ZeIRO
https://wiki.mikrotik.com/wiki/Manual:Switch_Chip_Features
vlan-mode (check | disabled | fallback | secure; Default: disabled) Changes the VLAN lookup mechanism against the VLAN Table for ingress traffic.
disabled - disables checking against the VLAN Table completely for ingress traffic. No traffic is dropped when set on ingress port.
fallback - checks tagged traffic against the VLAN Table for ingress traffic, forwards all untagged traffic. If ingress traffic is tagged and egress port is not found in the VLAN table for the appropriate VLAN ID, then traffic is dropped. If a VLAN ID is not found in the VLAN Table, then traffic is forwarded. Used to allow known VLANs only in specific ports.
check - checks tagged traffic against the VLAN Table for ingress traffic, drops all untagged traffic. If ingress traffic is tagged and egress port is not found in the VLAN table for the appropriate VLAN ID, then traffic is dropped.
secure - checks tagged traffic against the VLAN Table for ingress traffic, drops all untagged traffic. Both ingress and egress port must be found in the VLAN Table for the appropriate VLAN ID, otherwise traffic is dropped.`
default-vlan-id (auto | integer: 0..4095; Default: auto) Adds a VLAN tag with the specified VLAN ID on all untagged ingress traffic on a port, should be used with vlan-header set to always-strip on a port to configure the port to be the access port. For hybrid ports default-vlan-id is used to tag untagged traffic. If two ports have the same default-vlan-id, then VLAN tag is not added since the switch chip assumes that traffic is being forwarded between access ports.
