Page 1 of 1

Port Group Isolation

Posted: Mon Aug 12, 2019 4:40 pm
by Link100
If I understood it correctly, I can separate ports under Bridge?

There are two external DHCP/DNS/Gateway servers:
Server 1 has the IP: 192.168.2.1/24
Server 2 has the IP: 192.168.3.1/24

On the MikroTik CRS326-24G now two port groups should be set up:
Group1: ether1 to ether8
Group2: ether9 to ether16

Group1 must not communicate with Group2.
Group2 must not communicate with Group1.

In MikroTik I have set it this way:

Mode: Bridge

1. under Bridge->Ports: two bridges created and this BridgeGroup1 and BridgeGroup2 named
2. then under Bridge->Ports: assign ether1 to ether8 to BridgeGroup1 and assign ether9 to ether16 to BridgeGroup2

3. IP->DHCP-Client Add New and selected under Interface BridgeGroup1
4. IP->DHCP-Client Add New and selected under Interface BridgeGroup2

DHCP Server1 is connected to ether1
DHCP Server2 is connected to ether9

If I now connect a PC with ether2, the PC gets an IP from "DHCP Server1" assigned

And if I connect another PC to ether10 then the PC gets an IP from "DHCP Server2" assigned

Is the configuration correct?

Re: Port Group Isolation  [SOLVED]

Posted: Mon Aug 12, 2019 7:22 pm
by Exiver
Yes your configuration is logically correct. You may need to check whether the Switch allows you to use Hardware Offloading ( https://wiki.mikrotik.com/wiki/Manual:I ... Offloading ) on two different bridges on the same switch chipset. If it does not you may see performance problems on the bridge which is not hardware offloaded. And you should check that devices from both groups are not able to communicate with each other (/ip firewall filter) or you could disable routing functionality.

Re: Port Group Isolation

Posted: Mon Aug 12, 2019 9:28 pm
by Link100
Thank you for your answer.

It is a CRS326-24G router switch.

Re: Port Group Isolation

Posted: Tue Aug 13, 2019 12:00 am
by blingblouw
But why would you not use vlans?

Put ether1-8 in vlan1 and ether9-16 in vlan2?

Re: Port Group Isolation

Posted: Tue Aug 13, 2019 2:16 am
by Link100
That would also be a possibility. But it also works as mentioned above.

Re: Port Group Isolation

Posted: Tue Aug 13, 2019 7:55 am
by cifzo
I'm using a similar approach.. I've got a CRS326 with a single bridge; ports 1-8 are untagged and 9-16 are in a VLAN. All ports on the switch show HW offloaded. I believe you can only HW offload 1 bridge.
https://wiki.mikrotik.com/wiki/Manual:L ... witch_chip