VPN and VLANs · Topic 6 of 7
VLANs with a Managed Switch
Learn how a RouterOS router and a managed switch share VLANs over a trunk, with router on a stick routing, access ports and matching tagged settings.
- 5 min
- A managed switch separates hosts into VLANs and tags the uplink.
- The router holds one VLAN interface per VLAN on the trunk port.
- Traffic between VLANs is routed by the router, not by the switch.
What it is
A managed switch carries several VLANs to a router over one trunk, and the router routes between them.
The switch places each host port into a VLAN and tags the frames on the uplink. The router receives all VLANs on one cable and holds a VLAN interface for each.
This design is called router on a stick. It lets one physical port serve many networks.
How it works
Both devices must agree on which VLAN IDs exist and which ports carry them tagged.
Roles of each device
| Device | Job |
|---|---|
| Managed switch | Assigns host ports to VLANs, tags frames on the trunk |
| Router | Terminates each VLAN, routes between VLANs, applies the firewall |
The switch does Layer 2 forwarding inside each VLAN. It never forwards traffic from one VLAN to another. The router does that, because that is routing.
Router configuration
On the router, create one VLAN interface per VLAN on the trunk port. Give each one the gateway address of its network.
/interface vlan add name=vlan10 vlan-id=10 interface=ether2
/interface vlan add name=vlan20 vlan-id=20 interface=ether2
/ip address add address=192.168.10.1/24 interface=vlan10
/ip address add address=192.168.20.1/24 interface=vlan20Hosts in VLAN 10 use 192.168.10.1 as their default gateway. Traffic from VLAN 10 to VLAN 20 goes up to the router, is routed, and comes back down the same cable with the other tag.
Services such as DHCP are usually attached to each VLAN interface, so every VLAN has its own address pool.
Switch configuration
On the managed switch, three things are set for each VLAN.
- The VLAN exists in the switch VLAN table.
- The host ports are access ports, untagged in that VLAN.
- The uplink port is tagged in every VLAN that the router should see.
The same IDs must be used on both sides. If the switch tags VLAN 10 and the router has no VLAN 10 interface, the frames are dropped.
Untagged traffic on the trunk
A trunk can also carry one VLAN without a tag. On the switch this is called the native or untagged VLAN. On the router, untagged frames belong to the physical interface itself, with no VLAN interface involved.
Both sides must agree on which VLAN is untagged. A mismatch moves traffic into the wrong network. Many designs avoid the problem by tagging every VLAN on the trunk.
A RouterOS device as the managed switch
A MikroTik device can be the switch too. The ports go in a bridge with VLAN filtering, as shown in the earlier VLAN page.
/interface bridge port add bridge=bridge1 interface=ether3 pvid=10
/interface bridge port add bridge=bridge1 interface=ether4 pvid=20
/interface bridge vlan add bridge=bridge1 tagged=ether2 untagged=ether3 vlan-ids=10
/interface bridge vlan add bridge=bridge1 tagged=ether2 untagged=ether4 vlan-ids=20Ports ether3 and ether4 are access ports for VLAN 10 and VLAN 20. The port ether2 is the trunk that leads to the router, and it carries both VLANs tagged.
Management access
Keep the management address in its own VLAN, not in a user VLAN. Then a user host cannot reach the switch just by being on the same network.
Be careful when changing the management VLAN on a remote device. A wrong change cuts the connection, and you lose access until someone is on site.
Verifying
/interface vlan print
/ip address print
/interface bridge vlan print
/ping 192.168.10.1From a host in each VLAN, ping its gateway first, then a host in the other VLAN. A failure at the first ping points to the switch side, and a failure at the second points to routing or the firewall.
Test in this order: host to gateway, gateway to other VLAN, then the internet. The first failure shows where to look.
What to remember for the exam
Seven facts cover most questions on this topic.
- A managed switch separates hosts into VLANs and tags the uplink.
- The router holds one VLAN interface per VLAN on the trunk port.
- Traffic between VLANs is routed by the router, not by the switch.
- VLAN IDs must match on the switch and on the router.
- The uplink is tagged in every VLAN the router needs.
- Untagged frames on the trunk belong to the physical interface of the router.
- Both ends must agree on which VLAN, if any, is untagged.
Changing the VLAN of the management port on a remote device can cut you off. Plan a way back before you apply it.
Common mistakes
These four errors appear often.
Tagging a VLAN on the switch that the router does not know. The router has no interface for that tag, so it drops the frames.
Leaving the uplink untagged for a VLAN. The VLAN joins the untagged traffic of the trunk and lands in the wrong network.
Forgetting the gateway address. The VLAN interface exists, but without an address hosts have no gateway.
Expecting the switch to route between VLANs. A Layer 2 switch separates VLANs and does not connect them.
Check yourself
Work through these three questions.
What does the router need for each VLAN on a trunk in router on a stick?
It needs a VLAN interface with the matching
vlan-idon the trunk port. The interface carries the gateway address.Who routes between VLAN 10 and VLAN 20?
The router does, because the switch only forwards inside each VLAN. The traffic goes up the trunk and returns with the other tag.
What goes wrong if the switch and the router disagree on the untagged VLAN?
Frames arrive in the wrong network, because untagged frames belong to the interface itself. Both ends must agree on which VLAN is untagged.
Topic 6 of 7 in VPN and VLANs
Test yourself on VPN and VLANs
The full MikroTik MTCRE question bank has 417 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.