Mikrotik VLANs - CRS3XX Step by Step - Mikrotik Tutorial

Learn to configure VLANS on Mikrotik CSR3XX step by step.
The main VLAN setting is vlan-filtering which globally controls vlan-awareness and VLAN tag processing in the bridge.
#MikrotikTutorial #MikrotikVLANs #ConfigureVLANsMikrotik

[@TheNetworkTrip]

Have you configure VLANs on Mikrotik devices? Which switch models have you used?

[@carloscardoso8796]

Do you provide consultant services?

[@TheNetworkTrip]

@@carloscardoso8796 Hi Carlos, you can contact me from here: mikrotiktraining.ca/

[@trclamar]

Yes! I use CRS317, CRS305. I also use CCR2004, CCR1009 and RB760iGS (hex S). I also use some settings like Frame Types and Ingress Filtering. For blokcing the router the way it not route User Networks to Management VLAN it is possible to filter forward traffic going out through interface vlan-99, dropping it, and also add a rule to drop traffic incomming from interface that is not vlan-99 but is trying to go out via vlan-99? I think that whay if I forgot some user network, it will also work, is it right?

[@petruscoffee2251]

I used this config you teach on a mAP,RB433,RB2011 and a RB1200 (sort home network testlab) no firewall setup yet just want to get all under the belt first. Loved the vid helps alot

[@youtubegarbage4u]

can you please make a follow up video enabling for ipv6 as well? thanks

[@fedorpro2114]

In 30 minutes, I understood more than after watching a bunch of hours of training videos. thank you

[@TheNetworkTrip]

Great to hear!

[@tomaszzdunski6762]

I have exactly the same. Simple explanation how to do it well!

[@SamWhitlock]

Where the heck has this been all of my life?! Seriously this has cleared up so many things about how to actually DO this on Mikrotik gear!

[@TheNetworkTrip]

Thanks, Sam! 😄 Glad it helped clear things up for you!

[@gwarphy]

This is the clearest explanation of VLANS I have seen. Thank you for taking the time to do such a thorough job!

[@professionalnetworkingsolu146]

This is the best

[@OstJoker]

One of the best and clearest tutorials I saw at the Internet. I am system administrator of a network with a 500+ wired devices + 2000+ wireless devices. I have almost every mikrotik model in my network, from hap lite to a CRS317 (95 routers totally). VLANS on mikrotik devices are a really pain in the ass, to say truth. So many different ways to configure on different devices, its just blows my head.

[@drumer2142]

The best and most useful tutorial we are going to need for years to come !!!!

[@TheNetworkTrip]

Glad it was helpful!

[@tietark9745]

You are the greatest Mikrotik trainer I have come across in the past 15 years of using Mikrotik keep it up.

[@tomaszzdunski6762]

Just WOW! So simple explanation how to deal with Mikrotik VLANs, bridge and a specially adjusting inter-VLAN communication with firewall. EXCELLENT JOB! Thanks!

[@wrexs0ul]

Needed a quick refresher. You were #1 rated video. Gave me what I needed, thank you!

[@TheNetworkTrip]

Glad it was helpful!

[@oldschool1079]

this is the best Mikrotik VLan tutorial out there so far. Wish you would make more mikrotik video tutorials. Great stuff.

[@TheNetworkTrip]

Thanks, more to come!

[@JoseMiguelLMaria]

After many hours of watching youtube videos and reading tutorials about VLAN's and bridges, this is the first video that I was able to follow and make it all work. Thank you for the clearness of the explanation and the right pace for it. Thank you!

[@TheNetworkTrip]

Thank you Jose! I’m happy to hear that

[@johnlowry4927]

Great tutorial. The implementation of VLANs on Mikrotik have always confused me. this by far the clearest explanation I have found thus far.

[@TheNetworkTrip]

Thanks

[@lennyaltamura2009]

I"m also a Cisco guy, and purchased the CRS328 series a few years back. This is a complete and excellent guide for configuring VLANS on the Mikrotik CRS3XX. I'm using Port aggregation as well, and if you can create another video about that, I'm sure others besides myself would be ecstatic. Thank you for the informative guide. Job well done!

