VLAN Segmentation on a Single Switch

Build a two-VLAN network on one switch, verify isolation, then diagnose a deliberately broken port.

Theory

VLANs allow us to take a single physical switch and carve it into multiple, isolated virtual switches. Devices in one VLAN cannot talk to devices in another VLAN without a router.

Topology & Design

One switch (MikroTik RouterOS 7 device acting as a switch)
Three connected PCs:
- PC 1: Port ether1
- PC 2: Port ether2
- PC 3: Port ether3
VLAN 10 (“staff”): PC 1 and PC 2
VLAN 20 (“guest”): PC 3

flowchart TD SW[Switch<br>bridge-lab] subgraph "VLAN 10 (PVID 10)" PC1[PC 1<br>10.0.0.1] PC2[PC 2<br>10.0.0.2] end subgraph "VLAN 20 (PVID 20)" PC3[PC 3<br>10.0.0.3] end SW ---|ether1| PC1 SW ---|ether2| PC2 SW ---|ether3| PC3

Note: There is no router providing IP addresses in this lab. We will manually assign static IPs to the PCs to verify connectivity.

Implementation

Let’s build the network. Connect to your MikroTik switch via WinBox (MAC address).

1. Create the bridge:

/interface bridge add name=bridge-lab vlan-filtering=no

2. Assign ports to the bridge with their PVIDs:

/interface bridge port add bridge=bridge-lab interface=ether1 pvid=10
/interface bridge port add bridge=bridge-lab interface=ether2 pvid=10
/interface bridge port add bridge=bridge-lab interface=ether3 pvid=20

3. Build the VLAN table:

/interface bridge vlan add bridge=bridge-lab untagged=ether1,ether2 vlan-ids=10
/interface bridge vlan add bridge=bridge-lab untagged=ether3 vlan-ids=20

4. Enable VLAN Filtering:

/interface bridge set bridge-lab vlan-filtering=yes

Verification

On your 3 PCs, manually configure the following static IPs:

PC 1: 10.0.0.1 / 255.255.255.0
PC 2: 10.0.0.2 / 255.255.255.0
PC 3: 10.0.0.3 / 255.255.255.0

Test isolation:

From PC 1, ping 10.0.0.2 (PC 2). It should succeed (Same VLAN).
From PC 1, ping 10.0.0.3 (PC 3). It should fail (Different VLAN, no router).
From PC 3, ping 10.0.0.2 (PC 2). It should fail.

Failure Injection

Now we will break the network. Run this command to deliberately misconfigure the switch:

/interface bridge port set [find interface=ether2] pvid=20

Troubleshooting

You get a ticket: “PC 2 cannot reach PC 1 anymore.”

Work the problem instead of guessing:

Confirm the symptom: From PC 2, try to ping 10.0.0.1. It fails.
Check link state: Ensure the cable on ether2 is plugged in and the port shows as running in WinBox.
Check the PVID: Look at the ports in the bridge.
```
/interface bridge port print
```
Ah! ether2 is set to PVID 20, but it should be 10!
Check the VLAN table:
```
/interface bridge vlan print
```
Notice that RouterOS might have automatically moved ether2 into the untagged list for VLAN 20 because of the PVID change.

Recovery

Correct ether2’s PVID back to 10:

/interface bridge port set [find interface=ether2] pvid=10

Re-verify connectivity between PC 1 and PC 2. The ping should immediately succeed.

Documentation

Write down what the symptom looked like (PC 2 could not reach PC 1), what the actual cause was (PVID mismatch on an access port), and how you confirmed it (/interface bridge port print). This process is what makes you a network engineer.