Manual:CRSexamples

FromMikroTikWiki

Contents
1Summary
2ManagementIPConfiguration
3VLAN
3.1PortBasedVLAN
3.2ProtocolBasedVLAN
3.3MACBasedVLAN
3.4InterVLANRouting
3.5Unknown/InvalidVLANfiltering
3.6VLANTunneling(QinQ)
4Mirroring
4.1PortBasedMirroring
4.2VLANBasedMirroring
4.3MACBasedMirroring
5Trunking
6Isolation
6.1PortLevelIsolation
6.2ProtocolLevelIsolation
7BandwidthLimiting
8TrafficStormControl

Applies
to
RouterOS:v6.12+

Summary
BasicusecasesandconfigurationexamplesforCloudRouterSwitchfeatures.

ManagementIPConfiguration
Untagged(VLAN0)ManagementIPaddresshastobeassignedtothemasterport.
/interfaceethernet
setether3masterport=ether2
setether4masterport=ether2
setether5masterport=ether2
/ipaddress
addaddress=192.168.88.1/24interface=ether2network=192.168.88.0

FortaggedVLANManagementIPaddressaddVLAN99interfaceandassignIPaddresstoit.Sincethemasterportreceivesall
thetrafficcomingfromswitchcpuport,VLANinterfacehastobeconfiguredonthemasterport,inthiscase"ether2"port.Now
fromswitchchippointtherealsohastobeVLAN99taggingonswitch1cpuport.
/interfacevlan
addname=vlan99vlanid=99interface=ether2
/ipaddress
addaddress=192.168.88.1/24interface=vlan99network=192.168.88.0

/interfaceethernetswitchegressvlantag
addtaggedports=switch1cpuvlanid=99

VLAN
Note:ItisrecommendedtogetSerialConsolecableandtestitbeforeconfiguringVLANsbecauseyoumayloseaccesstotheCPU
and/ortheportyouareconnectedto.

Note:SomechangesmaytakesometimetotakeeffectduetoalreadylearnedMACaddreses.InsuchcasesflushingUnicastForwarding
Databasecanhelp:/interfaceethernetswitchunicastfdbflush

Note:Multiplemasterportconfigurationisdesignedasfastandsimpleportisolationsolution,butitlimitspartofVLANfunctionality
supportedbyCRSswitchchip.ForadvancedconfigurationsuseonemasterportwithinCRSswitchchipforallports,configureVLANs
andisolateportgroupswithportisolationprofileconfiguration.

PortBasedVLAN
Example1

PortBasedVLAN1

Chooseamasterportandenslavetheportsyouneedtobeinthesameswitchgroup.
/interfaceethernet
setether6masterport=ether2
setether7masterport=ether2
setether8masterport=ether2

AddinitialVLANassignments(PVID)toVLANaccessports.
/interfaceethernetswitchingressvlantranslation
addports=ether6customervid=0newcustomervid=200salearning=yes
addports=ether7customervid=0newcustomervid=300salearning=yes
addports=ether8customervid=0newcustomervid=400salearning=yes

AddVLAN200,VLAN300andVLAN400taggingonether2porttocreateitasVLANtrunkport.
/interfaceethernetswitchegressvlantag
addtaggedports=ether2vlanid=200
addtaggedports=ether2vlanid=300
addtaggedports=ether2vlanid=400

VLANmembershipdefinitionsintheVLANtablearerequiredforproperisolation.AddingentrieswithVLANidandportsmakes
thatVLANtrafficvalidonthoseports.
/interfaceethernetswitchvlan
addports=ether2,ether6vlanid=200learn=yes
addports=ether2,ether7vlanid=300learn=yes
addports=ether2,ether8vlanid=400learn=yes

AftervalidVLANconfigurationunknown/invalidVLANforwardingcanbedisabledinglobalswitchsettings.
/interfaceethernetswitch
setdropifinvalidorsrcportnotmemberofvlanonports=ether2,ether6,ether7,ether8

Example2

PortBasedVLAN2

Createagroupofswitchedports.
/interfaceethernet
setether6masterport=ether2
setether7masterport=ether2
setether8masterport=ether2

AddinitialVLANassignments(PVID)foruntaggedtrafficonether6,ether7,ether8ports.
/interfaceethernetswitchingressvlantranslation
addports=ether6customervid=0newcustomervid=200salearning=yes
addports=ether7customervid=0newcustomervid=300salearning=yes
addports=ether8customervid=0newcustomervid=400salearning=yes