[@TheNetworkTrip]

You're welcome! Thank you for the suggestion, I will add a video about port aggregation!

[@blaise2628]

Excellent tutorial for Vlan setups using MikroTik equiptment. I have searched and watch many hours of tutorials on the subject from the web. I just couldn't get it but now because of your amazing video, I got it all working exactacly the way I want. I learned so much , thank you!!!

[@TheNetworkTrip]

Thanks a lot! 🙌 I'm glad the tutorial helped you get everything working perfectly.

[@josefkulhanek6287]

I looked for how to set up VLAN on Mikrotik devices, and this is in my opinion best guide ever. Explained step by step how to reach the goal.

[@adriendessemond9009]

Extremely useful, thank you so much for having shared this. I was searching around how to configure my Mikrotek (CRS-305) for several VLAN switch for hours and hours until I found your explanation... crystal clear. Now everything works as intended, solving a problem running for months. I followed your explanations, step by step et voila! If you want to play safe, detach the management interface (eth1 on CRS-305) from the bridge. After that, whatever mistake you do, you are not disconnected. Leave all 10G on the bridge.

[@TheNetworkTrip]

Thank you!

[@Cenedd]

Thanks for posting this; very useful for getting my head around a different vendor implementation. One gotcha I discovered - in case it's useful for others - is that at 13:24 if you add the bridge interface as untagged for the management vlan instead of tagged, the IP address you assign to the Interfaces/Vlan interface is not reachable and when you then turn on vlan-filtering on the bridge, you lose all access to the device and (unless you have a serial cable) have to factory reset it by holding down the reset button until the "user" light flashes while turning on the box. If you assign an IP to a physical interface, it gives you a backup way to access it while you're testing this. You can remove it once you know the proper IP is accessible.

[@nicramtimzs6245]

You can still MAC telnet in that scenario: wiki.mikrotik.com/wiki/MAC_access

[@Cenedd]

@@nicramtimzs6245 Thanks, that's really helpful to know. Looks like WinBox can connect similarly - as long as MAC Winbox Server hasn't been disabled.

[@guitarheroepicfail]

Your scenario can work but you are missing a step. The same as settings an access port, if you set a port as untagged, you must also put a PVID on it. On the bridge itself, where you turn on VLAN Filtering, you can also set a PVID on the bridge itself.

[@TheNetworkTrip]

Hi Gareth, thank you for your comment. I've just checked the video but actually, the bridge is under the tagged section: kzbin.info/www/bejne/j33XeIR3hp2ciZI Completely agree with you about having one physical interface out of the bridge to avoid the risk of being locked out.

[@Cenedd]

@@TheNetworkTrip Sorry, didn't mean it to sound like I was saying that you'd done it wrong, just that *I* missed that step and locked myself out.

[@Dreamwoodinternational]

Sir, you have ended my search for the ultimate guide on how to configure my new RB4011 and CRS328 with VLANs!!! Subscribed and looking forward to all new material - after I watch all your other videos. Can't thank you enough. Greetings from Oz.

[@TheNetworkTrip]

Awesome, thank you!

[@firefly2472]

I have the same setup, lets see if i can do it to :)

[@Dreamwoodinternational]

@@firefly2472 I wish I could say I have been totally successful. To date, still don't have Vlans running. Still get caught up with the Management Lan settings because all network items already have an IP and are all operational.

[@firefly2472]

@@Dreamwoodinternational . Got them up and running... well kinda. Got everything on my desk to test, learn and do it again :)

[@Dreamwoodinternational]

@@firefly2472 Safest way to do it.

[@RobertSpan]

I´ve watched this tutorial everytime I setup a CRS now, each times helps to fresh up my memmory! Thanks :)

[@TheNetworkTrip]

Great to hear!

[@DonWon4725]

Thank you taking the time to explain how the Mikrotik 300 series works been scratching my head now for couple days trying to grasp concepts around how this switch handles VLANS, been watching variety of different videos which doesn't on this particular switch thanks once again.

[@TheNetworkTrip]

Glad to help!

[@sweatbandandy]

Easily the best tutorial for configuring VLANs on Mikrotik switches. I wish I'd found this video weeks ago.

[@TheNetworkTrip]

Glad you enjoyed it!

