Konfigurácia VLAN

emissay

Dobrý deň,

nemám moc skúsenosti s touto problematikou. Chcem sa spýtať, či je možné nakonfigurovať mikrotik router s takým zapojením ako uvádzam na obrázku v prílohe. Hľadal som nejaké návody, ale ani jedno zapojenie sa nepodobalo tomu môjmu. Ja viem, že je to asi veľmi neštandardné zapojenie.

Ďakujem pekne za odpovede.

the_max

https://wiki.mikrotik.com/wiki/Manual:Switch_Chip_Features#Setup_Examples

Example 1 i example 2, v podstatě tě zajímá to, jak je nastavenej v příkladech ether2. Analogicky podle toho si nastavíš u sebe porty 3 a 4. A pokud má bejt ether4 odtagovanej, tak koukej na example 1 na porty 3,4 a 5.

emissay

Keďže v VLANAm sa venujem celkovo dva týždne, tak mi tie návody moc nehovoria. Nemám problém spraviť jeden trunk s X VLANAMi s DHCP serverom pre každú z nich. Ale mám značný problém vytvoriť 2 a viac TRUNkov s rovnakými VLANAMi (tak aby na každej beží DHCP server) plus napr jeden access port pre priame pripojenie zariadenia. Tiež neviem ako má byť správne nakonfigurovaná MGMT sieť pre správu zariadení. :

crazyape

K vlan se chovej stejně jako k fyzickému interface a jen dodržuj číslo vlan. Nic na tom není ...

emissay

Ja viem len toto...

/interface vlan

add name=vlan20 vlan-id=20 interface=ether2

add name=vlan30 vlan-id=30 interface=ether2

/ip address

add address=192.168.40.1 interface=vlan40

add address=192.168.50.1 interface=vlan50

/ip pool

add name=POOL40 ranges=192.168.40.2-192.168.40.254

add name=POOL50 ranges=192.168.50.2-192.168.50.254

/ip dhcp-server

add address-pool=POOL40 disabled=no interface=VLAN40 name=DHCP40

add address-pool=POOL50 disabled=no interface=VLAN50 name=DHCP50

/ip dhcp-server network

add address=192.168.40.0/24 dns-server=8.8.8.8 gateway=192.168.40.1

add address=192.168.50.0/24 dns-server=8.8.8.8 gateway=192.168.50.1

/ip firewall nat

add action=masquerade chain=srcnat out-interface=ether1

Ok....jeden TRUNK port... funguje to... A keď chcem ešte jeden rovnaký plus jeden access port?

mladas

vytvor vvlan si na portu 2 pojmenuj jej treba vlan20-2 a na portu 3 treba vlan20-3 ty pak spoj spolu bridgem, ktery pojmenujes treba bridge20 na tomto spojis ty 20kove vlany a port nezatagovany 4 a na tom bribge20 rozjedes dhcp server a ten bude jak do tech zatagovanych vlan tak do portu 4

emissay

Tak nakoniec sa mi to podarilo spraviť vďaka jednému celkom šikovnému tutorialu.

# LAN SSID

/interface wireless security-profiles set [ find default=yes ] authentication-types=wpa2-psk mode=dynamic-keys wpa2-pre-shared-key="password"

/interface wireless set [ find default-name=wlan1 ] ssid=NetGate2 frequency=auto mode=ap-bridge disabled=no

# GUEST SSID

/interface wireless security-profiles add name=guest authentication-types=wpa2-psk mode=dynamic-keys wpa2-pre-shared-key="password"

/interface wireless add name=wlan2 ssid=GUEST master-interface=wlan1 security-profile=guest disabled=no

# SEC SSID

/interface wireless security-profiles add name=sec authentication-types=wpa2-psk mode=dynamic-keys wpa2-pre-shared-key="password"

/interface wireless add name=wlan3 ssid=SEC master-interface=wlan1 security-profile=sec disabled=no

# BASE SSID

/interface wireless security-profiles add name=base authentication-types=wpa2-psk mode=dynamic-keys wpa2-pre-shared-key="password"

/interface wireless add name=wlan4 ssid=BASE master-interface=wlan1 security-profile=base disabled=no

#######################################

# Bridge

#######################################

# create one bridge, set VLAN mode off while we configure

/interface bridge add name=BR1 protocol-mode=none vlan-filtering=no

#######################################

# -- Trunk Ports --

#######################################

# ingress behavior

/interface bridge port

# Trunk. Leave pvid set to default of 1

add bridge=BR1 interface=ether2

add bridge=BR1 interface=ether3

#######################################

# -- Access Ports --

#######################################

# ingress behavior

/interface bridge port

# LAN VLAN

add bridge=BR1 interface=ether4 pvid=10

add bridge=BR1 interface=ether6 pvid=10

add bridge=BR1 interface=wlan1 pvid=10

# GUEST VLAN

add bridge=BR1 interface=wlan2 pvid=20

# SEC VLAN

add bridge=BR1 interface=ether5 pvid=30

add bridge=BR1 interface=wlan3 pvid=30

# BASE_VLAN

add bridge=BR1 interface=ether10 pvid=99

add bridge=BR1 interface=wlan4 pvid=99

# egress behavior

/interface bridge vlan

# Purple Trunk. These need IP Services (L3), so add Bridge as member

add bridge=BR1 tagged=BR1,ether2,ether3 untagged=ether4,ether6,wlan1 vlan-ids=10

add bridge=BR1 tagged=BR1,ether2,ether3 untagged=wlan2 vlan-ids=20

add bridge=BR1 tagged=BR1,ether2,ether3 untagged=ether5,wlan3 vlan-ids=30

add bridge=BR1 tagged=BR1,ether2,ether3 untagged=ether10,wlan4 vlan-ids=99

#######################################

# IP Addressing & Routing

#######################################

# LAN facing router's IP address on the BASE_VLAN

/interface vlan add interface=BR1 name=BASE_VLAN vlan-id=99

/ip address add address=172.16.0.1/24 interface=BASE_VLAN

# DNS server, set to cache for LAN

/ip dns set allow-remote-requests=yes servers="9.9.9.9"

