Pinned for reference, please use :D! MikroTik Documentation for VLANS: help.mikrotik.com/docs/display/ROS/Basic+VLAN+switching Switch Chip Features: help.mikrotik.com/docs/display/ROS/Switch+Chip+Features#SwitchChipFeatures-Introduction

I spent two nights, essentially breaking my network, going in circles, trying to achieve something so simple in hindsight! I had such weird anomolies when doing this, for example ping absolutely fine to hosts, but no TCP sessions would stay established, later on 20 packets reply, 20 drop, etc etc. All because of the way I created the vlans on the bridges, which I tried two different ways according to docs I read. Painful, but I got there now thanks to this!

@TheNetworkBerg

Ай бұрын

MikroTik definitely allows for the possibility of misconfiguration. Not totally sure why they allow you to configure things in certain ways which can break your setup. Glad to hear you got everything working!

I watched the video with morning breakfast ☕

@PierPaoloG

2 ай бұрын

Doing it right now in front of my coffee while giving assistance to a customer 😂

Great content, nice and detailed. It's great to have content like this where you talk about best practices, dos and don'ts. Keep it coming

Man, thank you so much. First Mikrotik device, RB951 and was struggling with the nuance of the Mikrotik way of doing things over 2 very late nights and got my basic config working thanks to this video in 30minutes!!. Subscribed.

This it the best video I've seen on demystifying the vlan setup on mikrotiks (and I'd watch a lot previously to get my head around it), as other have said the little tip on not applying pvid filtering until you're done the rest - seems obvious, but so easy to click and watch winbox / putty disappear :D - I've gotten into the habit of 'safe moding' first. Have shared with a colleague who's dipping their toe in with Mikrotik (so he's spared the pain of watching about a dozen conflicting videos and then still locking himself out - to be fair, he's got form for it, mainly with prod linux servers :D ). Also the block diagram bit was a great bit of advice. Thanks as always.

@H30_

2 ай бұрын

Indeed, finally, after watching dozens of videos that teach only the theory, but not really any actual practical aspects, I had my vlans set up across my MT Router and few other non MT switches and a unifi AP, in a matter of hours - which is my first time actually practically setting up vlans. Great stuff!!

Glad to see more videos from you on 'tik.

brilliant video understood exactly what you were doing. looking at getting a mikrotik network up and running I'm still using an edgerouter with an old hp switch and some ap's.

Amazing video, practical example of how to set up really helps with understanding the whole concept!

That was a very nice, informative video. Thanks a lot for your efforts.

and as always,great explanation.thanks for giving this much of efforts.

Great explanation as always!

I can't thank you enough for this video! I've been struggling with my configuration for almost a year, and you explained everything perfectly in this video.

@TheNetworkBerg

Ай бұрын

Great to hear!

Just what I needed, thanks!

Your small hint putting the bridge into bridge/vlan and don‘t add the software vlan into it in case of routing made my day. Never read this somewhere else. Thanks a lot

@TheNetworkBerg

3 ай бұрын

Yeah that can definitely catch some people out, myself included :P

Thank you for this. I had set up my RB several years ago and had per-port VLANS. This method made trunking to a couple AP's and switches much 'cleaner'.

@TheNetworkBerg

Ай бұрын

Yeah this definitely feels cleaner for setups like that, glad I could help :D!

Great video, thank you!

Very nice review........ glad to you see join the 2020's in terms of single bridge vlan filtering, for most routers and CRS3xxx series. The main difference between vlans between device acting as a switch or router (besides the obvious) is that the managment vlan is the only that needs to be identified AND the only one tagged with the bridge in /interface bridge vlan settings. On a serious note, good to focus on AX3, a very common home device. However you have indirectly discovered your next video. Explaining why switches and the AX3, which dont have a classic marvel switch chip but something called PHYs. These need to be discussed so we folks understand what they are doing under the hood ( clearly they must help the CPU in some capacity ). A comparison would be fantastic!!!

Hey, it'sThe Network Barry :)

🙏 thanks, more and more pls...

Very usefull thank !

thank you

wow 1 of the best pretty forward hap3 ax6 mkstly bought equipment for home lab thank u, i hope i will be able to somewhat replicate & set this up

thank you sir...

awesome new looking 😊

VLAN neverending story :)

I believe if you create a bond interface with physical interfaces that belong to the same switch chip you will have a hardware offloaded bond and can be added to the bridge if needed. It is possible to create a bond interface with interfaces that belong to different switch chips then the that bond will be limited by the switch chip to CPU speed, the Mikrotik will let you do this without a warning so check the block diagrams for you use case.

