SwOS Trunking, QoS and Layer 2 Security

What it is

SwOS offers a small set of Layer 2 features beyond VLANs: trunking, QoS and security controls.

All of them are set in the web interface, and all of them run in the switch chip. That means they work at wire speed, and also that the set of options is fixed. If a feature is not on a page, the device cannot do it.

This page covers the three groups in turn.

How it works

Each feature has a page, and the same ideas apply as on a RouterOS chip.

Port trunking

A trunk bundles several ports into one logical link.

Basic SwOS trunking is a static aggregation. You choose the member ports, and the switch spreads traffic across them with a hash of the addresses.

A static trunk has no negotiation, so the other end must be set up as a static group too. Some models and newer versions also offer LACP, so check the version.

Ports in a trunk must have the same speed and the same VLAN settings. A trunk is treated as one port by spanning tree.

QoS

SwOS can prioritise traffic and limit rates in hardware.

• Priority: the switch can read the 802.1p priority in the VLAN tag, or use a default priority for the port, and place traffic in a queue.
• Rate limits: each port can have an ingress limit and an egress limit.
• Flood limits: broadcast, unknown multicast and unknown unicast traffic can be limited, as a form of storm control.

The details come from the QoS chapter. The same rules apply here: priority matters only when a port is congested, and a rate limit is a single cap for the whole port.

Static hosts and port lock

The host table can restrict which devices may use a port.

You can add a static host entry, which ties a MAC address to a port. Some options let a port lock to the first address it learns, so that other addresses are refused.

These are simple port security tools. They are weaker than 802.1X, because a MAC address can be copied.

Port isolation and forwarding

Each port can have a list of the ports it may send to.

Limit a client port to forward only to the uplink, and clients cannot reach each other. This is the same idea as port isolation in RouterOS, and it runs in the chip. Leave the uplink open to every client.

Access control rules

The ACL page holds rules that match frames and act on them.

A rule can match MAC addresses, the Ethernet type, IP addresses, protocols and port numbers. The action can allow, drop or redirect, depending on the version. Rules are checked in order, and the table has a limited size, so use groups of addresses and not one rule per host.

Other controls

Several smaller switches complete the picture.

• Flood control: stop unknown unicast or multicast from leaving a port.
• Spanning tree: RSTP keeps redundant links safe, as the previous page described.
• Management limits: limit where management is allowed from, as the introduction page described.
• Mirroring: some models can copy traffic to a monitoring port.

SwOS has no firewall. Some features that RouterOS offers, such as DHCP snooping or 802.1X, are missing or limited, so check the model and version, and use RouterOS when you need more.

Checking

Verify each feature with a test.

1. Pull one cable of a trunk, and check that traffic continues on the other.
2. Test a rate limit with a transfer between two hosts.
3. Test an ACL by sending the traffic that it should block.
4. Test isolation by pinging between two client ports.