Konfigurácia VLAN

[emissay]

Dobrý deň,

nemám moc skúsenosti s touto problematikou. Chcem sa spýtať, či je možné nakonfigurovať mikrotik router s takým zapojením ako uvádzam na obrázku v prílohe. Hľadal som nejaké návody, ale ani jedno zapojenie sa nepodobalo tomu môjmu. Ja viem, že je to asi veľmi neštandardné zapojenie.

Ďakujem pekne za odpovede.

[the.max]

https://wiki.mikrotik.com/wiki/Manual:Switch_Chip_Features#Setup_Examples

Example 1 i example 2, v podstatě tě zajímá to, jak je nastavenej v příkladech ether2. Analogicky podle toho si nastavíš u sebe porty 3 a 4. A pokud má bejt ether4 odtagovanej, tak koukej na example 1 na porty 3,4 a 5.

[emissay]

Keďže v VLANAm sa venujem celkovo dva týždne, tak mi tie návody moc nehovoria. Nemám problém spraviť jeden trunk s X VLANAMi s DHCP serverom pre každú z nich. Ale mám značný problém vytvoriť 2 a viac TRUNkov s rovnakými VLANAMi (tak aby na každej beží DHCP server) plus napr jeden access port pre priame pripojenie zariadenia. Tiež neviem ako má byť správne nakonfigurovaná MGMT sieť pre správu zariadení.

[CrazyApe]

K vlan se chovej stejně jako k fyzickému interface a jen dodržuj číslo vlan. Nic na tom není ...

[emissay]

Ja viem len toto...

Kód: Vybrat vše

/interface vlan
add name=vlan20 vlan-id=20 interface=ether2
add name=vlan30 vlan-id=30 interface=ether2

/ip address
add address=192.168.40.1 interface=vlan40   
add address=192.168.50.1 interface=vlan50

/ip pool
add name=POOL40 ranges=192.168.40.2-192.168.40.254
add name=POOL50 ranges=192.168.50.2-192.168.50.254


/ip dhcp-server
add address-pool=POOL40 disabled=no interface=VLAN40 name=DHCP40
add address-pool=POOL50 disabled=no interface=VLAN50 name=DHCP50


/ip dhcp-server network
add address=192.168.40.0/24 dns-server=8.8.8.8 gateway=192.168.40.1
add address=192.168.50.0/24 dns-server=8.8.8.8 gateway=192.168.50.1

/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1




Ok....jeden TRUNK port... funguje to... A keď chcem ešte jeden rovnaký plus jeden access port?

[mladas]

vytvor vvlan si na portu 2 pojmenuj jej treba vlan20-2 a na portu 3 treba vlan20-3 ty pak spoj spolu bridgem, ktery pojmenujes treba bridge20 na tomto spojis ty 20kove vlany a port nezatagovany 4 a na tom bribge20 rozjedes dhcp server a ten bude jak do tech zatagovanych vlan tak do portu 4

[emissay]

Tak nakoniec sa mi to podarilo spraviť vďaka jednému celkom šikovnému tutorialu.

Kód: Vybrat vše

# LAN SSID
/interface wireless security-profiles set [ find default=yes ] authentication-types=wpa2-psk mode=dynamic-keys wpa2-pre-shared-key="password"
/interface wireless set [ find default-name=wlan1 ] ssid=NetGate2 frequency=auto mode=ap-bridge disabled=no

# GUEST SSID
/interface wireless security-profiles add name=guest authentication-types=wpa2-psk mode=dynamic-keys wpa2-pre-shared-key="password"
/interface wireless add name=wlan2 ssid=GUEST master-interface=wlan1 security-profile=guest disabled=no

# SEC SSID
/interface wireless security-profiles add name=sec authentication-types=wpa2-psk mode=dynamic-keys wpa2-pre-shared-key="password"
/interface wireless add name=wlan3 ssid=SEC master-interface=wlan1 security-profile=sec disabled=no

# BASE SSID
/interface wireless security-profiles add name=base authentication-types=wpa2-psk mode=dynamic-keys wpa2-pre-shared-key="password"
/interface wireless add name=wlan4 ssid=BASE master-interface=wlan1 security-profile=base disabled=no

#######################################
# Bridge
#######################################

# create one bridge, set VLAN mode off while we configure
/interface bridge add name=BR1 protocol-mode=none vlan-filtering=no

#######################################
#
# -- Trunk Ports --
#
#######################################

# ingress behavior
/interface bridge port

# Trunk. Leave pvid set to default of 1
add bridge=BR1 interface=ether2
add bridge=BR1 interface=ether3


#######################################
#
# -- Access Ports --
#
#######################################

# ingress behavior
/interface bridge port

# LAN VLAN
add bridge=BR1 interface=ether4 pvid=10
add bridge=BR1 interface=ether6 pvid=10
add bridge=BR1 interface=wlan1  pvid=10

# GUEST VLAN
add bridge=BR1 interface=wlan2  pvid=20

# SEC VLAN
add bridge=BR1 interface=ether5 pvid=30
add bridge=BR1 interface=wlan3  pvid=30

# BASE_VLAN
add bridge=BR1 interface=ether10 pvid=99
add bridge=BR1 interface=wlan4 pvid=99

#
# egress behavior
#
/interface bridge vlan

# Purple Trunk. These need IP Services (L3), so add Bridge as member
add bridge=BR1 tagged=BR1,ether2,ether3 untagged=ether4,ether6,wlan1 vlan-ids=10
add bridge=BR1 tagged=BR1,ether2,ether3 untagged=wlan2 vlan-ids=20
add bridge=BR1 tagged=BR1,ether2,ether3 untagged=ether5,wlan3 vlan-ids=30
add bridge=BR1 tagged=BR1,ether2,ether3 untagged=ether10,wlan4 vlan-ids=99