AddVLAN200,VLAN300andVLAN400taggingonportsaccordingtodiagram.Thetaggedportsoptionallowmultiple
valuestosupporttaggingonmanyports.
/interfaceethernetswitchegressvlantag
addtaggedports=ether2,ether7,ether8vlanid=200
addtaggedports=ether2,ether6,ether8vlanid=300
addtaggedports=ether2,ether6,ether7vlanid=400

VLANmembershipdefinitionsintheVLANtablearerequiredforproperisolation.AddingentrieswithVLANidandportsmakes
thatVLANtrafficvalidonthoseports.
/interfaceethernetswitchvlan
addports=ether2,ether6,ether7,ether8vlanid=200learn=yes
addports=ether2,ether6,ether7,ether8vlanid=300learn=yes
addports=ether2,ether6,ether7,ether8vlanid=400learn=yes

UnknownVLANsshouldbedisabledaftervalidVLANmembershipconfiguration.
/interfaceethernetswitch
setdropifinvalidorsrcportnotmemberofvlanonports=ether2,ether6,ether7,ether8

ProtocolBasedVLAN

ProtocolBasedVLAN

Createagroupofswitchedports.
/interfaceethernet
setether6masterport=ether2
setether7masterport=ether2

setether8masterport=ether2

SetVLANforIPandARPprotocols
/interfaceethernetswitchprotocolbasedvlan
addport=ether2protocol=arpsetcustomervidfor=allnewcustomervid=0
addport=ether6protocol=arpsetcustomervidfor=allnewcustomervid=200
addport=ether2protocol=ipsetcustomervidfor=allnewcustomervid=0
addport=ether6protocol=ipsetcustomervidfor=allnewcustomervid=200

SetVLANforIPXprotocol
/interfaceethernetswitchprotocolbasedvlan
addport=ether2protocol=ipxsetcustomervidfor=allnewcustomervid=0
addport=ether7protocol=ipxsetcustomervidfor=allnewcustomervid=300

SetVLANforAppleTalkAARPandAppleTalkDDPprotocols
/interfaceethernetswitchprotocolbasedvlan
addport=ether2protocol=0x80F3setcustomervidfor=allnewcustomervid=0
addport=ether8protocol=0x80F3setcustomervidfor=allnewcustomervid=400
addport=ether2protocol=0x809Bsetcustomervidfor=allnewcustomervid=0
addport=ether8protocol=0x809Bsetcustomervidfor=allnewcustomervid=400

MACBasedVLAN

MACBasedVLAN

Createagroupofswitchedports.
/interfaceethernet
setether7masterport=ether2

EnableMACbasedVLANtranslationonaccessport.
/interfaceethernetswitchport
setether7allowfdbbasedvlantranslate=yes

AddMACtoVLANmappingentriesinMACbasedVLANtable.
/interfaceethernetswitchmacbasedvlan
addsrcmac=A4:12:6D:77:94:43newcustomervid=200
addsrcmac=84:37:62:DF:04:20newcustomervid=300
addsrcmac=E7:16:34:A1:CD:18newcustomervid=400

AddVLAN200,VLAN300andVLAN400taggingonether2porttocreateitasVLANtrunkport.
/interfaceethernetswitchegressvlantag
addtaggedports=ether2vlanid=200

addtaggedports=ether2vlanid=300
addtaggedports=ether2vlanid=400

InterVLANRouting

InterVLANRouting

InterVLANroutingconfigurationconsistsoftwomainpartsVLANtagginginswitchchipandroutinginRouterOS.Thisconfiguration
canbeusedinmanyapplicationsbycombiningitwithDHCPserver,Hotspot,PPPandotherfeaturesforeachVLAN.Additionallythis
examplecoversblockingofunwantedotherVLANtrafficonports.
Createagroupofswitchedports.
/interfaceethernet
setether6masterport=ether2
setether7masterport=ether2
setether8masterport=ether2

