interface=vlan-phones
add bridge=bridge-phones interface=ether1
add bridge=bridge-phones interface=ether2
add bridge=bridge-phones interface=ether3
add bridge=bridge-phones interface=ether4
add bridge=bridge-phones interface=ether9
 
add bridge=bridge-workstations interface=vlan-workstations
add bridge=bridge-workstations interface=ether5
add bridge=bridge-workstations interface=ether6
add bridge=bridge-workstations interface=ether7
add bridge=bridge-workstations interface=ether8

/ip address 
add address=10.105.21.197/24 interface=bridge-native
add address=10.105.20.197/24 interface=bridge-phones
add address=10.105.30.197/24 interface=bridge-workstations

/ip address remove 0

/ip route 
add gateway=10.105.10.254

mrjoli021 · Sat Aug 24, 2013 4:47 am

Does it matter that the native vlan is 21 and not 1. I am seeing alot of errors on the cisco switch with native vlan mismatch. If so how do I force the native vlan and/or how do I disable vlan1.

StubArea51 · Sat Aug 24, 2013 5:38 am

My first question would be - do you need an untagged native VLAN across the trunk?

Cisco switches configured to trunk will detect a mismatch of the Native VLAN. Put the following config into the Cisco switch under the interface to correct the Native VLAN mismatch if 21 is the "native" on the MikroTik side. A MikroTik can take untagged traffic and tag it but it doesn't really have a "Native VLAN" on trunks the way Cisco implements it

switch (config)# vlan dot1q tag native

switch (config-if)# switchport trunk native vlan 21

More info here: http://www.cisco.com/en/US/tech/tk389/t ... l#trubtips

mrjoli021 · Sat Aug 24, 2013 4:48 pm

That is what I have always had. It doesnt show the encap since the cisco switch only supports .1q.

Also, if I place ether10 to ip 10.105.21.197 I am able to ping across. I have ran wireshark and it shows that the request is getting to 10.105.21.200 but something is blocking it on the way back.

Is there some type of ACL or something that needs to turned off to be able to get across?

Cisco config

interface FastEthernet0/12
 switchport mode trunk
 switchport trunk native vlan 21

StubArea51 · Sat Aug 24, 2013 7:33 pm

Have you enabled tagging of the Native VLAN on the Cisco switch? Where are you taking the capture from?

StubArea51 · Sat Aug 24, 2013 11:30 pm

Try this config on the Cisco side - it will tag all the VLANs you need. Also, you don't have any ports tied to the bridge-native. In order to send untagged traffic to the switch on this VLAN, a port on the MikroTik must be tied to that bridge.

vlan 999
 name unused-native
!
interface FastEthernet0/12
 switchport mode trunk
 switchport trunk native vlan 999
 switchport trunk allowed vlan 21,30,40
!
end

I tried the latest config you used and it worked perfectly on Vlan 21,30 and 40 between a Cisco switch and a MikroTik with the above Cisco port config. If it still isn't working, then you have something else causing the issue.

Here is the export compact from the MikroTik I used.

ros code

/interface bridge
add name=bridge-native-cisco
add name=bridge-phones-cisco
add name=bridge-workstations-cisco
/interface ethernet
set 0 name=winbox-172.31.0.10
set 1 name=ether10
/interface vlan
add interface=ether10 name=vlan-workstations-cisco vlan-id=30
add interface=ether10 name=vlan-native-cisco vlan-id=21
add interface=ether10 name=vlan-phones-cisco vlan-id=40
/ip hotspot user profile
set [ find default=yes ] idle-timeout=none keepalive-timeout=2m
/interface bridge port
add bridge=bridge-native-cisco interface=vlan-native-cisco
add bridge=bridge-phones-cisco interface=vlan-phones-cisco
add bridge=bridge-workstations-cisco interface=vlan-workstations-cisco
add bridge=bridge-phones-cisco interface=ether3
add bridge=bridge-phones-cisco interface=ether4
add bridge=bridge-workstations-cisco interface=ether5
add bridge=bridge-workstations-cisco interface=ether6
/ip address
add address=10.105.21.197/24 interface=bridge-native-cisco
add address=10.105.20.197/24 interface=bridge-phones-cisco
add address=10.105.30.197/24 interface=bridge-workstations-cisco
add address=172.31.0.10/24 interface=winbox-172.31.0.10
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 name=router
/ip neighbor discovery
set vlan-workstations-cisco disabled=yes
set vlan-native-cisco disabled=yes
set vlan-phones-cisco disabled=yes