[@PM-mq6oc]

Thank you for your clear explanation about how MK works with inter-VLAN routing.

[@TheNetworkTrip]

Glad it was helpful!

[@GloriaNyarko-l4u]

Thanks, Mr. Wilmer Almazan you literally saved me my job. This video really helped me get my network up and running. I remember your 5 steps really well. Thanks alot.

[@TheNetworkTrip]

Glad it helped

[@DelioC]

13:40 is a very important detail. Add the bridge itself to the management vlan. The lack of this step was driving me crazy as the switch was acting very erratic. Thanks for this video.

[@TheNetworkTrip]

Great! That’s a critical step

[@massfrommars]

Your video is the most complete and accurate guide on this topic in youtube. I hope you publish more videos on related topics.

[@TheNetworkTrip]

Thank you, I will

[@michaelmauer1385]

Great and easy to follow and understand video on VLANs in the Mikrotik world.

[@TheNetworkTrip]

Glad it was helpful!

[@ericalarid9791]

Great explanation of VLANs I would like to see more!

[@TheNetworkTrip]

Hi Eric, more content coming soon

[@ntandonxumalo]

This is most useful knowledge that I was looking for, I wish I can like it 1000 times. Thank you so much for this content.❤

[@daxcor]

This was totally amazing. I have watched many vlan videos and this was the best. One question, I am struggling with the concept of what a bridge is and why we need it.

[@TheNetworkTrip]

Thanks! The bridge interface itself is used to manage the switch (it provides access to the CPU).

[@AIONizandoCR]

Muchas gracias por el video. Me salvó la tanda. NO sabía que había diferencia entre tener 1 o varios bridge, y tenía un uso de CPU de 100%. Siguiendo estas instrucciones pasé a 20% de uso CPU. Un tico por acá. Gracias mae!

[@pioneercable2760]

thank thank you very much, it's a big advantage for us to know this technics about vlan, for future expansion of our network i will apply this method .....thank you very much and more power😊😊😊😊👍👍👍👍👍👍

[@TheNetworkTrip]

Thank you!

[@Dilipbhambore]

Sir, I must say that this is the best of the best tutorial of Mikrotik VLAN I have ever seen. Using same scenario Could you please also let us know how we can assign an IP address to all the vlans on a CRS (not the management vlan) ?

[@TheNetworkTrip]

Thank you. If you want to perform routing, you can follow this tutorial: kzbin.info/www/bejne/mWPWcnRsn7Kdebs

[@ly3nml]

Thanks for the great tutorial. It would be great to talk about loopback protection and other steps that are used in practice when configuring access switches.

[@KasseBasses]

Thank you for a fantastic guide! I would have given you 10 bucks for this video if I could.

[@TheNetworkTrip]

Thank you! It’s a pleasure

[@AndreasTriller]

Danke!

[@TheNetworkTrip]

Thank you very much

[@Nando_Nandes]

Best, amazing and only one Who taught something that really worked for what i need

[@TheNetworkTrip]

Thank you, I'm glad it helped!!

[@eldioni52]

Buen trabajo Wilmer, es un orgullo tener trainers hispanos que apuesten por el mercado inglés también. 👍👍🇵🇦

[@TheNetworkTrip]

Muchas gracias, saludos, un placer

[@DonWon4725]

Extending my thanks for explaining VLAN configurations this makes sense tried many other tutorials from youtube this one works the best everyone all other are complete jokes.

[@TheNetworkTrip]

Glad it helped!

[@MJP-ruoka]

Thank you a lot! This video helped me to understand how make trunk ports from webfig/winbox on my crs310s.

[@TheNetworkTrip]

Glad it helped!

[@Gowan08]

Hey All, I loved this guide, it was truly the best, but its missing some context. The issue they wasn't obvious is that he is using native VLAN 1 in his VLAN filtering. This caused me a huge issue. The default VLAN wasn't allowed on router where I had the CRS310 ethernet 1 port plugged into. VLAN1 is the default on the MikroTik and was causing the switch to respond on the management port only, but not allow communication to any other device. I noticed some of the VLAN IDs were excluded, but I ended up tagging my bridge port that was trunking VLANs to the PVID I needed. Thank you Wilmer for your expertise, I wouldn't have had a clue where to start.