Missed your content

Very nice video. Can you do a bandwidth test to see if wirespeed is achieved? To see when is used switchchip and cpu. A wrong layout can decrease speed and bottlenecking.

Awesome video! This helped me a lot, I was able to configure all the VLANs I wanted to on my RB3011 and CRS125-24G. I'm now running into the issue you mentioned @7:13. My CPU is hitting 100% downloading anything. Do you have any advice on how to implement this VLAN structure with a router that has multiple switch chips?

thank you video tutorial, now it solve my confusion about mikrotik vlan. I have a question, how can i restrict access between vlans?

Shared to my connections on LinkedIn, not sure if that will help much - but hoping my techie connections will give it a bit of a boost. Just not a huge player in the UK enterprise space.

thank you! one thing i was doing wrong, tagging the vlan as well as the bridge - it didnt show up as tagged with vlan filtering enabled; one more thing i learned is that i dont need software vlans (l3) if i dont plan to use dhcp or any other l3 service.

Great Video as always, one request we are not able to see your mouse cursor during recording, please enable it. so that we can see actually where you are clicking. Thank you.. 😊👌

Gothic 2, such a great game!

@TheNetworkBerg

3 ай бұрын

Definitely one of my favorite games ever, I still replay it every couple of years

Hi could you please do a wifi setup video especially with the new wifi packages.

Hey you do a really great job, but why you don't show to work in the CLI ? The cli is you last hope when all other is broken and most of the ppl are really lost if they dont know to handle it.

one question, do the ports need to be part of the bridge you are configuring the vlans on to work properly? Lets say you have 2 bridges, one has all the ports, one has none, can the second bridge affect vlan tagging of ports even though the ports its tagging do not reside within itself?

Great video. Just what i needed. I just got that l009, and i am in full learning mode. would it be possible to make a video on creating firewall rules in this setup.. I'd like to separate the vlans by default but have them all have an internet connection (so devices can go to the internet but not to devices on other vlans). And maybe poke a hole for some servers.. (edit words vs. Dutch autocorrect..)

@TheNetworkBerg

2 ай бұрын

Funny you should mention it was busy recording just that today 😉

@omemanti

2 ай бұрын

@@TheNetworkBerg haha, excellent, looking forward to it.

@TheNetworkBerg

2 ай бұрын

Posted it last night, feel free to pop to the the latest video on my channel and let me know if this helps you or if you are still having issues.

Nice, i will be doing this later when my expansion switch arrives. CRS326 of course. Can you please help me confoguring VLAN's for my RB5009 to get it working with IP-TV? I need to use a media splitter right now from my provider. Its a managed switch litteraly and has specific ports for TV and such.. There is VLAN config on that. My IP-TV box gets an ip of 10.x.x.x..

It would've been good if you explained why the single bridge per ASIC method exists. I.e. rooted in the original Linux DSA and switchdev implementation. People who haven't worked with cumulus or whiteboxes with a Linux based OS, often think this is exclusive to MikroTik.

Did you test mlag on mikrotik switches? Is it working fine?

Oh man.. I just got my RB5009UG+S+ and my head is spinning with trying to figure out the VLAN setup. I will get it... but damn my head hurts right now.

❤

Hello, will there be a future video about the hybrid port/hybrid vlan on Mikrotik with an example?

@TheNetworkBerg

3 ай бұрын

I can definitely do something like a Hybrid port video as well :)

May i ask your sir , shoud i change the PVID on bridge to vlan100 in case that i want the change native vlan to 100 ?

Question: Suppose I have RB5009 Series where port 1 = ISP1, port 2 = ISP2, port 3-5 = for Hotspot(10.0.0.1/24), port 6 = OLT pon1 (172.16.0.1/24), port 7 = OLT pon2, (172.16.0.1/24) then lastly port 8 = LAN (192.168.100.1/24). Knowing that I assigned each port/interface with each assigned IPs for that setup. Then, Do I still need to configure it in a VLAN setup or is it the same already with VLAN setup? Please help. Thanks in advance.

Why weren't VLAN settings used for the 3** series switch in this section? /interface ethernet switch vlan

Sir how about multiple crs with failover using layer 3

Great video, I wonder if you could fork off this and offer a VLAN tutorial for dealing with double tagging. For example were ISP's have SVID and CVID's to deal with. Can you use this way of doing VLANS to add the CVID to the bridge VLAN rather than adding new CVID's as sub interfaces to a parent SVID interface?

@TheNetworkBerg

2 ай бұрын

Interesting concept, will have to test it out because honestly the way I've always been doing it is as a sub interface.