SetVLANtaggingonCPUportforallVLANstomakepacketstaggedbeforetheyareroutedandaddingressVLANtranslation
rulestoensurecorrectVLANidassignmentisdoneonaccessports.
/interfaceethernetswitchegressvlantag
addtaggedports=switch1cpuvlanid=200
addtaggedports=switch1cpuvlanid=300
addtaggedports=switch1cpuvlanid=400
/interfaceethernetswitchingressvlantranslation
addports=ether6customervid=0newcustomervid=200salearning=yes
addports=ether7customervid=0newcustomervid=300salearning=yes
addports=ether8customervid=0newcustomervid=400salearning=yes

ForroutingaddVLANinterfacesonmasterportbecauseitconnectswithCPUportandaddIPaddressestocreatedVLAN
interfaces.Inthisexamplethree192.168.x.1addressesareaddedtovlan200,vlan300andvlan400interfaces.
/interfacevlan
addname=vlan200interface=ether2vlanid=200
addname=vlan300interface=ether2vlanid=300
addname=vlan400interface=ether2vlanid=400
/ipaddress
addaddress=192.168.20.1/24interface=vlan200network=192.168.20.0
addaddress=192.168.30.1/24interface=vlan300network=192.168.30.0
addaddress=192.168.40.1/24interface=vlan400network=192.168.40.0

Unknown/InvalidVLANfiltering
VLANmembershipisdefinedintheVLANtable.AddingentrieswithVLANidandportsmakesthatVLANtrafficvalidonthoseports.
AftervalidVLANconfigurationunknown/invalidVLANforwardingcanbedisabledinglobalswitchsettings.ThisVLANfiltering
configurationexampleappliestoInterVLANRoutingsetup.

/interfaceethernetswitchvlan
addports=switch1cpu,ether6vlanid=200learn=yes
addports=switch1cpu,ether7vlanid=300learn=yes
addports=switch1cpu,ether8vlanid=400learn=yes

Option1:disableinvalidVLANforwardingonspecificports:
/interfaceethernetswitch
setdropifinvalidorsrcportnotmemberofvlanonports=ether2,ether6,ether7,ether8

Option2:disableinvalidVLANforwardingonallports:
/interfaceethernetswitch
setforwardunknownvlan=no

VLANTunneling(QinQ)
ThisexamplecoverstypicalVLANtunnelingusecasewhereserviceproviderdevicesaddanotherVLANtagforindependent
forwardinginthemeantimeallowingcustomerstousetheirownVLANs.
Note:ThisexamplecontainsonlyServiceVLANtaggingpart.
ItisrecommendedtoadditionallysetUnknown/InvalidVLANfilteringconfigurationonports.

thumb

CRS1:ThefirstswitchontheedgeofserviceprovidernetworkhastoproperlyindentifytrafficfromcustomerVLANidonportand
assignnewserviceVLANidwithingressVLANtranslationrules.
VLANtrunkportconfigurationforserviceproviderVLANtagsisinthesameegressvlantagtable.
ThemaindifferencefrombasicPortBasedVLANconfigurationisthatCRSswitchchiphastobesettodoforwardingaccordingto
service(outer)VLANidinsteadofcustomer(inner)VLANid.
/interfaceethernet
set[finddefaultname=ether2]masterport=ether1
set[finddefaultname=ether9]masterport=ether1
/interfaceethernetswitchingressvlantranslation
addcustomervid=200newservicevid=400ports=ether1salearning=yes
addcustomervid=300newservicevid=500ports=ether2salearning=yes
/interfaceethernetswitchegressvlantag
addtaggedports=ether9vlanid=400
addtaggedports=ether9vlanid=500
/interfaceethernetswitch
setbridgetype=servicevidusedaslookupvid

CRS2:Thesecondswitchintheserviceprovidernetworkrequireonlyswitchedportsusingmasterportandbridgetypeconfiguredto
doforwardingaccordingtoservice(outer)VLANidinsteadofcustomer(inner)VLANid.
/interfaceethernet
set[finddefaultname=ether10]masterport=ether9
/interfaceethernetswitch
setbridgetype=servicevidusedaslookupvid

