VLANs · Topic 3 of 6

Port Based VLAN in Basic Switch Chips

Configure port based VLANs in the switch chip menu of RouterBOARD and CRS devices using the VLAN table, vlan-mode, vlan-header and default VLAN ID.

4 min

In a nutshell

Chip VLANs are set in the /interface ethernet switch menus.
The VLAN table lists the member ports of each VLAN ID.
default-vlan-id gives untagged frames their VLAN.

What it is

Some MikroTik devices keep VLAN rules inside the switch chip, and you set them in the /interface ethernet switch menus.

This is different from the bridge. The chip holds a VLAN table that lists which ports belong to which VLAN, and per port settings that decide how tags are added, kept or removed. Forwarding follows the table at wire speed.

The method applies to chips that expose this menu, such as basic chips on small RouterBOARDs and the CRS1xx and CRS2xx series. Models differ, so check what a given device supports.

How it works

Port settings classify each frame, and the VLAN table decides where it may go.

The VLAN table

Each VLAN gets a row that lists its member ports and its ID.

/interface ethernet switch vlan add vlan-id=10 ports=ether2,ether3,ether1
/interface ethernet switch vlan add vlan-id=20 ports=ether4,ether5,ether1
/interface ethernet switch vlan print

Here ether1 is a trunk that belongs to both VLANs. The other ports are access ports of one VLAN each. To let the router itself take part in a VLAN, add the CPU port of the switch to the member list.

Port settings

Three port properties control the tags.

Property	Role
`default-vlan-id`	The VLAN given to untagged frames on this port
`vlan-header`	What to do with the tag when a frame leaves
`vlan-mode`	How strictly the VLAN table is applied

The vlan-header choices matter most:

always-strip removes the tag on egress. It is used on access ports.
add-if-missing adds a tag if the frame has none. It is used on trunk ports.
leave-as-is does not change the frame.

Access and trunk configuration

/interface ethernet switch port set ether2 vlan-mode=secure vlan-header=always-strip default-vlan-id=10
/interface ethernet switch port set ether1 vlan-mode=secure vlan-header=add-if-missing

An access port such as ether2 receives untagged frames, assigns them to VLAN 10, and strips the tag when sending frames out. The trunk ether1 keeps tags and adds one to any untagged frame. The VLAN table then limits which frames can leave through each port.

Exam tip

Configure the VLAN table first and the strict vlan-mode last. A strict mode applied too early can cut off your own management access.

VLAN modes

The mode decides how much the chip checks.

Mode	Behaviour
`disabled`	The VLAN table is not used for the port
`fallback`	The table is used when a match is found, and traffic still passes when it is not
`check`	Stricter, and checks frames against the table
`secure`	Strictest, drops frames when the VLAN is not in the table or the ingress port is not a member

Use secure for real isolation. The weaker modes let traffic through that has no matching table row, which defeats the purpose.

Port based VLAN, in summary

A port based VLAN assigns a VLAN to a port, not to a frame property.

Every untagged frame on an access port is placed in the VLAN of that port. The host sees an ordinary network, and does not know about the tag. This is the most common VLAN design, and the simplest to maintain.

Limits

Check the model before you plan.

Not all basic chips offer a full VLAN table.
Chip VLAN entries are separate from the bridge VLAN table, so do not set up the same VLAN in both places.
Some chips cannot handle both methods on the same ports at once.

A chip with no VLAN table can still isolate traffic with bridges, if each bridge holds different ports and the chip offloads them.

What to remember for the exam

Seven facts cover most questions on this topic.

Chip VLANs are set in the /interface ethernet switch menus.
The VLAN table lists the member ports of each VLAN ID.
default-vlan-id gives untagged frames their VLAN.
always-strip suits access ports, and add-if-missing suits trunk ports.
vlan-mode=secure drops frames not allowed by the table.
The switch CPU port must be in the table for the router to reach the VLAN.
Port based VLAN means the port decides the VLAN of untagged frames.

Watch out

Do not combine chip VLAN tables and bridge VLAN filtering for the same ports. Pick one method per device.

Common mistakes

These four mistakes appear often.

Forgetting the CPU port. The router cannot reach hosts in a VLAN unless the CPU port is a member.

Using a weak vlan-mode. fallback and check allow traffic that secure would drop.

Wrong vlan-header on a trunk. With always-strip on a trunk, tags are lost and VLANs merge.

Mixing both VLAN methods. Chip tables and bridge VLAN filtering on the same ports give confusing results.

Check yourself

Work through these three questions.

Which setting puts untagged frames on an access port into VLAN 10?
default-vlan-id=10 on that port.
Which vlan-header value removes the tag when a frame leaves an access port?
always-strip.
Why use vlan-mode=secure?
It drops frames whose VLAN is not in the table or whose ingress port is not a member, so isolation is enforced.

Topic 3 of 6 in VLANs

Test yourself on VLANs

The full MikroTik MTCSWE question bank has 484 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.