VLAN Connectivity Failure

Diagnosing why devices in the same or different VLANs can't reach each other.

• troubleshooting
• vlans
• switching

VLAN issues usually come down to a mismatch between what a port is doing (tagging vs untagging) and what the device connected to it expects.

1. Confirm the PVID on each access port

The single most common VLAN failure is an access port left on the default PVID (1) instead of the intended VLAN. If an end-device (like a PC) plugs into ether2 for VLAN 20, the switch must untag traffic to it and tag traffic from it with PVID 20.

WinBox Check: Go to Bridge -> Ports tab. Check the PVID column for your access ports.

CLI Check:

/interface bridge port print
# Look at the 'PVID' column for the interface in question.

2. Confirm Tagged vs. Untagged in the VLAN Table

A trunk port needs to carry the right VLANs tagged. If a VLAN is missing from a trunk’s tagged list, devices on that VLAN elsewhere in the network become unreachable across that trunk. Similarly, access ports must be in the untagged list for their respective VLANs.

WinBox Check: Go to Bridge -> VLANs tab. Look at the Tagged and Untagged columns for your VLAN IDs.

CLI Check:

/interface bridge vlan print
# Verify that the uplink port (e.g., ether1) is in the "tagged" list for all required VLANs.
# Verify that the bridge itself is tagged for any VLANs that the router/switch needs to interface with directly (e.g., Management).

3. Confirm VLAN Filtering is Actually Enabled

On a MikroTik bridge, building the VLAN table does nothing to isolate traffic unless VLAN filtering is explicitly enabled.

CLI Check:

/interface bridge print
# Look for 'vlan-filtering=yes'

Warning: Do not blindly enable this if you are managing the switch on the same bridge without proper management VLAN tagging, as you will lock yourself out.

4. Are they in the SAME VLAN across switches?

Two devices in the same VLAN but on different switches need a correctly configured trunk between those switches.

• Are both sides of the trunk link set to tagged for that VLAN ID?
• Are both ports up and passing traffic?

5. Are they in DIFFERENT VLANs? (Inter-VLAN Routing)

Two devices in different VLANs will never reach each other through switching alone — they require a router (Inter-VLAN routing).

If PC 1 (VLAN 10) cannot ping PC 2 (VLAN 20):

1. Check the Gateway: Does each PC have the correct default gateway? (Usually the router’s IP on that VLAN).
2. Check the Router’s VLAN Interfaces: Does the router have a VLAN interface configured for both VLANs?

   /interface vlan print
   

3. Check Firewall Forwarding: Is the router’s firewall blocking traffic between the two subnets?

   /ip firewall filter print
   # Look for drop rules in the 'forward' chain.