CRS3:ThethirdswitchhassimilarconfigurationtoCRS1:
Portsinaswitchgroupusingmasterport
IngressVLANtranslationrulestodefinenewserviceVLANassingmentsonports
taggedportsforserviceproviderVLANtrunks
CRSswitchchipsettouseserviceVLANidinswitchinglookup.
/interfaceethernet
set[finddefaultname=ether4]masterport=ether3
set[finddefaultname=ether10]masterport=ether3
/interfaceethernetswitchingressvlantranslation
addcustomervid=200newservicevid=400ports=ether3salearning=yes
addcustomervid=300newservicevid=500ports=ether4salearning=yes
/interfaceethernetswitchegressvlantag
addtaggedports=ether10vlanid=400
addtaggedports=ether10vlanid=500
/interfaceethernetswitch
setbridgetype=servicevidusedaslookupvid

Mirroring

Mirroring

TheCloudRouterSwitchessupportthreetypesofmirroring.Portbasedmirroringcanbeappliedtoanyofswitchchipports,VLAN
basedmirroringworksforallspecifiedVLANsregardlessswitchchipportsandMACbasedmirroringcopiestrafficsentorreceived
fromspecificdevicereachablefromtheportconfiguredinUnicastForwardingDatabase.
PortBasedMirroring
Thefirstconfigurationsetsether5portasamirror0analyzerportforbothingressandegressmirroring,mirroredtrafficwillbesentto
thisport.Portbasedingressandegressmirroringisenabledfromether7port.
/interfaceethernetswitch
setingressmirror0=ether8egressmirror0=ether8
/interfaceethernetswitchport
setether7egressmirrorto=mirror0ingressmirrorto=mirror0

VLANBasedMirroring

Thesecondexamplerequiresportstobeswitchedinagroup.Mirroringconfigurationsetsether5portasamirror0analyzerportandsets
mirror0porttobeusedwhenmirroringfromVLANoccurs.VLANtableentryenablesmirroringonlyforVLAN300trafficbetween
ether2andether7ports.
/interfaceethernet
setether7masterport=ether2
/interfaceethernetswitch
setingressmirror0=ether5vlanuses=mirror0
/interfaceethernetswitchvlan
addports=ether2,ether7vlanid=300learn=yesingressmirror=yes

MACBasedMirroring
Thethirdconfigurationalsorequiresportstobeswitchedinagroup.Mirroringconfigurationsetsether5portasamirror0analyzerport
andsetsmirror0porttobeusedwhenmirroringfromUnicastForwardingdatabaseoccurs.TheentryfromUnicastForwardingdatabase
enablesmirroringforpacketswithsourceordestinationMACaddressE7:16:34:A1:CD:18fromether8port.
/interfaceethernet
setether8masterport=ether2
/interfaceethernetswitch
setingressmirror0=ether5fdbuses=mirror0
/interfaceethernetswitchunicastfdb
addport=ether8mirror=yessvl=yesmacaddress=E7:16:34:A1:CD:18

Trunking

Trunking

TheTrunkingintheCloudRouterSwitchesprovidesstaticlinkaggregationgroupswithhardwareautomaticfailoverandloadbalancing.
IEEE802.3adandIEEE802.1axcompatibleLinkAggregationControlProtocolisnotsupportedyet.Upto8Trunkgroupsaresupported
withupto8TrunkmemberportsperTrunkgroup.
ConfigurationrequiresagroupofswitchedportsandanentryintheTrunktable.
/interfaceethernet
setether6masterport=ether2
setether7masterport=ether2
setether8masterport=ether2
/interfaceethernetswitchtrunk
addname=trunk1memberports=ether6,ether7,ether8

ThisexamplealsoshowsproperbondingconfigurationinRouterOSontheotherend.
/interfacebonding
addname=bonding1slaves=ether2,ether3,ether4mode=balancexortransmithashpolicy=layer2and3\
linkmonitoring=miimiiinterval=100ms

Isolation
PortLevelIsolation

PortLevelIsolation

PortlevelisolationisoftenusedforPrivateVLAN,where:
Oneormultipleuplinkportsaresharedamongallusersforaccessinggatewayorrouter.
PortgroupIsolatedPortsisforguestusers.Communicationisthroughtheuplinkportsonly.
PortgroupCommunity0isfordepartmentA.Communicationisallowedbetweenthegroupmembersandthroughuplinkports.
PortgroupCommunityXisfordepartmentX.Communicationisallowedbetweenthegroupmembersandthroughuplinkports.
TheCloudRouterSwitchesuseportlevelisolationprofilesforPrivateVLANimplementation:
UplinkportsPortlevelisolationprofile0
IsolatedportsPortlevelisolationprofile1
Community0portsPortlevelisolationprofile2
CommunityX(X<=30)portsPortlevelisolationprofileX
Thisexamplerequiresagroupofswitchedports.Assumethatallportsusedinthisexampleareinoneswitchgroupconfiguredwith
masterportsetting.
ThefirstpartofportisolationconfigurationissettingtheUplinkportsetportprofileto0forether2.
/interfaceethernetswitchport
setether2isolationleakageprofileoverride=0

