Getting the most out of this forum
What MT routers do you have that do work?
What firmware is loaded on the routers that work? On the RB850Gx2?
What is the "untagged vlan" on the Cisco? is it the default vlan 1?
What interface and vlan is associated with 172.31.234.0/24 (your home lan)? Is that the port connected to the Cisco switch? Were you expecting vlan 30 on ether4 to have access to vlan 30 on the Cisco trunk on ether2?
Providing this information up front reduces frustration for the people trying to help, and therefore makes it much more likely that you will get a timely and correct answer.
If you don't give enough information, you are expecting us to read your mind.
Also what make/model/software is being used by other things related to your problem is helpful too, as well as information about your experience, i.e. if you know how to do this with pfsense, or openWRT, Cisco, Juniper, or edgeos let us know that, and perhaps even post the config that works with that vendor's kit. Many people here have worked with multiple vendors, and a config is a compact way to transfer a lot of details.
The above information is important because if you want the best performance, you want hardware switching to be used by the bridge.
I don't think you should be using multiple bridges, ROS will allow you to shoot yourself in the foot, there are many fewer rules than other vendors impose; that makes it easy to configure non-optimal configurations.
Review the official documentation.
Bridge VLAN Filtering It is technical, but if you have worked with vlans on other equipment, it is understandable. What I don't know is if the new bridge way of configuring things will work well on the RB850Gx2. Hopefully someone that has more ROS experience will let you know.
I found this
RouterOS bridge mysteries explained helpful too.
Also, since I am pretty green in ROS,
other members with more experience will hopefully correct me, if any of the info I assert here is incorrect. I want to learn too.
Read this MUM presention slide set:
Playing with RouterOS's VLANs By Lorenzo Busatti But this is from 2019, and slide 51 states: "currently only CRS3xx series devices are capable of using bridge VLAN filtering and hardware offloading at the same time."
I know that v7.2rc4 supports both vlan filtering and hardware offloading on the RB750gr3 and RB760iGS (hEX) see
Very slow intervlan routing but I don't know about the Atheros8327 chip used in the RB850Gx2. I am new to ROS, and only have 1 RB760iGS in a lab environment. I understand more about the way the ER-X works than the hEX S, but I am learning more and more about the ROS way to do things.
Here's another MUM presentaion from 2019 showing how it could be done with the Atheros8327 switch ASIC
RouterOS bridge/switch configuration changes and possibilities in latest RouterOS versions? by Péter Major
I don't know if this is still required or not to get hardware offloading, and you would want hardware offloading if you have two ports on the RB850Gx2 with the same vlan (the port connected to the Cisco switch and the Unifi Access point).
Also, here is the block diagram of the RB850GX2
Since your router has the ability to have a dedicated CPU connection to ether1, you should leave that out of the bridge, and use is only for your internet connection.
You should be able to do everything you want with a single bridge. bridge ports correspond to the physical ports labeled ether2...ether5). You can configure different bridge ports differently; some as hybrid, some as tagged only trunks, some as access ports. But you will need to enable vlan-filtering, which is the setting that makes the switch vlan-aware.
/interface bridge port is where you describe how you want received ethernet frames to be handled (on the ports connected to the switch block). This will associate each received frame with a single vlan, or reject and drop it. If an untagged frame is received, and not specifically rejected by the setting of frame-types by admit-only-vlan-tagged, then the frame will be classified as belonging in the vlan specified by the Port Vlan ID (PVID), otherwise if the frame has an explicit IEEE 802.1Q tag, then that tag will specify the vlan the received frame will be classified as. (your frame filtering frame-type choices are: admit-all | admit-only-untagged-and-priority-tagged | admit-only-vlan-tagged; Default: admit-all).
/interface bridge vlan ties vlan-ids to interfaces, and specifies whether that vlan-id will be tagged or untagged on egress from the port on the switch block. My understanding of the "bridge interface vlan", when specifying the bridge itself as the member, is how the two ports connected to the "internal trunk" between the routing block and the switch block will be configured. When adding a vlan that you want the routing block to have access to, you need to add the bridge to the interface list, and it should be a tagged "vlan" in almost every case, if you don't know why, assume it will be tagged. Note that if the bridge interface is not included for the vlan-id, there will be no connection between the routing block and the switch block for that vlan. This can be a valid configuration, for example if you want L2 switching to occur between multiple bridge ports, but don't want the router/firewall/dhcp/etc to be connected to that vlan in any way. You don't specify pvid here, that is specified in the /interface bridge port section. But if you specified a pvid in the bridge port section, ROS will treat the vlan on that bridge port as untagged for egress, but you can explicitly specify this in the config to make it more obvious.
The
/interface vlan is the routing engine's "Layer 3 connection" to the vlan on the router's internal trunk port internally connected to another base interface. That's the interface that the ip address, firewall, dhcp server, etc. will be associated with.
