VLAN not working with new 6.41

holo · Mon Feb 19, 2018 12:17 am

I can not "ping"/connect my vlan IP what is strange DHCP is workign and assigning IP to clients, but clients can't connect to my CRS125. Here is my simple config:

[admin@MikroTik] /ip route> /export 
# feb/18/2018 21:36:40 by RouterOS 6.41.2
# software id = NPD6-SUAU
#
# model = CRS125-24G-1S
# serial number = 738006D3BDD1
/interface bridge
add name=bridge-IPTV
add name=switch-br0 protocol-mode=none
/interface ethernet
set [ find default-name=ether1 ] name=ether1-WAN
set [ find default-name=ether13 ] name=ether13-TV
/interface vlan
add interface=switch-br0 name=vlan10-internal vlan-id=10
add interface=ether1-WAN name=vlan103 vlan-id=103
/interface ethernet switch
set drop-if-invalid-or-src-port-not-member-of-vlan-on-ports="ether2,ether3,ether4,ether5,ether6,ether7,ether8,ether9,ether10,\
    ether11,ether12,ether14,ether15,ether16,ether17,ether18,ether19,ether20,ether21,ether22,ether23,ether24,sfp1"
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp_pool0 ranges=192.168.10.10-192.168.10.254
/ip dhcp-server
add address-pool=dhcp_pool0 disabled=no interface=vlan10-internal name=dhcp-vlan10
/interface pppoe-client
add disabled=no interface=ether1-WAN name=pppoe-interbeskidy password=paassswwoord profile=default-encryption use-peer-dns=yes \
    user=user1
/interface bridge port
add bridge=bridge-IPTV interface=ether13-TV
add bridge=bridge-IPTV interface=vlan103
add bridge=switch-br0 interface=ether2
add bridge=switch-br0 interface=ether3
add bridge=switch-br0 interface=ether4
add bridge=switch-br0 interface=ether5
add bridge=switch-br0 interface=ether6
add bridge=switch-br0 interface=ether7
add bridge=switch-br0 interface=ether8
add bridge=switch-br0 interface=ether9
add bridge=switch-br0 interface=ether10
add bridge=switch-br0 interface=ether11
add bridge=switch-br0 interface=ether12
add bridge=switch-br0 interface=ether14
add bridge=switch-br0 interface=ether15
add bridge=switch-br0 interface=ether16
add bridge=switch-br0 interface=ether17
add bridge=switch-br0 interface=ether18
add bridge=switch-br0 interface=ether19
add bridge=switch-br0 interface=ether20
add bridge=switch-br0 interface=ether21
add bridge=switch-br0 interface=ether22
add bridge=switch-br0 interface=ether23
add bridge=switch-br0 interface=ether24
add bridge=switch-br0 interface=sfp1
/interface bridge vlan
add bridge=switch-br0 untagged=ether10 vlan-ids=10
/interface ethernet switch egress-vlan-tag
add tagged-ports=sfp1,switch1-cpu vlan-id=10
/interface ethernet switch ingress-vlan-translation
add customer-vid=0 new-customer-vid=10 ports="ether2,ether3,ether4,ether5,ether6,ether7,ether8,ether9,ether10,ether11,ether12\
    ,ether14,ether15,ether16,ether17,ether18,ether19,ether20,ether21,ether22,ether23,ether24,sfp1"
/interface ethernet switch vlan
add ports="ether2,ether3,ether4,ether5,ether6,ether7,ether8,ether9,ether10,ether11,ether12,ether14,ether15,ether16,ether17,et\
    her18,ether19,ether20,ether21,ether22,ether23,ether24,sfp1,switch1-cpu" vlan-id=10
/ip address
add address=192.168.10.1/24 interface=vlan10-internal network=192.168.10.0
/ip dhcp-server network
add address=192.168.10.0/24 gateway=192.168.10.1
/ip dns
set allow-remote-requests=yes
/ip firewall nat
add action=masquerade chain=srcnat out-interface=pppoe-interbeskidy
/ip route
add distance=1 gateway=pppoe-interbeskidy pref-src=xxx.xxx.xxx.xxx
/ip service
set telnet disabled=yes
set ssh address=0.0.0.0/0 port=2222
/system clock
set time-zone-name=Europe/Warsaw

Did i miss something?