@JimmieB

2 ай бұрын

@@TheNetworkBergYes that's how I'm doing it, but I thought after watching your vid maybe there's a better way? I don't have a lab to test so will have to build one. Might be a fun experiment.

are you experienced in taming scary monster living under /switch menu on crs1xx devices? (i'm not only talking about vlans)

What would happen if we changed the PVID on the bridge from 1 to 99, i.e. the PVID of the management vlan

my plan is 1G I replace Huawei HG8240T5 Gpon with LXT-010S-H from LEOX and I'm install it in to Mikrotik RB5009 from Mikrotik I setup Vlan10 and PPPoE for Internet and It's work and I got internet connection but I couldn't figure out how to configure Vlan30 for VoIP

You say that Software defined VLANs are bind to the bridge, but what if you use VLANs on a bond? You bind those VLANs on the bond interface and not on the bridge. The bond interfaces go to the bridge. So what do you do if you are going to tag the ports in Bridge VLANs?

Why this is better solution? I have created separate bridges for Server, Management, LAN etc. and on interfaces I have created vlan to each ports separately

@TheNetworkBerg

3 ай бұрын

Basically it boils down to throughput and hardware offloading. Multiple bridges may not support hardware offloading and traffic between the bridges will probably have to go through to the CPU to get processed. Depending on the model of your hardware this link to the CPU might be very small (Like 1Gb) and can easily impact performance like speed or cause packet loss. The other problem is that the CPU will have to deal with the forwarding and this can cause a spike in the CPU usage. If the CPU starts maxing out it can potentially cause the router to hang and will also provide a general negative experience. Perhaps your network isn't that big or you are using bigger routers and you just never really notice the impact on the CPU, it is strongly advised to use hardware offloading with a switch chip wherever possible for the best performance. Though there are also instances where traffic needs to pass to the CPU regardless and even having a switch chip will not improve your performance. This is why looking at the documentation is crucial in planning out your network.

@krystianroza

2 ай бұрын

@@TheNetworkBerg right now I'm using RB4011 without any disadvantages, but probably not full speed via the 2,5Gb/s connections to CPU, but You made my mind go crazy and probably I will change it after copy of configuration of course :)

VLAN on Mikrotiks makes me sad. What takes hours of planning, mapping and configuration on Mikrotik takes minutes on Cisco. Don’t get me wrong, I like Mikrotik and have more of them than Cisco in my environments for others reasons.

@TheNetworkBerg

2 ай бұрын

I do agree that MT has many potentional pitfalls when it comes to adding a VLAN and makes it feel unnecessarily harder. Although there is one thing I remember well about Cisco and that is forgetting to use the "add" command when wanting to tag additional VLANs on a trunk, I think this has brought down more networks than it should have.

@beedslolkuntus2070

Ай бұрын

Don’t think you can expect much from them. The cost says it all. They are just not comparable at all. Everyone knows but mtik is actually fairly weak in their software, the “same OS for every of our product” starts to seem like a weakness. It seems glued and janky.

@ImadShamsy

Ай бұрын

Suppose there is a router after the switch instead of a computer to receive the service via vlan interface, what will the configuration be like?

@beedslolkuntus2070

Ай бұрын

@@ImadShamsy You need to configure the router accordingly to whatever your needs are, for example if the service now is internet already in a vlan that is there in a network I want to tap into it and do double natting then that can be done. It all depends on your total objective really, depending on what it is you can efficiently plan and know what devices to use or what to not.

Now just to remember when and when NOT L3 HW offload happens. I wish I didn't have to remember....so more expensive L3 switches it is for me even for homelab.

I have a problem with vlans...my queues are not working well ..mk cpu is freaking high

Good idea for video if possible, filter rules on switch chip itself. What I noticed a lot, people are buying CRS devices and use them as routers... Mikrotik is confusing their customers with that naming scheme. As you said, CPU is limited and thus routing performance is bad...

everything works, but with larger traffic of 1GB (10GB sfp links) my cpu is loaded at 100%

@TheNetworkBerg

5 күн бұрын

Strange, has yours ports been added to a VLAN filtered bridge? Have ran this same setup on 25Gb, 40Gb & 100Gb interfaces and I get full throughput without CPU bottle-necking.

@masulkow

4 күн бұрын

@@TheNetworkBerg I checked it on 10 and 100 Gb cards but the result was the same on both. So I thought that I do some configuration mistake and I set everything up again and the result was the same - CPU 100%

Spend more time outlining the goal, preferably by drawing data paths, before making changes... you're going at a speed where only a network admin can follow you and those don't need this video.

Messy video. Your previous videos on the topic are better.

i wish you'd redo this. make a plan first and stop bouncing all over the place. its so confusing to watch.