mrjoli021 · Sun Aug 25, 2013 3:23 am

this is what my cisco config looks like. Right now I have this in a lab and nothing else plugged into it except the MT and a monitor port. Port 12 is plugged into the MT with a crossover cable. The cisco switch is a 2950 but I am having the same problem with the production 3750.
I also reset the switch to default and removed the vlan.dat file.

interface FastEthernet0/12
 switchport trunk native vlan 21
 switchport trunk allowed vlan 21,30,40
 switchport mode trunk
!

interface Vlan21
 ip address 10.105.21.200 255.255.255.0
 no ip route-cache
!

The MikroTik export is:

/interface bridge
add l2mtu=1594 name=bridge-native
add l2mtu=1594 name=bridge-phones
add l2mtu=1594 name=bridge-workstations
/interface vlan
add interface=ether10 l2mtu=1594 name=vlan-native vlan-id=21
add interface=ether10 l2mtu=1594 name=vlan-phones vlan-id=40
add interface=ether10 l2mtu=1594 name=vlan-workstations vlan-id=30
/interface bridge port
add bridge=bridge-native interface=vlan-native
add bridge=bridge-phones interface=vlan-phones
add bridge=bridge-phones interface=ether1
add bridge=bridge-phones interface=ether2
add bridge=bridge-phones interface=ether3
add bridge=bridge-phones interface=ether4
add bridge=bridge-phones interface=ether9
add bridge=bridge-workstations interface=vlan-workstations
add bridge=bridge-workstations interface=ether5
add bridge=bridge-workstations interface=ether6
add bridge=bridge-workstations interface=ether7
add bridge=bridge-workstations interface=ether8
/ip address
add address=10.105.21.197/24 interface=bridge-native
add address=10.105.20.197/24 interface=bridge-phones
add address=10.105.30.197/24 interface=bridge-workstations
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 name=router

StubArea51 · Sun Aug 25, 2013 3:35 am

Look at my previous post and change the native VLAN to 999 (or some other VLAN you will never use).

The problem you are having is that VLAN 21 is being sent untagged to the MikroTik and it is expecting it to be tagged.

mrjoli021 · Sun Aug 25, 2013 4:08 am

I am still not able to ping across. my MT export

/interface bridge
add l2mtu=1594 name=bridge-native-cisco
add l2mtu=1594 name=bridge-phones-cisco
add l2mtu=1594 name=bridge-workstations-cisco
/interface ethernet
set 0 name=winbox-172.31.0.10
/interface vlan
add interface=ether10 l2mtu=1594 name=vlan-workstations-cisco vlan-id=30
add interface=ether10 l2mtu=1594 name=vlan-native-cisco vlan-id=21
add interface=ether10 l2mtu=1594 name=vlan-phones-cisco vlan-id=40
/interface bridge port
add bridge=bridge-native-cisco interface=vlan-native-cisco
add bridge=bridge-phones-cisco interface=vlan-phones-cisco
add bridge=bridge-workstations-cisco interface=vlan-workstations-cisco
add bridge=bridge-phones-cisco interface=ether3
add bridge=bridge-phones-cisco interface=ether4
add bridge=bridge-workstations-cisco interface=ether5
add bridge=bridge-workstations-cisco interface=ether6
/ip address
add address=10.105.21.197/24 interface=bridge-native-cisco
add address=10.105.20.197/24 interface=bridge-phones-cisco
add address=10.105.30.197/24 interface=bridge-workstations-cisco
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 name=router

my revised cisco vlan config I have done "sh ip int brief" and vlan 99 shows up/up

interface FastEthernet0/12
 switchport trunk native vlan 99
 switchport trunk allowed vlan 21,30,40
 switchport mode trunk

interface Vlan21
 no ip address
 no ip route-cache
 shutdown
!
interface Vlan99
 ip address 10.105.21.200 255.255.255.0
 no ip route-cache
!