# WAN facing port with IP Address provided by ISP

/ip address add interface=ether1 address=a.a.a.a/aa network=a.a.a.0

# router's gateway provided by ISP

/ip route add distance=1 gateway=b.b.b.b

# LAN VLAN interface creation, IP assignment, and DHCP service

/interface vlan add interface=BR1 name=LAN_VLAN vlan-id=10

/ip address add interface=LAN_VLAN address=192.168.0.1/24

/ip pool add name=LAN_POOL ranges=192.168.0.2-192.168.0.254

/ip dhcp-server add address-pool=LAN_POOL interface=LAN_VLAN name=LAN_DHCP disabled=no

/ip dhcp-server network add address=192.168.0.0/24 dns-server=172.16.0.1 gateway=192.168.0.1

# GUEST VLAN interface creation, IP assignment, and DHCP service

/interface vlan add interface=BR1 name=GUEST_VLAN vlan-id=20

/ip address add interface=GUEST_VLAN address=10.0.20.1/24

/ip pool add name=GUEST_POOL ranges=10.0.20.2-10.0.20.254

/ip dhcp-server add address-pool=GUEST_POOL interface=GUEST_VLAN name=GUEST_DHCP disabled=no

/ip dhcp-server network add address=10.0.20.0/24 dns-server=172.16.0.1 gateway=10.0.20.1

# SEC VLAN interface creation, IP assignment, and DHCP service

/interface vlan add interface=BR1 name=SEC_VLAN vlan-id=30

/ip address add interface=SEC_VLAN address=10.0.30.1/24

/ip pool add name=SEC_POOL ranges=10.0.30.2-10.0.30.254

/ip dhcp-server add address-pool=SEC_POOL interface=SEC_VLAN name=SEC_DHCP disabled=no

/ip dhcp-server network add address=10.0.30.0/24 dns-server=172.16.0.1 gateway=10.0.30.1

# Optional: Create a DHCP instance for BASE_VLAN. Convenience feature for an admin.

/ip pool add name=BASE_POOL ranges=172.16.0.10-172.16.0.254

/ip dhcp-server add address-pool=BASE_POOL interface=BASE_VLAN name=BASE_DHCP disabled=no

/ip dhcp-server network add address=172.16.0.0/24 dns-server=172.16.0.1 gateway=172.16.0.1

#######################################

# Firewalling & NAT

# A good firewall for WAN. Up to you

# about how you want LAN to behave.

#######################################

# Use MikroTik's "list" feature for easy rule matchmaking.

/interface list add name=WAN

/interface list add name=VLAN

/interface list add name=BASE

/interface list member

add interface=ether1 list=WAN

add interface=BASE_VLAN list=VLAN

add interface=LAN_VLAN list=VLAN

add interface=GUEST_VLAN list=VLAN

add interface=SEC_VLAN list=VLAN

add interface=BASE_VLAN list=BASE

# VLAN aware firewall. Order is important.

/ip firewall filter

##################

# INPUT CHAIN

##################

add chain=input action=accept connection-state=established,related comment="Allow Estab & Related"

# Allow VLANs to access router services like DNS, Winbox. Naturally, you SHOULD make it more granular.

add chain=input action=accept in-interface-list=VLAN comment="Allow VLAN"

# Allow BASE_VLAN full access to the device for Winbox, etc.

add chain=input action=accept in-interface-list=VLAN comment="Allow VLAN"

add chain=input action=drop comment="Drop"

##################

# FORWARD CHAIN

##################

add chain=forward action=accept connection-state=established,related comment="Allow Estab & Related"

# Allow all VLANs to access the Internet only, NOT each other

add chain=forward action=accept connection-state=new in-interface-list=VLAN out-interface-list=WAN comment="VLAN Internet Access only"

add chain=forward action=drop comment="Drop"

##################

# NAT

##################

/ip firewall nat add chain=srcnat action=masquerade out-interface-list=WAN comment="Default masquerade"

#######################################

# VLAN Security

#######################################

# Only allow packets with tags over the Trunk Ports

/interface bridge port

set bridge=BR1 ingress-filtering=yes frame-types=admit-only-vlan-tagged [find interface=ether2]

set bridge=BR1 ingress-filtering=yes frame-types=admit-only-vlan-tagged [find interface=ether3]

# Only allow ingress packets without tags on Access Ports

/interface bridge port

set bridge=BR1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged [find interface=ether4]

set bridge=BR1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged [find interface=ether5]

set bridge=BR1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged [find interface=ether6]

set bridge=BR1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged [find interface=wlan1]

set bridge=BR1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged [find interface=wlan2]

set bridge=BR1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged [find interface=wlan3]

set bridge=BR1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged [find interface=wlan4]

#######################################

# MAC Server settings

#######################################

# Ensure only visibility and availability from BASE_VLAN, the MGMT network

/ip neighbor discovery-settings set discover-interface-list=BASE

/tool mac-server mac-winbox set allowed-interface-list=BASE

/tool mac-server set allowed-interface-list=BASE

#######################################

# Turn on VLAN mode

#######################################

/interface bridge set BR1 vlan-filtering=yes