You can also create management VLAN, but that means you'll have VLANs on your main router as well, you might configure one of CRS ports as access port to that VLAN and/or you'll allow routing between VLANs, optionally blocking access to management VLAN from most LAN devices. In this case, router/firewall may allow some (limited) access from CRS to internet and problems, mentioned in previous bullet, will not happen.

can it be the bridge port ? Or should I take one from the switch?

I'm not sure what kind of scenario you have in your mind. But anyway, if you're thinking about management VLAN, then configuring switch to use that VLAN for management is separate isssue from configuring all LAN gear for you to be able to acces it.

A word of caution: when reconfiguring management access it's easy to lock self out. So one really should enable safe mode before changing dangerous settings and disable it after settings are done and management connection remains alive. If management conection breaks (either due to configuration errors or due to administrator terminating it), changes since start of safe mode will be reverted. Manually disabling safe mode makes changes permanent. Safe mode is available in all UIs, in GUIs there's a button for enabling/disabling it, in CLI pressing ctrl-X toggles it.

Let's assume all switch ports are members of same bridge and that ether1 is trunk port towards router. And let's say that you'll use VLAN 99 as management VLAN. To make CRS manageable through it, it needs IP address in that VLAN and you configure it thus:

Code: Select all

/interface vlan
# create VLAN interface, which will receive IP settings
add interface=bridge name=MGMT vlan-ids=99
/interface bridge vlan
# setup tagged VLANs on bridge ports. bridge interface has to be tagged member as well due to vlan interface above
add bridge=bridge tagged=bridge,ether1 vlan-ids=99
/ip address
# set up IP address for management. I'm all for static addresses for management
add interface=MGMT address=192.168.99.2/24
/interface bridge
# make bridge VLAN-aware
set [ find name=bridge ] vlan-filtering=yes

At this point CRS can be managed through configured IP address and if router knows about VLAN 99 and IP subnet 192.168.99.0/24, then you can connect to CRS' address from normal LAN (depending on router configuration).

At this point you don't have ethernet port for connecting management PC, connections have to pass router. As next step you can take one of CRS ports out of normal LAN and dedicate it for management access. You leave it on bridge, just make it access port for management VLAN:

Code: Select all

/interface bridge port
set [ find interface=ether24 ] pvid=99 frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=yes
# no need to explicitly set ether24 as untagged member of VLAN 99, pvid setting does it already

Actual order of performing the two steps doesn't matter.
When both steps are done, you can manage CRS without router being set up for management VLAN, simply by connecting management PC to dedicated management ether port (and setting appropriate IP address).

There are additional steps needed to "burn the bridges" ... to make sure other ways of management access are disabled. One step is to make sure CRS doesn't have any other IP address set.
Another step is to make sure that MAC connections are only allowed through VLAN 99 (MGMT interface). I'm not sure if CRS line has any related config by default, but end state should be something like this:

Code: Select all

/interface list
add name=MGMT
/interface list member
add list=MGMT interface=MGMT
#optionally add ether24 but shouldn't be necessary
#add list=MGMT interface=ether24
/tool mac-server
set allowed-interface-list=MGMT
/tool mac-server mac-winbox
set allowed-interface-list=MGMT

Before executing the above make sure you can connect to CRS via it's management IP address.