Hi!

I have been setting up my CRS125-24G-1S and hap ac. Everything works very well, cloud router works as router to internet (nat, firewall) and CAPsMAN works fine. Hap ac has 2 SSID's which are connected to different VLANs and there is now problem with these. InterVLAN and internet access works as expected.

Now I would like to configure one port to a same vlan as one of my ssid, but how should I do it? I'm really confused about conflicting guides in internet. Lets say, I want to have VLAN 100 to port 24 in my cloud router. What should I configure for bridge? How about switch-cpu1? There is Ingress and Egress, tagged and untagged - what is the difference?

I have tested many different configurations but all where I have succeed is blocking my self out of router and need for reset it. I'm not requesting any ready made config lines because I would like to understand how dot1q is working in mikrotik and in which layer of ISO OSI-model each component is working. Which part of ports/bridge/switch should have tagged/untagged, should I have filtering or not, should I use RSTP or not? Which port should have ingress and which egress? Uh.. I'm confused

Got now VLAN filtering enabled for bridge without locking myself out of management. So, untagged interfaces seems to be working as expected. I still have problems with tagging. Adding a port to bridge with tagging doesn't work. Also ssid's (cap) with vlan doesn't work.

1. If I want to have a interface on router in a VLAN and want that VLAN to be routed untagged to a ethernet port, should I add that vlan interface tagged or untagged to bridge? Or should I leave it completely out from bridge VLAN list?

2. How should I configure cap interface with vlan tagging? Should it be added tagged/untagged to bridge or should it be left out?

Have you read / tried below:

https://wiki.mikrotik.com/wiki/Manual:VLANs_on_Wireless

Complete with loads of errors...

R2 diagram shows ether2 not ether1 as per the script.
172.168.1.x should be 172.16.1.x

No wonder people get confused when the examples are often wrong.

Wiki has been updated, thank you for pointing out the imperfections!

The setup is not very simplistic, for this reason the configuration is going to be a bit more complex. Since you are using CRS1XX, then you have the option to use the built-in switch chip to offload some portion of traffic, the CAPsMAN related traffic must go through the CPU. Start by checking out this guide:
https://wiki.mikrotik.com/wiki/Manual:CRS_Router

You can base your whole configuration on this guide. After that is done, you can set up CAPsMAN. Most probably you will end up using untagged traffic for CAPsMAN and will use the "vlan-mode" parameter for each CAP interface, this way all traffic traversing through Ethernet ports will be switched (except for traffic going through NAT) and traffic from CAP interfaces will be received as tagged traffic and will be forwarded through appropriate Ethernet interface by using the CPU.

There is no example for hybrid ports (tagged and untagged vlans in single port)?

And according that page, there is no vlan's specificed in example below

In case you are using a CRS1xx/CRS2xx series device:

For me, it looks quite confusing wiki page...

And according that page, there is no vlan's specificed in example below

I'm guessing a little, but I believe as per the table on the following page https://wiki.mikrotik.com/wiki/Manual:S ... p_Features CRS3xx can use bridge VLAN filtering and maintain hardware offload to switch at wire speed. CRS1xx/2xx can't use the bridge VLAN filtering and maintain the wirespeed switching, so it is done in the switch VLAN configuration instead. That is why I think the examples differ.

To use the VLAN on the CRS125 you have and maintain the wirespeed switching you will have to use the VLAN config on the switch chip rather than bridge VLAN filtering. This is detailed slightly further down under the section titled "Port based VLANs"

I think the idea is you have to work through the full page looking at the sections for CRS3xx and CRS1xx/2xx and decide which parts you want to implement as there are different methods for each part of the config for CRS3xx vs CRS1xx/2xx

Updated my router to 6.42.6 (from .4 if I remember correctly) and port based VLAN is working again!

Is it possible to do a hybrid port (1 tagged VLAN and untagged traffic) for a port in my router (CRS125-24G-1S)?

The wiki has been updated to be less confusing when using different CRS series switches:
https://wiki.mikrotik.com/wiki/Manual:CRS_Router

Hybrid ports are possible, use the guide provided above and combine it with this guide:
https://wiki.mikrotik.com/wiki/Manual:C ... d_ports.29