A VLAN is a logical grouping that allows end users to communicate as if they were physically connected to a single isolated LAN, independent of the physical configuration of the network. VLAN support adds a new dimension of security and cost savings permitting the sharing of a physical network while logically maintaining separation among unrelated users.
VLANs are simply a way of grouping a set of switch ports together so that they form a logical network, separate from any other such group. Within a single switch this is straightforward local configuration. When the VLAN extends over more than one switch, the inter-switch links have to become trunks, on which packets are tagged to indicate which VLAN they belong to.
You can use MikroTik RouterOS (as well as Cisco IOS and Linux) to mark these packets as well as to accept and route marked ones.
As VLAN works on OSI Layer 2, it can be used just as any other network interface without any restrictions. And VLAN successfully passes through ethernet bridges (for MikroTik RouterOS bridges you should set forward-protocols to ip, arp and other; for other bridges there should be analogical settings)
You can add a VLAN interface using the /interface vlan add command:
[admin@MikroTik] interface vlan> add
creates new item with specified property values.
arp
copy-from item number
disabled
interface
mtu
name
vlan-id
[admin@MikroTik] interface vlan> add name=test vlan-id=1 interface=ether1
[admin@MikroTik] interface vlan> print
Flags: X - disabled, R - running
# NAME MTU ARP VLAN-ID INTERFACE
0 X test 1500 enabled 1 ether1
[admin@MikroTik] interface vlan> enable 0
[admin@MikroTik] interface vlan> print
Flags: X - disabled, R - running
# NAME MTU ARP VLAN-ID INTERFACE
0 R test 1500 enabled 1 ether1
[admin@MikroTik] interface vlan>
Descriptions of settings:
name - Interface name for reference
mtu - mtu - Maximum Transmit Unit. Should be set to 1500 bytes as on ethernet interfaces. Note that this may not work with some ethernet cards that do not support receiving/transmitting of full size ethernet packets with VLAN header added (1500 bytes data + 4 bytes VLAN header + 14 bytes ethernet header). In this situation MTU 1496 can be used, but note that this will cause packet fragmentation if larger packets have to be sent over interface. At the same time remember that MTU 1496 may cause problems if path MTU discovery is not working properly between source and destination.
interface - physical interface to the network where are VLANs
arp - Address Resolution Protocol, one of the:vlan-id - Virtual LAN identificator or tag that is used to distinguish VLANs. Must be equal for all computers in one VLAN
- disabled - the interface will not use ARP protocol
- enabled - the interface will use ARP protocol
- proxy-arp - the interface will be an ARP proxy (see corresponding manual)
- reply-only - the interface will only reply to the requests originated to its own IP addresses, but neighbour MAC addresses will be gathered from /ip arp statically set table only.
Use /ip address add command to assign an IP address to the VLAN interface.
The bandwidth usage of the interface may be monitored with the monitor-traffic feature from the interface menu.
To connect computers through VLAN they must be connected physically and unique IP addresses should be assigned them so that they could ping each other. Then on each of them the VLAN interface should be created:
[admin@MikroTik] interface vlan> add name=test vlan-id=32 interface=ether1 [admin@MikroTik] interface vlan> print Flags: X - disabled, R - running # NAME MTU ARP VLAN-ID INTERFACE 0 R test 1500 enabled 32 ether1 [admin@MikroTik] interface vlan>If the interfaces were successefully created, both of them will be running. If computers are connected incorrectly (through network device that does not retransmit or forward VLAN packets), either both or one of the interfaces will not be running.
When the interface is running, IP addresses can be assigned to the VLAN interfaces.
On the Router 1:
[admin@MikroTik] ip address> add address=10.10.10.1/24 interface=test [admin@MikroTik] ip address> print Flags: X - disabled, I - invalid, D - dynamic # ADDRESS NETWORK BROADCAST INTERFACE 0 10.0.0.204/24 10.0.0.0 10.0.0.255 ether1 1 10.20.0.1/24 10.20.0.0 10.20.0.255 pc1 2 10.10.10.1/24 10.10.10.0 10.10.10.255 test [admin@MikroTik] ip address>On the Router 2:
[admin@MikroTik] ip address> add address=10.10.10.2/24 interface=test [admin@MikroTik] ip address> print Flags: X - disabled, I - invalid, D - dynamic # ADDRESS NETWORK BROADCAST INTERFACE 0 10.0.0.201/24 10.0.0.0 10.0.0.255 ether1 1 10.10.10.2/24 10.10.10.0 10.10.10.255 test [admin@MikroTik] ip address>If it set up correctly, then it is possible to ping Router 2 from Router 1 and vice versa:
[admin@MikroTik] ip address> /ping 10.10.10.1 10.10.10.1 64 byte pong: ttl=255 time=3 ms 10.10.10.1 64 byte pong: ttl=255 time=4 ms 10.10.10.1 64 byte pong: ttl=255 time=10 ms 10.10.10.1 64 byte pong: ttl=255 time=5 ms 4 packets transmitted, 4 packets received, 0% packet loss round-trip min/avg/max = 3/10.5/10 ms [admin@MikroTik] ip address> /ping 10.10.10.2 10.10.10.2 64 byte pong: ttl=255 time=10 ms 10.10.10.2 64 byte pong: ttl=255 time=11 ms 10.10.10.2 64 byte pong: ttl=255 time=10 ms 10.10.10.2 64 byte pong: ttl=255 time=13 ms 4 packets transmitted, 4 packets received, 0% packet loss round-trip min/avg/max = 10/11/13 ms [admin@MikroTik] ip address>
http://www.csd.uwo.ca/courses/CS457a/reports/handin/jpbojtos/A2/trunking.htm
http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121newft/121t/121t3/dtbridge.htm#xtocid114533
http://www.cisco.com/warp/public/473/27.html#tagging
http://www.cisco.com/warp/public/538/7.html
http://www.nwfusion.com/news/tech/2001/0305tech.html
http://www.intel.com/network/connectivity/resources/doc_library/tech_brief/virtual_lans.htm
This is a list of network interfaces on which VLAN was tested and worked, but WITHOUT LARGE PACKET (>1496 bytes) SUPPORT: