New Switch (SwOS)

MikroTik CSS series switches (and CRS series dual-booted into switch-mode) run an operating system called SwOS. Unlike RouterOS, SwOS does not have a CLI and cannot be accessed via WinBox. It is managed entirely through a web browser.

Required Information

Before you begin, map out your VLAN plan:

• Management IP address. (By default, SwOS listens on 192.168.88.1).
• Access Ports: Which physical ports will belong to which VLANs (untagged).
• Trunk Ports: Which physical ports will carry multiple VLANs (tagged) to other switches or routers.

1. Initial Access

1. Connect your computer to any port on the switch.
2. Assign your computer a static IP address in the 192.168.88.x/24 range (e.g., 192.168.88.2).
3. Open a web browser and navigate to http://192.168.88.1.
4. Log in with the default username: admin and leave the password blank.

2. System Configuration & Password

It is critical to secure the switch before putting it into production.

1. Go to the System tab.
2. In the Identity field, enter a name for your switch (e.g., Core-Switch).
3. In the Password section at the bottom, enter a strong password in New Password and Confirm Password.
4. Set the IP Address to the intended static management IP for your network.
5. Click Apply All.

Note: If you changed the IP address, your browser will lose connection. Reconfigure your computer’s IP address to match the new subnet if necessary, and navigate to the new IP address.

3. Configure the VLAN Table

In SwOS, you must define which ports are allowed to participate in which VLANs.

1. Go to the VLANs tab.
2. Click Append.
3. Enter your VLAN ID (e.g., 10 for Sales).
4. Under the port columns (Port 1, Port 2, etc.), check the boxes for every port that needs this VLAN (both access and trunk ports!).
5. Repeat for all your VLANs (e.g., VLAN 20 for Guest).
6. Click Apply All.

4. Configure Port VLAN Settings (Tagged vs Untagged)

Now you must tell the switch how to handle the traffic on those ports (Access vs Trunk).

1. Go to the VLAN tab (singular).
2. For Trunk Ports (e.g., Port 1 connected to router):
   • VLAN Mode: strict (Only allow traffic defined in the VLANs tab).
   • VLAN Receive: only tagged (It should only receive tagged packets from the router).
   • Default VLAN ID: 1 (or leave default).
3. For Access Ports (e.g., Port 2 for a PC on VLAN 10):
   • VLAN Mode: strict.
   • VLAN Receive: only untagged (PCs send untagged packets).
   • Default VLAN ID: 10 (This tags incoming packets from the PC with VLAN 10).
   • Force VLAN ID: Check this box.
4. Click Apply All.

5. Verify Connectivity

1. Plug a PC into Port 2. Ensure it receives an IP address from the router’s VLAN 10 DHCP server.
2. Attempt to ping the router.
3. If traffic is not flowing, double-check that the port is checked in the VLANs tab and has the correct Default VLAN ID in the VLAN tab.