Learn.GTArsenals
Search

Quick Start

New Switch (MikroTik CRS)

Bring a factory-default MikroTik CRS switch into service with a management VLAN, VLAN filtering, and secured management access.

Objective Configure a factory-default MikroTik CRS switch with a management VLAN, VLAN-aware bridge, and access/trunk ports.
Device MikroTik CRS series (RouterOS 7)
Time 30-40 min

[!WARNING] RouterOS vs. SwOS This guide is for MikroTik CRS series switches running RouterOS (which allows management via WinBox and Terminal). If you are using a CSS series switch, or have booted your CRS into SwOS, you must use the web browser GUI instead, as SwOS does not support WinBox or CLI.

Required Information

Before you begin, map out your VLAN plan:

  • Management VLAN ID and IP address.
  • Access Ports: Which physical ports will belong to which VLANs (untagged).
  • Trunk Ports: Which physical ports will carry multiple VLANs (tagged) to other switches or routers.

Interactive Switch Configuration Generator

Use this tool to instantly generate a safe VLAN-aware bridge configuration. Copy or download the output and paste it into your MikroTik terminal.

Switch Parameters

Generated RouterOS CLI

1. Initial Access & Identity

Why: We must rename the switch for inventory and secure the admin account.

# Connect using the MAC address in WinBox/Terminal
/system identity set name="Core-Switch"
/user set admin password="YourStrongPasswordHere"
  1. Open WinBox and connect via MAC Address (Login: admin, Password: [blank]).
  2. Go to System → Identity and enter Core-Switch. Click OK.
  3. Go to System → Users, double-click admin, click Password, and set your strong password.

2. Create the Bridge and Add Ports

Why: In RouterOS, hardware switching and VLAN filtering happen on a Bridge interface. We add all switch ports to this bridge.

# Create the bridge. Do NOT enable vlan-filtering=yes yet!
/interface bridge add name=bridge1 vlan-filtering=no

# Add all ports to the bridge. 
# For access ports (e.g., ether2 for VLAN 10), set the PVID (Port VLAN ID) now.
/interface bridge port add bridge=bridge1 interface=ether1
/interface bridge port add bridge=bridge1 interface=ether2 pvid=10
/interface bridge port add bridge=bridge1 interface=ether3 pvid=20
  1. Go to Bridge → Bridge tab. Click [+] to add a new bridge. Name it bridge1. Leave VLAN Filtering unchecked. Click OK.
  2. Go to Bridge → Ports tab. Click [+] to add ports.
  3. Add ether1 to bridge1 (Trunk port, leave PVID at 1).
  4. Add ether2 to bridge1. Change PVID to 10.
  5. Add ether3 to bridge1. Change PVID to 20.

3. Configure the VLAN Table (Tagged vs Untagged)

Why: We must explicitly define which ports are allowed to carry which VLANs.

  • Tagged ports (Trunks) carry traffic with a VLAN ID attached. (e.g. ether1 uplinking to a router).
  • Untagged ports (Access) strip the VLAN ID before sending to a PC.
# Assuming VLAN 10 (Sales), VLAN 20 (Guest), and VLAN 99 (Management).
# ether1 is our Trunk (tagged) to the router.
# The 'bridge1' interface itself MUST be tagged for the Management VLAN so the switch can be managed!

/interface bridge vlan add bridge=bridge1 tagged=ether1,bridge1 vlan-ids=99
/interface bridge vlan add bridge=bridge1 tagged=ether1 untagged=ether2 vlan-ids=10
/interface bridge vlan add bridge=bridge1 tagged=ether1 untagged=ether3 vlan-ids=20
  1. Go to Bridge → VLANs tab. Click [+] to add a new VLAN.
  2. Set VLAN ID to 99. Add ether1 and bridge1 to the Tagged list. Click OK.
  3. Click [+] again. Set VLAN ID to 10. Add ether1 to Tagged and ether2 to Untagged.
  4. Click [+] again. Set VLAN ID to 20. Add ether1 to Tagged and ether3 to Untagged.

4. Management Interface and IP

Why: The switch itself needs an IP address to be managed, but it should only be accessible from the Management VLAN (99).

# Create the management VLAN interface ON the bridge
/interface vlan add interface=bridge1 name=vlan99-mgmt vlan-id=99

# Assign an IP address to it
/ip address add address=10.99.99.2/24 interface=vlan99-mgmt

# Point a default route to your router so you can update/manage it from other subnets
/ip route add dst-address=0.0.0.0/0 gateway=10.99.99.1
  1. Go to Interfaces → VLAN tab. Click [+]. Name: vlan99-mgmt, VLAN ID: 99, Interface: bridge1. Click OK.
  2. Go to IP → Addresses. Click [+]. Address: 10.99.99.2/24, Interface: vlan99-mgmt. Click OK.
  3. Go to IP → Routes. Click [+]. Dst. Address: 0.0.0.0/0, Gateway: 10.99.99.1. Click OK.

5. Enable VLAN Filtering (The Point of No Return)

Why: Activating VLAN filtering tells the switch to actually enforce the rules we just built.

Warning: Do not enable VLAN filtering until your VLAN table is configured and the bridge1 interface is tagged on the management VLAN, otherwise you will lose access.

/interface bridge set bridge1 vlan-filtering=yes
  1. Go to Bridge → Bridge tab.
  2. Double-click bridge1. Go to the VLAN tab inside the bridge window.
  3. Check VLAN Filtering. Click OK. (You may get disconnected for a few seconds).

Verification

  1. Test Access Ports: Plug a laptop into ether2. Check if it receives a DHCP IP for VLAN 10 from the router.
  2. Test Isolation: A device on ether2 (VLAN 10) should not be able to communicate directly at Layer 2 with a device on ether3 (VLAN 20).
  3. Test Management: Attempt to WinBox or SSH into 10.99.99.2 from a computer on the Management VLAN.

Common Failures

  • Locked Out!: You enabled vlan-filtering=yes before ensuring bridge1 (the CPU) was included in the tagged= list for your Management VLAN. (Solution: MAC Telnet from a directly connected device or Factory Reset).
  • PVID mismatch: Leaving an access port’s PVID at the default (1), but trying to send untagged traffic for VLAN 10. The switch will drop the traffic.
  • Trunk port missing VLANs: Forgetting to add ether1 to the tagged= list for a newly created VLAN.

Production Notes

  • Export the configuration /export file=switch-base and save the .rsc file securely.
  • Ensure Spanning Tree Protocol (RSTP/MSTP) is left enabled on the bridge to prevent broadcast storms if someone loops a cable.