Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have installed OpenWrt on a MikroTik Routerboard RB750UP (AR7240 CPU with AR9330 built in switch). I have included additional details below, but my question is:

How do I configure an untagged and tagged vlan on the same port?

I have successfully configured non-tagged vlans and tagged vlans independently, but not for the same port. The reason why I want to do this is because I have a Ubiquiti NanoStation loco M2 plugged into a port providing a wireless lan (which requires untagged frames), but I also want to configure a tagged vlan for managing the loco (i.e. accessing its management ip via tagged van).

Here are some further details:

Hardware

  • MikroTik RouterBoard RB750UP
  • Ubiquiti NanoStation loco M2

swconfig output:

swconfig dev eth0 help
switch0: eth0(AR7240/AR9330 built-in switch), ports: 5 (cpu @ 0), vlans: 16
<snip>

Here's a link to a diagram of (what I believe to be) the layout of the RB750's AR7240/AR9330 switch.

Operating System

OpenWrt BARRIER BREAKER (Bleeding Edge, r36085), built with a custom configuration

# uname -a
Linux OpenWrt 3.8.3 #3 Wed Mar 27 04:09:04 PDT 2013 mips GNU/Linux

Network Diagram

Here's a link to a diagram of my Network Setup.

As the image shows, the NanoStation loco is plugged into port 3 and has a management IP of 192.168.20.10/24 configured on a vlan with vid=3. It also acts as a wireless bridge/access point for the 192.168.100.0/24 network.

Accordingly, port 3 on the router has an untagged vlan configured for the 192.168.100.0/24 network and a tagged vlan for the 192.168.20.0/24 management network (with vid=3).

Network Configuration

Here's what I'm trying to achieve with the below config:

  • Tagged VLAN 3 (vid=3) on port 3 (virtual interface eth0.3)
  • Untagged VLAN 4 on port 3 (virtual interface eth0.4)
  • Default vlan pvid=4 on port 3 (to handle incoming untagged frames)

And the actual contents of /etc/config/network:

<snip>

config interface 'loco'
        option proto 'static'
        option ifname 'eth0.3'
        option ipaddr '192.168.20.1'
        option netmask '255.255.255.0'

config interface 'locolan'
       option proto 'static'
       option ifname 'eth0.4'
       option ipaddr '192.168.100.1'
       option netmask '255.255.255.0'

<snip>

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option vid '1'
        option ports '0t 2 4'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option vid '2'
        option ports '0t 1'

config switch_vlan
        option device 'switch0'
        option vlan '3'
        option vid '3'
        option ports '0t 3t'

config switch_vlan
       option device 'switch0'
       option vlan '4'
       option vid '4'
       option ports '0t 3'

config switch_port
    option port '3'
    option pvid '4'

After rebooting the router, swconfig shows the following switch configuration. Note the missing '3t' from VLAN 3.

# swconfig dev switch0 show
Global attributes:
    enable_vlan: 1
Port 0:
    pvid: 0
    link: port:0 link:up speed:1000baseT full-duplex txflow rxflow 
Port 1:
    pvid: 2
    link: port:1 link:up speed:100baseT full-duplex auto
Port 2:
    pvid: 1
    link: port:2 link:down
Port 3:
    pvid: 4
    link: port:3 link:up speed:100baseT full-duplex auto
Port 4:
    pvid: 1
    link: port:4 link:up speed:100baseT full-duplex auto
VLAN 0:
    vid: 0
    ports: 0t 
VLAN 1:
    vid: 1
    ports: 0t 2 4 
VLAN 2:
    vid: 2
    ports: 0t 1 
VLAN 3:
    vid: 3
    ports: 0t    <----- no tagged port 3!
VLAN 4:
    vid: 4
    ports: 0t 3

As a result, I cannot ping the loco's management IP.

I've also tried manually configuring the vlan/port assignment and tags using swconfig, but in each permutation, it either leaves port 3 out of one of the vlans, or it forces port 3 to be tagged in both vlans.

Questions

  1. How do I configure an untagged and tagged vlan on the same port? I'm specifically trying to configure this for OpenWrt, but even understanding how to do this for Linux in general would be helpful.
  2. Are there any known bugs/issues with swconfig or the AR7240/AR9330 OpenWrt switch driver that could be causing this? (None came up in my searches.)
share|improve this question
    
I'm confused with your goals: (2) Untagged VLAN 4 on port 3 (virtual interface eth0.4) and (3) Default vlan pvid=4 on port 3 (to handle incoming untagged frames). If you have untagged VLAN 4 on port 3, it will already handle incoming untagged frames, isn't it? Why do you need extra default vlan pvid=4 on port 3 then? –  Andrey Sapegin Feb 13 at 10:53

3 Answers 3

Generally speaking, even untagged ports need to be assigned a NATIVE VLAN id AND only if this is different from the default id of 1. This is to help the switch understand how to forward packets. If you do not provide a vlan and it is bridged, it's considered a routed interface. You should not generally specify subinterfaces (ie tags) on interfaces unless you expect it to be bound on that system with an IP on that interface.

  1. Configure the vlan routed interfaces (not the physical/bridged)
  2. Specify the tagging protocol used on the physical bridged interfaces (ie. dot1q)
  3. Choose AND specify the native VLAN id on all interfaces (if NOT vlan 1)

Another point. Generally speaking, tagging only occurs when a L2 packet moves from one vlan to the core switch engine and only if it needs to be carried over another trunk. When a packet flows out of the switch engine it is stripped of the tag and forwarded via standard Ethernet frames.

share|improve this answer
    
"If you do not provide a vlan and it is bridged" - something is wrong with that statement. I think you mean if it's not bridged then it's routed. –  Matt May 13 at 20:39

I don't think it is possible to have a port with tagging enable AND without..

Either you are in access mode with an id configured (no tagging),

Either you configure multiple id on the port in access mode.

Either you are tagging on that port,with à single id

Either you are tagging multiple id to isolate trafic, it is called a trunk

I think what you need here is a trunk on your interface with your admin and data vlan configured on. Keep in mind the port configured on the other equipement must accept tagged frame on the specific id vehiculate by the trunk

share|improve this answer

user173470,

For this.. Best practice is to assign the Native VLAN or PortVlan ID on that specific port to VLAN for the NanoStation. Than TAG all your other VLANs if you want them passed on that port. Not all devices can pass tagged frames. Also you do not have to assign all members to those ports. Only assign the vlan members to ports that you want the traffic passed on. (Saves Bandwidth).

Your other ports can be see to there appropriate PVID / Physical Vlan and be tagged. If you only need to pass one vlan then set it as untagged for a device that only needs that vlan.

Keeps you config simple.

Hope this helps.. Cheers..

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.