VLANs on the Switch Chip of a RouterBOARD

What it is

Many RouterBOARD models contain a switch chip that forwards frames between Ethernet ports in hardware.

Traffic that stays inside the chip does not use the CPU, so it runs at wire speed. The CPU is only involved for traffic that must be routed, filtered or otherwise processed by RouterOS.

The chip can also handle VLANs, so ports can be separated into VLANs without loading the CPU.

How it works

Ports on the same chip are switched in hardware, and a configuration decides how VLAN tags are handled.

Which chip a port belongs to

Each model has one or more switch chips, and each chip serves a group of ports. A port on a different chip, or one that is not connected to a chip at all, cannot be switched in hardware with the others.

The chip is connected to the CPU through an internal port. In the switch menu this appears as a CPU port, so the router itself can take part in a VLAN.

/interface ethernet switch print
/interface ethernet switch port print

Two ways to configure it

RouterOS has a long history of two methods for VLANs on a switch chip. The method you use depends on the model and the RouterOS version.

In older RouterOS v6 versions, a slave port was joined to a master port with master-port. Since v6.41, the recommended way is a bridge, and the bridge uses hardware offload when the chip allows it.

Not every chip can offload bridge VLAN filtering. On such devices, enabling VLAN filtering on the bridge may move forwarding to the CPU, and the speed drops.

The switch menu settings

In the switch menu, a VLAN table lists which ports belong to which VLAN, and each port has settings for VLAN handling.

/interface ethernet switch vlan add switch=switch1 vlan-id=10 ports=ether3,ether2,switch1-cpu
/interface ethernet switch port set ether3 vlan-mode=secure vlan-header=always-strip default-vlan-id=10
/interface ethernet switch port set ether2 vlan-mode=secure vlan-header=add-if-missing

The table entry says that VLAN 10 exists on ether3, ether2 and the CPU port. The port settings then control how frames enter and leave.

An access port strips the tag on the way out, with always-strip, and gives untagged frames the default VLAN. A trunk port keeps the tag, using add-if-missing.

The CPU port

For the router to have an address in a VLAN, the CPU port must be a member of the VLAN table entry. Without it, hosts cannot reach the router in that VLAN, even though they can reach each other.

Bridge hardware offload

With the bridge method, you create a bridge, add the ports, and RouterOS programs the chip for you.

/interface bridge add name=bridge1
/interface bridge port add bridge=bridge1 interface=ether3 pvid=10
/interface bridge port print

The port list shows whether a port is offloaded to hardware, by a flag in the print. If a feature forces software handling, the flag is absent.

Choosing between the methods

Use the bridge method on current RouterOS when your hardware supports it. Use the switch menu on models and versions where the documentation tells you to. Do not configure the same ports with both methods.

Verifying

/interface ethernet switch vlan print
/interface bridge port print
/interface print stats