Thencontinuewithsettingisolationprofile1toallisolatedportsandaddingthecommunicationportforportisolationprofile1.
/interfaceethernetswitchport
setether5isolationleakageprofileoverride=1
setether6isolationleakageprofileoverride=1
/interfaceethernetswitchportisolation
addportprofile=1ports=ether2type=dst

ConfigurationtosetCommunity0andCommunity1portsissimilar.
/interfaceethernetswitchport
setether7isolationleakageprofileoverride=2
setether8isolationleakageprofileoverride=2
/interfaceethernetswitchportisolation
addportprofile=2ports=ether2,ether7,ether8type=dst

/interfaceethernetswitchport
setether9isolationleakageprofileoverride=3
setether10isolationleakageprofileoverride=3
/interfaceethernetswitchportisolation
addportprofile=3ports=ether2,ether9,ether10type=dst

ProtocolLevelIsolation

ProtocolLevelIsolation

ProtocollevelisolationonCRSswitchescanbeusedtoenchancenetworksecurity.Forexample,restrictingDHCPtrafficbetweenthe
usersandallowingitonlytotrustedDHCPserverportcanpreventsecurityriskslikeDHCPspoofingattack.Thefollowingexample
showshowtoconfigureitonCRS.
Chooseamasterportandenslavetheportsyouneedtobewithinthesameswitchgroup.
/interfaceethernet
set[finddefaultname=ether2]masterport=ether1
set[finddefaultname=ether3]masterport=ether1
set[finddefaultname=ether4]masterport=ether1
set[finddefaultname=ether5]masterport=ether1

SetthesameCommunityportprofileforallDHCPclientports.Communityportprofilenumbersarefrom2to30.
/interfaceethernetswitchport
setether2isolationleakageprofileoverride=2
setether3isolationleakageprofileoverride=2
setether4isolationleakageprofileoverride=2
setether5isolationleakageprofileoverride=2

Andconfigureportisolation/leakageprofileforselectedCommunity(2)toallowDHCPtrafficdestinedonlytoportwherethe
trustedDHCPserverislocated.registrationstatusandtraffictypepropertieshavetobesetemptyinordertoapplyrestriction
onlyforDHCPprotocol.
/interfaceethernetswitchportisolation
addportprofile=2protocoltype=dhcpv4type=dstforwardingtype=bridgedports=ether1\
registrationstatus=""traffictype=""

BandwidthLimiting
BothIngressPortpolicerandShaperprovidebandwidthlimitingfeaturesforCRSswitches.
IngressPortPolicersetsRXlimitonport:
/interfaceethernetswitchingressportpolicer
addport=ether5meterunit=bitrate=10M

ShapersetsTXlimitonport:
/interfaceethernetswitchshaper
addport=ether5meterunit=bitrate=10M

TrafficStormControl
ThesameIngressPortpoliceralsocanbeusedforthetrafficstormcontroltopreventdisruptionsonLayer2portsbyabroadcast,
multicast,orunicasttrafficstorm.

Broadcaststormcontrolexampleonether5portwith8kilobitlimitpersecond:
/interfaceethernetswitchingressportpolicer
addport=ether5rate=8kmeterunit=packetpackettypes=broadcast

ExamplewithmultiplepackettypeswhichincludesARPandNDprotocolsandunregisteredmulticasttraffic.Unregistered
multicastistrafficwhichisnotdefinedinMulticastForwardingdatabase.
/interfaceethernetswitchingressportpolicer
addport=ether5rate=2Mmeterunit=packetpackettypes=broadcast,arpornd,unregisteredmulticast

[Top|BacktoContent]
Retrievedfrom"http://wiki.mikrotik.com/index.php?title=Manual:CRS_examples&oldid=26886"
Categories: Manual Interface CaseStudies Routerboard
Thispagewaslastmodifiedon15December2014,at09:21.
Thispagehasbeenaccessed99,180times.