StubArea51 · Sun Aug 25, 2013 4:39 am

Change your Cisco config to this:

vlan 999
 name native-secure-unused
!
interface FastEthernet0/12
 switchport trunk native vlan 999
 switchport trunk allowed vlan 21,30,40
 switchport mode trunk
!
interface Vlan21
 ip address 10.105.21.200 255.255.255.0
 no ip route-cache
!
no interface vlan99

mrjoli021 · Sun Aug 25, 2013 4:50 am

That worked thank a million.

StubArea51 · Sun Aug 25, 2013 7:23 pm

Glad it worked for you....good luck!

Jimmy · Sat Sep 07, 2013 11:29 pm

I rely need help to my CCR, and from my post: http://forum.mikrotik.com/viewtopic.php?f=13&t=75922 to program my CCR to work with cisco trunk, I have no luck to get dhcp on my interfaces

I have dhcp on vlan 1 and vlan 6, and it look like the trunk from spf is working sins I can connect to my CCR, there is one the trunk from my cisco 2960, but non of the port from 1 to 5 and 6 to 11 is getting ip from my dhcp servers?

Can any plz help mw out here, my plan I to run this CCR as my backbone.

My Cisco switch to the CCR is running trunk 802.1Q with allow all

And here is the setup on my CCR

/interface bridge
add name=bridge-trunk

/interface bridge port
add bridge=bridge-trunk interface=sfp1
add bridge=bridge-trunk interface=sfp2
add bridge=bridge-trunk interface=sfp3
add bridge=bridge-trunk interface=sfp4


/interface vlan
add name=vlan1-tr interface=bridge-trunk vlan-id=1
add name=vlan5-tr interface=bridge-trunk vlan-id=5
add name=vlan6-tr interface=bridge-trunk vlan-id=6



/interface bridge
add name=bridge-vlan1
add name=bridge-vlan5
add name=bridge-vlan6


/interface bridge port
add bridge=bridge-vlan1 interface=ether1
add bridge=bridge-vlan1 interface=ether2
add bridge=bridge-vlan1 interface=ether3
add bridge=bridge-vlan1 interface=ether4
add bridge=bridge-vlan1 interface=ether5
add bridge=bridge-vlan1 interface=vlan1-tr


add bridge=bridge-vlan6 interface=ether6
add bridge=bridge-vlan6 interface=ether7
add bridge=bridge-vlan6 interface=ether8
add bridge=bridge-vlan6 interface=ether9
add bridge=bridge-vlan6 interface=ether10
add bridge=bridge-vlan6 interface=ether11
add bridge=bridge-vlan6 interface=vlan6-tr



add bridge=bridge-vlan5 interface=ether12
add bridge=bridge-vlan5 interface=vlan5-tr

Cheers
Jimmy

Rudios · Sun Sep 08, 2013 9:40 pm

Dus you try my other suggested solution o have in the past you linked. So create the vlan interfaces on the ports that supposed to be trunk, and then bridge the vlan interfaces with the desired ports.