#######################################
# IP Addressing & Routing
#######################################

# LAN facing router's IP address on the BASE_VLAN
/interface vlan add interface=BR1 name=BASE_VLAN vlan-id=99
/ip address add address=172.16.0.1/24 interface=BASE_VLAN

# DNS server, set to cache for LAN
/ip dns set allow-remote-requests=yes servers="9.9.9.9"

# WAN facing port with IP Address provided by ISP
/ip address add interface=ether1 address=a.a.a.a/aa network=a.a.a.0

# router's gateway provided by ISP
/ip route add distance=1 gateway=b.b.b.b

# LAN VLAN interface creation, IP assignment, and DHCP service
/interface vlan add interface=BR1 name=LAN_VLAN vlan-id=10
/ip address add interface=LAN_VLAN address=192.168.0.1/24
/ip pool add name=LAN_POOL ranges=192.168.0.2-192.168.0.254
/ip dhcp-server add address-pool=LAN_POOL interface=LAN_VLAN name=LAN_DHCP disabled=no
/ip dhcp-server network add address=192.168.0.0/24 dns-server=172.16.0.1 gateway=192.168.0.1

# GUEST VLAN interface creation, IP assignment, and DHCP service
/interface vlan add interface=BR1 name=GUEST_VLAN vlan-id=20
/ip address add interface=GUEST_VLAN address=10.0.20.1/24
/ip pool add name=GUEST_POOL ranges=10.0.20.2-10.0.20.254
/ip dhcp-server add address-pool=GUEST_POOL interface=GUEST_VLAN name=GUEST_DHCP disabled=no
/ip dhcp-server network add address=10.0.20.0/24 dns-server=172.16.0.1 gateway=10.0.20.1

# SEC VLAN interface creation, IP assignment, and DHCP service
/interface vlan add interface=BR1 name=SEC_VLAN vlan-id=30
/ip address add interface=SEC_VLAN address=10.0.30.1/24
/ip pool add name=SEC_POOL ranges=10.0.30.2-10.0.30.254
/ip dhcp-server add address-pool=SEC_POOL interface=SEC_VLAN name=SEC_DHCP disabled=no
/ip dhcp-server network add address=10.0.30.0/24 dns-server=172.16.0.1 gateway=10.0.30.1

# Optional: Create a DHCP instance for BASE_VLAN. Convenience feature for an admin.
/ip pool add name=BASE_POOL ranges=172.16.0.10-172.16.0.254
/ip dhcp-server add address-pool=BASE_POOL interface=BASE_VLAN name=BASE_DHCP disabled=no
/ip dhcp-server network add address=172.16.0.0/24 dns-server=172.16.0.1 gateway=172.16.0.1

#######################################
# Firewalling & NAT
# A good firewall for WAN. Up to you
# about how you want LAN to behave.
#######################################

# Use MikroTik's "list" feature for easy rule matchmaking.

/interface list add name=WAN
/interface list add name=VLAN
/interface list add name=BASE

/interface list member
add interface=ether1     list=WAN
add interface=BASE_VLAN  list=VLAN
add interface=LAN_VLAN  list=VLAN
add interface=GUEST_VLAN list=VLAN
add interface=SEC_VLAN   list=VLAN
add interface=BASE_VLAN list=BASE

# VLAN aware firewall. Order is important.
/ip firewall filter


##################
# INPUT CHAIN
##################
add chain=input action=accept connection-state=established,related comment="Allow Estab & Related"

# Allow VLANs to access router services like DNS, Winbox. Naturally, you SHOULD make it more granular.
add chain=input action=accept in-interface-list=VLAN comment="Allow VLAN"

# Allow BASE_VLAN full access to the device for Winbox, etc.
add chain=input action=accept in-interface-list=VLAN comment="Allow VLAN"

add chain=input action=drop comment="Drop"

##################
# FORWARD CHAIN
##################
add chain=forward action=accept connection-state=established,related comment="Allow Estab & Related"

# Allow all VLANs to access the Internet only, NOT each other
add chain=forward action=accept connection-state=new in-interface-list=VLAN out-interface-list=WAN comment="VLAN Internet Access only"

add chain=forward action=drop comment="Drop"

##################
# NAT
##################
/ip firewall nat add chain=srcnat action=masquerade out-interface-list=WAN comment="Default masquerade"


#######################################
# VLAN Security
#######################################

# Only allow packets with tags over the Trunk Ports
/interface bridge port
set bridge=BR1 ingress-filtering=yes frame-types=admit-only-vlan-tagged [find interface=ether2]
set bridge=BR1 ingress-filtering=yes frame-types=admit-only-vlan-tagged [find interface=ether3]

# Only allow ingress packets without tags on Access Ports
/interface bridge port
set bridge=BR1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged [find interface=ether4]
set bridge=BR1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged [find interface=ether5]
set bridge=BR1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged [find interface=ether6]
set bridge=BR1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged [find interface=wlan1]
set bridge=BR1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged [find interface=wlan2]
set bridge=BR1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged [find interface=wlan3]
set bridge=BR1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged [find interface=wlan4]

#######################################
# MAC Server settings
#######################################

# Ensure only visibility and availability from BASE_VLAN, the MGMT network
/ip neighbor discovery-settings set discover-interface-list=BASE
/tool mac-server mac-winbox set allowed-interface-list=BASE
/tool mac-server set allowed-interface-list=BASE

#######################################
# Turn on VLAN mode
#######################################
/interface bridge set BR1 vlan-filtering=yes