[@eugeniogalan]

Great work Wilmer! very clear explanation. Thank you very much!

[@shaker8585]

Great job! Everything is very very clear now!

[@TheNetworkTrip]

Thanks! That’s great 😃

[@vitaliypro8441]

I just started watching and I really like your approach. You clearly stating what the plan is and doing it on the actual hardware. Subscribed and hoping you have more content

[@divinity176]

Just a quick point - if your device has a switch chip, you should be creating your VLANs there instead for full hardware speed. It is pretty easy to tell if you do, there is an extra menu item in the sidebar 'Switch', usually between 'PPP' and 'Mesh'.

[@TheNetworkTrip]

That’s correct. Most RBs have at least one switch chip, and we can use the switch menu as you mentioned before. Thank you!

[@alicewyan]

Just got here looking to properly understand VLANs the Mikrotik way, your channel is impressive! Do you have a video on how to configure VLANs in devices without a switch chip?

[@xinfo2728]

best VLAN video on mikrotik

[@TheNetworkTrip]

Thank you!

[@MrMaxi1968]

congratulations for the clarity of the toturial

[@TheNetworkTrip]

Thank you, glad to hear that

[@makeitcloudy]

this is it! straight to the point, thank you for your explanations. It works like a charm

[@TheNetworkTrip]

Thank you!!

[@DJAndomor]

Omg.. I think I got it 😅 best explanation on KZbin

[@TheNetworkTrip]

Great!

[@alex.username]

VERY elucidative and straightforward tutorial.

[@TheNetworkTrip]

Thank you Alex!

[@cyb0rg123]

Best tutorial ever ! I shall add info on improvement with this config (since now been using separate bridges and vlan interfaces - but crs326-24s-2q+ made maximum 320 mbit/s throughput till 100% cpu) i need to achieve at least 0,9 gbit/s throughput via vian/1gbit/s sfp

[@jurisbriol8770]

You are very proficient in your field.thank you for sharing.this helps a lot especially for people like me.

[@TheNetworkTrip]

Glad to help

[@corny291]

Thank you so much for your tutorial. The BEST!!

[@MatiasHuerta-q2s]

Master or the universe!!! Very good explain

[@TheNetworkTrip]

Wow, thanks!

[@bogorad]

Thank you so much! Mikrotik is soooo hard and counter-intuitive compared to OpenWRT's "switch" table :)

[@TheNetworkTrip]

Happy to help!

[@samukarbrj]

the best video on youtube found so far!

[@TheNetworkTrip]

Glad you enjoyed it

[@sixmaster800]

Gracias siempre tan preciso y profesional.

[@pawebrawanski7631]

Thanks for the video, I finally understood how to properly configure management vlan.

[@eliezerjerez]

Hola Wilmer, excelente tutorial, funciona perfectamente, solamente tuve un detalle al querer conectar dos switches (1 CRS328 y 1 CSS326) funcionan bien sobre puertos ethernet, pero no así en SFP+ (jumper, hay alguna configuración extra para poder hacer que funcionen sobre SFP+, saludos y gracias por los tutoriales que verdaderamente funcionan.

[@blaise2628]

Mr. Almazan, I know you turned on filtering for the two switches after configuring and testing. But what about the router, should it have it's filtering turned on or leave it off? Thank you, again for such a great step-by-step vlan tutorial using the MikroTiks GUI.

[@TheNetworkTrip]

Hello! Thank you. There is no need to enable it on the router because there is only one interface with VLAN sub-interfaces.

[@sergeybazenov]

Great video! The best explanation I've seen! I have a question. What do you use as a PC emulator?

[@TILZ-body]

wow good and clear explanation, thanks sir

[@JasonsLabVideos]

Really easy to follow and good explanation of your process !1 Good work !! Love it !

[@TheNetworkTrip]

Thank you very much!

[@Sam-dn4wb]

Very well explained sir! I would like to request OSPF+Vlan.. hope to include this in your videos

[@TheNetworkTrip]

Thanks Erza, OSPF coming soon.

