VLANs on the Mikrotik hAP ac³ (posted 2021-04-04)
For my BGP lab/training setups I have a bunch of routers, real or virtual, that each need several IP addresses to talk to other routers. VLANs are the perfect way to keep all of this manageable: with VLANs, it's possible to have separate IP interfaces, but still just use a single Ethernet port to hook everything up. Simple unmanaged switches simply forward the packets to the right port without looking at the VLAN header, so no need to configure the network.
Until I got my Mikrotik hAP ac³ this week...
In its default configuration it will do what unmanaged switches do: ignore the VLAN header. In addition, you can add VLAN interfaces to the Mikrotik and give those an IP address. I even got IPv6 prefix delegation to work. For this, set up the DHCPv6 client to request a prefix. Then fill in the name of a pool. But don't create that pool yourself—that won't work. The pool will be created automatically. Then configured an IPv6 on a VLAN interface that I created and specified that the pool should be used for that. "Advertise" is enabled by default, which means that the Mikrotik will send out router advertisements and machines that have the VLAN configured will configure an IPv6 address for themselves on that VLAN interface.
Eventually I want to set up a guest network with its own VLAN and IPv4 NAT. For now I just set up IP addresses on the VLAN interfaces so the Mikrotik will be able to talk to my virtual BGP routers on these VLANs. That initially went well.
However, I also wanted have these BGP VMs talk to an old Cisco 2503 router, which doesn't support VLANs. So I wanted to set up an access port. The idea was that the Cisco would be part of VLAN 203 without the need for it to insert a VLAN TAG itself. On the other ports, VLAN 203 (and a few more) get a VLAN header. However, not exactly like a trunk port where all packets have a VLAN header: regular traffic to/from the internet goes out on these same ports untagged.
Mixed tagged/untagged ports turned out to be unsupported by the Atheros 8327 chip that powers the switch ports. What you can do is have one or more access ports and one or more trunk ports. This is already somewhat complex. The access ports need to be set up with a default VLAN. (Under "switch" and then "ports".) Makes sense. In the documentation, it says to use add-if-missing will add a VLAN header if there isn't one. Makes sense. However, it turns out that you need to do this on the outgoing port, i.e., not the access port itself, but the trunk port(s) that are part of the same VLAN. However, then (with a slight delay?) untagged traffic from the default VLAN won't work anymore.
The good news is that even though the hardware can't have mixed ports, the software can. So remove those settings above, and go to the bridge section of the configuration instead. There, select your bridge instance and turn on VLAN filtering. After that, you can go to the VLAN tab an add one or more VLANs there, where you can specify which ports should be tagged and untagged for that VLAN. So now we can have access ports and mixed ports. I do believe performance will be lower because VLAN traffic will need to be handled in software. Also not the PVID setting, which is the default VLAN untagged traffic. (1 out of the box.)
Unfortunately, the Mikrotik's IP addresses on the VLAN interface I tested with were now unreachable, and I couldn't figure out any settings to fix that. So after I was done with the Cisco 2503, I unchecked the "VLAN filtering" in the bridge settings... and the Mikrotek's IP addresses on VLAN interfaces came back to life.