EDIT:
After upgrade to 6.42rc version even IP is not assigning. Are VLAN/Switch functionalities broken in newest 6.41 and 6.42rc when they ware moved from master ports to bridge? Do anyone experiencing similar problems?

sindy · Mon Feb 19, 2018 11:07 am

Did i miss something?

It's not clearly stated anywhere but you have to be very careful what you do in the switch menus with the 6.41 and above configuration because part of it is done in the bridge menus so the settings done these two ways conflict

So I would recommend you to remove (or just disable if it is possible)

/interface ethernet switch egress-vlan-tag
add tagged-ports=sfp1,switch1-cpu vlan-id=10

/interface ethernet switch ingress-vlan-translation
add customer-vid=0 new-customer-vid=10 ports="ether2,ether3,ether4,ether5,ether6,ether7,ether8,ether9,ether10,ether11,ether12\
    ,ether14,ether15,ether16,ether17,ether18,ether19,ether20,ether21,ether22,ether23,ether24,sfp1"

/interface ethernet switch vlan
add ports="ether2,ether3,ether4,ether5,ether6,ether7,ether8,ether9,ether10,ether11,ether12,ether14,ether15,ether16,ether17,et\
    her18,ether19,ether20,ether21,ether22,ether23,ether24,sfp1,switch1-cpu" vlan-id=10

and instead add "pvid=10" to all "add bridge=switch-br0 interface=xxx" commands.

Also,

/interface bridge vlan
add bridge=switch-br0 untagged=ether10 vlan-ids=10

is only necessary if you want to activate vlan-filtering at bridge level which (currently?) disables HW acceleration of the bridge, so you can remove this line. But if you use it, it must look as follows:

/interface bridge vlan
add bridge=switch-br0 tagged="switch-br0,sfp1" untagged="ether2,ether3,ether4,ether5,ether6,ether7,ether8,ether9,\
    ether10,ether11,ether12,ether14,ether15,ether16,ether17,ether18,ether19,ether20,ether21,ether22,ether23,\
    ether24" vlan-ids=10

Especially the inclusion of the switch as its own tagged member port is not obvious but is mandatory to let the VLAN pass between the switch chip and the CPU.

holo · Tue Feb 20, 2018 12:23 am

Hello

/interface bridge vlan
add bridge=switch-br0 untagged=ether10 vlan-ids=10

It left from tests i was testing at beginning without it and did not work too.

I didnt want to use

/inteface bridge vlan

feature as it is disabling HW support. I tried version 6.42rc and after it did not helped i came back to 6.41 and reconfigured it again.

But:
I do not know if there is same problem as on previous configuration with master-ports that there need to be only one "group" in other way VLAN features are limited. Here when we move to new "bridged" version of switch i removed all bridges and start from beginning and it start working first without my IPTV bridge. After everything was worked i added IPTV switch but with turned off (hw=no) support on ether13 port and it is still working.

PS

I tested if everything will crash when i will set on that ether13-TV port hw=yes switch and nothing happened. So maybe my previous system flash was buggy?

sindy · Tue Feb 20, 2018 12:37 am

Hello
Code: Select all
/interface bridge vlan
add bridge=switch-br0 untagged=ether10 vlan-ids=10
It left from tests i was testing at beginning without it and did not work too.

I didnt want to use
/inteface bridge vlan
feature as it is disabling HW support. I tried version 6.42rc and after it did not helped i came back to 6.41 and reconfigured it again.

But:
I do not know if there is same problem as on previous configuration with master-ports that there need to be only one "group" in other way VLAN features are limited. Here when we move to new "bridged" version of switch i removed all bridges and start from beginning and it start working first without my IPTV bridge. After everything was worked i added IPTV switch but with turned off (hw=no) support on ether13 port and it is still working.

PS

I tested if everything will crash when i will set on that ether13-TV port hw=yes switch and nothing happened. So maybe my previous system flash was buggy?

It seems that the fact that only one bridge can have HW support seems to be how the switch chip works regardless how the configuration is done (the old way or the new way). And HW acceleration makes no sense for bridges with only one physical ethernet as a member.

