5

Edit: While Mikrotik is well known for their consumer-grade wireless routers, this question is about their rack mounted, carrier-grade, aggregation service routers.

I need to send a VLAN trunk over an EoIP tunnel through two RouterOS/Mikrotik routers. I have thus bridged an ethernet interface on each side of the link with the respective EoIP interfaces.

Seeing how different VLANs and trunks are handled on RouterOS makes me wonder how I should go about this.

The frames will be tagged on egress from Catalyst switches on either side of the routers. Can one simply skip any VLAN configuration on RouterOS in this case? Will it bridge the frames with 802.1q tags intact?

I assume that such configuration will cause the IP addresses of the routers to be accessible from any VLAN on the trunk, if any addresses are configured on the bridged ethernet interfaces.

Any other downside to this configuration? Is there a better way?

Improve this question
1
  • I have now tested a configuration without any vlan interfaces, and frames are bridged from physical interface through EoIP/IPSec with tags intact. It also seems possible to only add vlan interfaces (and associated bridge) for the vlan containing the router IP address (hybrid ports) leaving all other tags intact and directly bridged. Eg. RouterOS seems to only strip configured tags on ingress. I don't know if there might be other complicating issues,
    – Roy
    Jul 31 '13 at 18:22
5

To be sure, create VLAN sub-interfaces on the physical interfaces and bridge the sub-interfaces. Any IP addresses are then configured on the respective bridges. VLANs are isolated from each other on layer 2 like on any switch.

Treat the EoIP tunnel interface like a physical interface for this exercise.

Oddly enough, the procedure is very similar to how VLAN trunks are configured on Juniper MX series routers :)

http://wiki.mikrotik.com/wiki/Manual:Interface/VLAN has the details.

Improve this answer
3
  • I read the docs, but they don't make much sense to me when it comes down to trunk-to-trunk. For 20 vlans that is 100 additional interfaces and bridges to configure. Might it not be better to put admin ip address on a separate physical interface and just bridge the entire trunk without messing with the tags?
    – Roy
    Jul 31 '13 at 18:02
  • 2
    If that works... I haven't tested that way myself, so I don't know what issues may arise. wiki.mikrotik.com/wiki/Vlans_on_Mikrotik_environment suggests that if you're not stripping tags you don't need to configure the VLAN interfaces, at least on physicsal trunk ports.
    – user661
    Jul 31 '13 at 18:06
  • I have now had the simplistic bridge configuration in production for over a year without issue, meaning a dumb ethernet bridge of a physical ethernet port to a tunnel interface (EoIP/IPSec) without any consideration for VLAN tags. The entire trunk is nicely sent through, with VLAN tags intact. In my configuration where I have two links between four mikrotik routers, for redundancy, that also has the added benefit that I can easily move VLANs between the two trunks (on the distribution switches) without changing any config on the Mikrotiks. I configured admin ip adresses on seperate interfaces.
    – Roy
    Mar 28 '15 at 3:03
0

In the scenario above, where plain trunks are in their entirety passed through a RouterOS device without adding or removing tags or doing any selective bridging, you can get away with not configuring individual vlans at all.

By just bridging the ethernet ports, RouterOS will forward any tagged frames with the tags intact.

This type of configuration is illustrated in the following example in the docs:

http://wiki.mikrotik.com/wiki/File:Vlan-2.png

AS soon as you need to do anything much with the VLANs, it's time to refer to the answer by @Aziraphale and create all of the individual vlan bridges and associated configurationse.

Improve this answer
-1

Using EoIP Tunnel to connect private LANs across internet

EoIP or Ether over IP tunnel is a tunnel protocol designed by Mikrotik development team which allows network administrators to easily connect private LANs located in different locations separated by cities or countries. As long as the Mikrotik routers can ping each other, we can create the EoIP tunnel among them.

enter image description here

Improve this answer
2
  • That is certainly a nice overview over EoIP, even if it is not horribly detailed and perhaps not showing a terribly typical implementation. Though, while I sincerely appreciate the effort, I must admit that I'm a little perplexed as to how this is meant to address the question about vlan trunks?
    – Roy
    Aug 3 '16 at 6:17
  • I read the question as how do I create an "EoIP tunnel through two RouterOS/Mikrotik routers" and found some documentation indicating that it can be done along with a nice diagram and link to the documentation.
    – Ronnie Royston
    Aug 3 '16 at 16:39

Not the answer you're looking for? Browse other questions tagged or ask your own question.