Friday, 11 March 2016

Mikrotik VLAN tagging on a bridge. (Not passthrough)

While Mikrotik's Wiki is immensely helpful, especially with VLAN use cases and possible accelerations. (http://wiki.mikrotik.com/wiki/Manual:CRS_examples) - there is a simplest use case which it doesn't address.

I have a client that operates VoIP and PPPOE throughout their building. The problem is if this client wants to add VoIP phones behind their router, it can create a wiring nightmare.

So why not just put the building traffic (and in so doing VoIP and PPPOE) onto a VLAN behind the client's router? That way, the phones can be set to a certain VLAN and there are no additional wires.

So how?

When you add a VLAN interface on a Mikrotik router, that interface talks on that VLAN. How? It removes the VLAN tag and makes the VLAN traffic ordinary traffic to anything on the newly created "vlan" interface (and of course anything bridged with it) - it removes the VLAN tag for any traffic that comes in through the newly created interface (or anything bridged with it.) and adds the tag back for anything going out through the VLAN interface.

So it's simple, right?

So the incoming interface is ether1.

It's bridged with br-ppp.

I have a pppoe-client dialling out over br-ppp (instead of ether1).

So now I want my phones to work on VLAN20.

The client network is bridge1. (Only ether2 is on it, because ether2 is the master port for all the other switch ports except ether1.)

Here's how:

[admin@client-102] > /int vlan add name=vlan20 vlan-id=20 interface=bridge1 

[admin@client-102] > /int br add interface=vlan20 bridge=br-ppp
Done! Simple huh!

[admin@client-102] > /int br po prFlags: X - disabled, I - inactive, D - dynamic
 #    INTERFACE           BRIDGE        PRIORITY  PATH-COST    HORIZON
 0    ether2              bridge1       0x80      10           none
 1    wlan1               bridge1       0x80      10           none
 2    eoip-boardroom      bridge1       0x80      10           none
 3    ether1              br-ppp        0x80      10           none
 4    vlan20              br-ppp        0x80      10           none

[
admin@client-102] > /int vlan pr
Flags: X - disabled, R - running, S - slave
 #    NAME           MTU   ARP       VLAN-ID INTERFACE                     
 0 R  vlan20         1500  enabled   20      bridge1
[
admin@client-102] > 

I had a tiny bit of a problem with this client, in that his incoming interface and PPPOE wasn't on a bridge to start with. But a single line creating a bridge, changing the PPPOE-CLIENT dial-out interface, adding the incoming interface to the bridge, and moving the IP address that I was connected on, onto the bridge, solved that with only a hardly-noticable delay:

[admin@client-102] > /int pppoe-client set 0 interface=br-ppp; /int br por add interface=ether1  bridge=br-ppp; /ip add set 1 interface=br-ppp 
Of course I had to "/int pppoe-client pr" and "/ip addr pr" first. But I could've replaced the 0 and the 1 with [/int pppoe-client find name="pppoe-out1"] and [/ip add find add=192.168.254.123] if I wanted a cut-and-paste script.

The eoip-boardroom is another story... it bridges the client's network to a wireless SSID in the boardroom, because CAPSMAN didn't exist yet... Let me know if you want to know more...