[@ronaldhaley6169]

@@TheNetworkTrip Still waiting:)

[@ezequielbohuaben6900]

@@TheNetworkTrip Still waiting:) x2

[@javierjosevilcanina6834]

Good work, good explanation. Thanks a lot.

[@TheNetworkTrip]

Glad you liked it

[@willyfontana1]

It's a very good explanation and gives an excellent way to configure VLANs. I'm in the process of testing this in the case of a trunk (uplink or downlink from another switch) when there is a bonding interface of two ethernet ports. I hope this same schema works with bonding.

[@TheNetworkTrip]

Hi Guillermo, you can apply the same approach. Good luck!

[@willyfontana1]

@@TheNetworkTrip I did the lab yesterday and worked just fine. I simply put the bonding interface in the bridge instead of the ethernet interfaces forming the bonding. Thank you again for your explanation.

[@LenzoB]

Great Video, thank you sir. Was able to create 2 SSID's on mikrotik ap and assign vlan to both using same config as what you have shown in switch configuration. Much appreciated.

[@TheNetworkTrip]

Nice work!

[@JLubbers2]

Great tutorial. Please include the cli commands in summary.

[@symph760]

That would be perfect. Can also put them in description or link them somewhere for ease in copy pasting

[@coolaj86]

I had turned the volume up to hear your voice and then about died of a heart attack at the end with the super loud logo roll.

[@TheNetworkTrip]

Hello! I’m sorry about that. I will modify the video.

[@manueleorlandi5615]

Great Guide, thank you!

[@TheNetworkTrip]

Thank you

[@firefly2472]

Been playing a few hours today with a 4011 and a crs326. Got this working now. Now lets do all the other things :p (Lots of hours this take to learn :)

[@abdulkamalabduljalil9846]

Amazing Tutorial love it

[@TheNetworkTrip]

Thanks

[@SergeantTrigger]

crystal clear! thanks.

[@kaltek797]

Good video - I have linked to this from one of my own Mikrotik videos.

[@Anavllama]

For the CRS part starting at minute 8:00 and filling in the /bridge port values, this is the time to enter in frame types admit priority and untagged and also to check ingress filtering.

[@TheNetworkTrip]

Hello, thank you. That’s correct 👍🏻

[@netnutmike]

Great video that explains the complete setup process. Do you have a video about configuring a RB2011 with the 2 switch chips, and connecting router to vlans and connecting the vlans between the 2 switch chips? I cannot find a good video on how properly configure with the switch chips, CPU for ip access and cross chip vlan communication.

[@TheNetworkTrip]

Hi Mike, I will upload one video soon related to your suggestion

[@symph760]

I have really struggled with this one for quite sometime. Looking forward to that video

[@AkrobatkaAla-sf9ej]

Respect...You are good teacher ;)

[@TheNetworkTrip]

Thank you! 😃

[@velkejkoren]

Superb stuff man thank you this is exactly what I needed

[@faiyazmahdi631]

I just loved your way of explanation.. please do a lab on BGP Routing with multiple routing

[@AdityaSharma-w4j]

This is a very good tutorial on VLANs on Mikrotik CR3XXX series. If you can help me please, I want to configure CRS3XXX switch so that its not Router-on-a-stick rather Inter VLAN routing in switch itself.

[@TheNetworkTrip]

Hello! You can follow this video where I explain how to use it as a layer 3 device kzbin.info/www/bejne/mWPWcnRsn7Kdebs

[@michalm68]

Thank you very much. I needed it very much! Excellent explanation!

[@TheNetworkTrip]

Great to hear!

[@Anavllama]

This is no different from how I setup the hex router as solely a switch, except I use ingress filtering and frame type delineations on the bridge ports.

[@TheNetworkTrip]

Hi! This method works with any RouterOS debice BUT hardware offloading will be supported only on CRS3XX, CRS5xx and CCR2XXX

[@Anavllama]

@@TheNetworkTrip Thanks for the clarification. Just got a 310 to play with.

[@shokowillard]

Brilliant video, well done. Please may you do a Video on Capsman and Vlans, and another on Router Vlan configuration

[@TheNetworkTrip]

Great suggestion!