So in the new configuration, it is best to have a single common bridge for all VLANs which span more than a single Ethernet port.

If you set hw=yes for a bridge for which it cannot be activated it normally breaks nothing, it just does not happen.

WzL · Fri Feb 08, 2019 2:52 pm

Did i miss something?
It's not clearly stated anywhere but you have to be very careful what you do in the switch menus with the 6.41 and above configuration because part of it is done in the bridge menus so the settings done these two ways conflict

So I would recommend you to remove (or just disable if it is possible)
Code: Select all
/interface ethernet switch egress-vlan-tag
add tagged-ports=sfp1,switch1-cpu vlan-id=10

/interface ethernet switch ingress-vlan-translation
add customer-vid=0 new-customer-vid=10 ports="ether2,ether3,ether4,ether5,ether6,ether7,ether8,ether9,ether10,ether11,ether12\
    ,ether14,ether15,ether16,ether17,ether18,ether19,ether20,ether21,ether22,ether23,ether24,sfp1"

/interface ethernet switch vlan
add ports="ether2,ether3,ether4,ether5,ether6,ether7,ether8,ether9,ether10,ether11,ether12,ether14,ether15,ether16,ether17,et\
    her18,ether19,ether20,ether21,ether22,ether23,ether24,sfp1,switch1-cpu" vlan-id=10
and instead add "pvid=10" to all "add bridge=switch-br0 interface=xxx" commands.

Also,
Code: Select all
/interface bridge vlan
add bridge=switch-br0 untagged=ether10 vlan-ids=10
is only necessary if you want to activate vlan-filtering at bridge level which (currently?) disables HW acceleration of the bridge, so you can remove this line. But if you use it, it must look as follows:
Code: Select all
/interface bridge vlan
add bridge=switch-br0 tagged="switch-br0,sfp1" untagged="ether2,ether3,ether4,ether5,ether6,ether7,ether8,ether9,\
    ether10,ether11,ether12,ether14,ether15,ether16,ether17,ether18,ether19,ether20,ether21,ether22,ether23,\
    ether24" vlan-ids=10
Especially the inclusion of the switch as its own tagged member port is not obvious but is mandatory to let the VLAN pass between the switch chip and the CPU.

Is this advice still valid? I mean, to remove the vlan tagging done by the switch CPU on a CRS125 and add vlan tagging using the Bridge?! I ask this because the MT wiki says specifically otherwise?!

pcunite · Fri Feb 08, 2019 3:22 pm

Is this advice still valid? I mean, to remove the vlan tagging done by the switch CPU on a CRS125 and add vlan tagging using the Bridge?! I ask this because the MT wiki says specifically otherwise?!

I believe the hope is that we get a unified and coherent way of doing this going forward. If you're up for it, yes, follow the switch menu, which is even necessary at times because as yet, somethings don't happen automatically for you with the current API.

sid5632 · Fri Feb 08, 2019 4:10 pm

Is this advice still valid? I mean, to remove the vlan tagging done by the switch CPU on a CRS125 and add vlan tagging using the Bridge?!
I ask this because the MT wiki says specifically otherwise?!

Follow MikroTik's advice and do NOT do Vlan filtering on the Bridge unless you have a CRS-3xx. Do it on the Switch as you always did.
If you don't, switching performance will be terrible, as everything goes through the low spec. CPU.

WzL · Fri Feb 08, 2019 4:44 pm

Is this advice still valid? I mean, to remove the vlan tagging done by the switch CPU on a CRS125 and add vlan tagging using the Bridge?!
I ask this because the MT wiki says specifically otherwise?!
Follow MikroTik's advice and do NOT do Vlan filtering on the Bridge unless you have a CRS-3xx. Do it on the Switch as you always did.
If you don't, switching performance will be terrible, as everything goes through the low spec. CPU.

Thank you for your response, this makes sense and i will proceed accordingly.

VLAN not working with new 6.41 [SOLVED]

VLAN not working with new 6.41

Re: VLAN not working with new 6.41

Re: VLAN not working with new 6.41

Re: VLAN not working with new 6.41 [SOLVED]

Re: VLAN not working with new 6.41

Re: VLAN not working with new 6.41

Re: VLAN not working with new 6.41

Re: VLAN not working with new 6.41