SwOS · Topic 2 of 3
SwOS VLANs and RSTP
Configure VLANs in SwOS with the per port VLAN mode, VLAN receive, default VLAN ID and the VLAN table, and enable RSTP to prevent loops on a SwOS switch.
- 5 min
- SwOS VLANs use per port settings and a VLAN table.
- The default VLAN ID gives untagged frames their VLAN.
- VLAN receive can be any, only tagged or only untagged.
What it is
SwOS handles VLANs and spanning tree with two sets of web pages, one for ports and one for the VLAN table.
The ideas are the same as on a RouterOS switch chip. A port setting classifies each frame, and the VLAN table says which ports belong to each VLAN. Spanning tree is a separate page that keeps redundant links free of loops.
If you understand the chip VLAN model from the VLAN chapter, SwOS will look familiar.
How it works
Configure the port settings first, then the VLAN table, and enable the strict mode last.
Per port VLAN settings
Each port has a small group of VLAN options.
| Option | Role |
|---|---|
| VLAN mode | How strictly the VLAN table is applied |
| VLAN receive | Which frames the port accepts: any, only tagged, or only untagged |
| Default VLAN ID | The VLAN of untagged frames received on the port |
| Force VLAN ID | Puts all frames in the default VLAN, whatever tag they carry |
| VLAN header | Whether to leave, strip or add the tag on egress |
The VLAN mode has four levels, from disabled to strict. The levels range from ignoring the table to dropping any frame that the table does not allow. They work like the chip VLAN modes in RouterOS.
Access and trunk ports
An access port accepts untagged frames and sends them out untagged.
For an access port in VLAN 10, set the default VLAN ID to 10. Set the receive option to only untagged, and use a strict VLAN mode. Set the header option so that the tag is removed on the way out.
A trunk port keeps tags.
For a trunk, set the receive option to only tagged, and the header option to add the tag if it is missing. Do not use a default VLAN on a trunk unless you want untagged frames to join that VLAN on purpose.
The VLAN table
The VLAN table lists each VLAN and its member ports.
Add one row per VLAN, with the VLAN ID and a tick for every port that may carry it. Include the trunk port in every row. A frame can only leave through a port that is a member of its VLAN.
For the management address, the switch itself must be a member of the VLAN. Check that the management VLAN is in the table, and that your own port is a member, before you make the mode strict.
A strict VLAN mode with an incomplete table can cut off your own management access. Keep a second path in, and apply the strict mode last.
Independent VLAN lookup
Some switches offer a choice about how MAC learning works with VLANs.
With a shared lookup, one MAC table serves all VLANs. With an independent lookup, each VLAN has its own table, so the same MAC address can exist in two VLANs. Use the independent mode when the same device appears in several VLANs.
RSTP in SwOS
SwOS can run the rapid spanning tree protocol on its ports.
You enable it for the switch and set the options for each port. The page shows the root bridge, the role of each port and its state. Bridge priority and port cost steer which switch becomes the root and which links carry traffic.
The principles are those of the Spanning Tree chapter.
- The lowest bridge ID becomes the root.
- Each other switch finds the lowest cost path to the root.
- Redundant ports are blocked until needed.
SwOS speaks RSTP, and it works with neighbours that run STP or RSTP. Check the version for any further protocols.
Edge ports and protection
Ports that face end devices should not wait for spanning tree to settle.
Mark them as edge ports where the page offers it. Ports towards other switches are normal ports. A bridge priority that you set yourself on the intended root avoids the root being decided by chance.
Checking
Use the pages that show status.
- The VLAN pages show the settings.
- The spanning tree page shows the root, the roles and the states.
- The host page shows which VLAN each learned address belongs to.
After you set a VLAN, connect a test host to the access port, and check that the host page shows its address in the expected VLAN.
What to remember for the exam
Seven facts cover most questions on this topic.
- SwOS VLANs use per port settings and a VLAN table.
- The default VLAN ID gives untagged frames their VLAN.
- VLAN receive can be any, only tagged or only untagged.
- The VLAN header option leaves, strips or adds the tag on egress.
- The VLAN mode runs from disabled to strict.
- Trunk ports must be members of every VLAN they carry.
- SwOS runs RSTP, with root, port role and state visible on its page.
Common mistakes
These four mistakes appear often.
Using strict mode before the table is complete. Frames are dropped, and management access is lost.
Leaving the trunk out of a VLAN row. Tagged frames for that VLAN cannot cross the trunk.
Setting a default VLAN on a trunk by accident. Untagged frames then join that VLAN.
Leaving the root to chance. An old switch may become the root of the spanning tree.
Check yourself
Work through these three questions.
Which option gives untagged frames their VLAN on a SwOS port?
The default VLAN ID of the port.
Why must a trunk port be ticked in every VLAN row?
A frame can leave only through a port that is a member of its VLAN.
Which spanning tree protocol does SwOS run?
RSTP.
Topic 2 of 3 in SwOS
Test yourself on SwOS
The full MikroTik MTCSWE question bank has 484 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.