Jimmy · Sun Sep 08, 2013 11:22 pm

Hi Rudios
No and sorry for not try that out, my bad, and i will try it out first thing in the morning.
I rely like your option nr 2, it is rely easy to handle and easy to look at for other admins there need to log in to the CCR.
Just to make sure, sins I do not need that many VLAN, is this the right setup:

/interface vlan
add name=vlan1-sfp1 interface=sfp1 vlan-id=1
add name=vlan5-sfp1 interface=sfp1 vlan-id=5
add name=vlan6-sfp1 interface=sfp1 vlan-id=6

add name=vlan1-sfp2 interface=sfp2 vlan-id=1
add name=vlan5-sfp2 interface=sfp2 vlan-id=5
add name=vlan6-sfp2 interface=sfp2 vlan-id=6

add name=vlan1-sfp3 interface=sfp3 vlan-id=1
add name=vlan5-sfp3 interface=sfp3 vlan-id=5
add name=vlan6-sfp3 interface=sfp3 vlan-id=6

add name=vlan1-sfp4 interface=sfp4 vlan-id=1
add name=vlan5-sfp4 interface=sfp4 vlan-id=5
add name=vlan6-sfp4 interface=sfp4 vlan-id=6


/interface brige
add name=bridge-vlan1
add name=bridge-vlan5
add name=bridge-vlan6



/interface bridge port
add bridge=bridge-vlan1 interface=vlan1-sfp1
add bridge=bridge-vlan1 interface=vlan1-sfp2
add bridge=bridge-vlan1 interface=vlan1-sfp3
add bridge=bridge-vlan1 interface=vlan1-sfp4
add bridge=bridge-vlan1 interface=ether1
add bridge=bridge-vlan1 interface=ether2
add bridge=bridge-vlan1 interface=ether3
add bridge=bridge-vlan1 interface=ether4
add bridge=bridge-vlan1 interface=ether5

add bridge=bridge-vlan5 interface=vlan5-sfp1
add bridge=bridge-vlan5 interface=vlan5-sfp2
add bridge=bridge-vlan5 interface=vlan5-sfp3
add bridge=bridge-vlan5 interface=vlan5-sfp4
add bridge=bridge-vlan5 interface=ether12

add bridge=bridge-vlan6 interface=vlan6-sfp1
add bridge=bridge-vlan6 interface=vlan6-sfp2
add bridge=bridge-vlan6 interface=vlan6-sfp3
add bridge=bridge-vlan6 interface=vlan6-sfp4
add bridge=bridge-vlan6 interface=ether6
add bridge=bridge-vlan6 interface=ether7
add bridge=bridge-vlan6 interface=ether8
add bridge=bridge-vlan6 interface=ether9
add bridge=bridge-vlan6 interface=ether10
add bridge=bridge-vlan6 interface=ether11

Again I am new to this, but I rely like the product, so please bear with me

Cheers
Jimmy

Jimmy · Mon Sep 09, 2013 1:30 am

Hmm still not working


To start with this setup I do not get any dhcp?
Then I setup trunk on cisco to allow VLAN 1,5,6,999 and set 999 to native VLAN then I get dhcp on brigde-vlan1 but still no dhcp on vlan6?
PLZ I am open for all now, cuss I really need to get this CCR up and running.
Cheers
Jimmy

Jimmy · Thu Sep 12, 2013 11:47 pm

Just to close this one, i put VLAN 999 as native vlan but forgot to put the vlan in the trunk, all are working and running perfect with mikrotik and Cisco.

THX for good support.

Cheers
Jimmy

802.1Q trunking

802.1Q trunking

Re: 802.1Q trunking

ros code

Re: 802.1Q trunking

Re: 802.1Q trunking

Re: 802.1Q trunking

Re: 802.1Q trunking

Re: 802.1Q trunking

Re: 802.1Q trunking

Re: 802.1Q trunking

Re: 802.1Q trunking

Re: 802.1Q trunking

Re: 802.1Q trunking

Re: 802.1Q trunking

Re: 802.1Q trunking

Re: 802.1Q trunking

Re: 802.1Q trunking

Re: 802.1Q trunking

Re: 802.1Q trunking

ros code

Re: 802.1Q trunking

Re: 802.1Q trunking

Re: 802.1Q trunking

Re: 802.1Q trunking

Re: 802.1Q trunking

Re: 802.1Q trunking

Re: 802.1Q trunking

Re: 802.1Q trunking

Re: 802.1Q trunking

Re: 802.1Q trunking

Re: 802.1Q trunking

Who is online