[@_beyondcode]

To clarify 8:30: It's not just inefficient, but rather it disable hardware offloading. (inefficient is absolutely the correct word, but native English speakers use it much more casually) Also: Using the CLI makes this absolute cake.

[@TheNetworkTrip]

Thank you!!

[@rubengonzalez2484]

excellent video. What software are you using to simulate or test the network?

[@TheNetworkTrip]

Hello! I’m using the Web GUI available on GNS3 VM

[@NevaranUniverse]

Perfect explanation. But question, what would Ingress Filtering in the bridge interface do? Would it just improve security a bit more?

[@midafricam]

Excellent and well explained

[@sistemastigasermx5607]

Hola Wilmer, escelente informacion muchas gracias por compartir. quisiera preguntarte, si estoy usando el PVID=1 del Bridge como vlan de administracion desde un Router, el proceso de configuracion en el CRS1XX cambia algo??

[@chrislane5670]

Great video, very helpful as new to Mikrotik ~ with if your tagging above MGT, but i also need a vlan tagged and untagged, does that additional vlan tag need to point to Bridge as well, obvious to the interface?

[@TheNetworkTrip]

Hello Chris, Only the management vlan must point to the bridge interface.

[@chrislane5670]

​@@TheNetworkTrip Interesting , so in my case, using vlan 99 like u for managment. But i also use vlan 50 for Internet that will be tagged out same port as management but untagged out another port. your saying for my vlan 50 i do Not need to tag the bridge as well as "uplink" tagged port?

[@TheNetworkTrip]

If you are simply sending the VLAN 50 through the switch, you don't need to include the bridge interface. That would be required only if the routing will be performed by the switch (layer 3 switch).

[@chrislane5670]

@@TheNetworkTrip Thank you

[@huxkiriye]

Wow awesome lessons

[@TheNetworkTrip]

Thank you!!

[@1288robert]

Qué modelo de laptop utilizas para virtualizar o que modelo recomendarías? Escritorio o laptop? Cual recomiendas utilizar SwitchOS o RouterOS cuál consideras más estable? En mi opinión RouterOS es más estable que SwitchOS. Buen video 👌 buena idea hacer este tipo de tutoriales ya que Mikrotik se complica mucho para configurar vlan a diferencia de otros fabricantes.

[@campilloalarcon4160]

buenos días maestro , muchas gracias por la información avanzada y explicaciones respecto del uso de vlans en mikrotik, hace un tiempo se me presenta un problema con los crs 317 , que se enlazan entre si con trunk de fibra a 10Gb, en el mismo switch tengo modulos sfp de cobre de 10Gb y de 1 Gb , al funcionar enambos extremos con swos , presentan link paused interrumpiendo las conexiones, a que puede deberse este problema? existe alguna limitacion conocida respecto al buffer cuando se utilizan modulos de diferente tipo 10G y 1G? gracias

[@TheNetworkTrip]

Hola! Lo ideal es que coloque la velocidad manualmente (1Gbps Full Duplex) y asi evita problemas de negociacion e interrupciones de trafico.

[@benny532017]

Superb vid, thanks man!

[@TheNetworkTrip]

Glad you liked it!

[@davidv1106]

Thank you for this video!

[@lazarkebic4869]

Great video!! tnx man! This video finaly clear up so much in my head :)

[@fernando_roman]

de lo mejor q vi. Gracias

[@addario2]

Very useful video! Many thanx for uploading! :)

[@YordyEscalona-w8w]

Gracias amigo me costó un poco porque no conseguí tutorial en español

[@LuisAngelChacon]

excelente video, gracias inge

[@TheNetworkTrip]

Gracias, un placer

[@salducci]

Hi! Congrats for the clarity & the professionalism of this video. Maybe a stupid question: is it possible to make "CRS326-1" perform the "Router" tasks (so merging those 2 devices)? At first sight, it is difficult since a vlan interface must be dedicated to a single port so it could be limitative...

[@TheNetworkTrip]

HI Alexandre, thank you. The CRS can be use for routing if the traffic is below 400Mbps. I won't recommend a CRS device in an environment with hundreds of users and high throughput. You can get an idea about the performance in the tests shown here: mikrotik.com/product/crs326_24s_2q_rm#fndtn-testresults