Thank you. I think you refer to #3 not #4, as #4 is (or at least that was my intention) about the setting "Default VLAN ID" on the VLAN tab of the switch OS.Re: #4
Does your ISP provide the service over VLAN1 or in any other ways forces you to use it?
I might have missed where you explained how you were forced - with a gun pointed at your head - to use VLAN1.
The usual advice is to NOT use VLAN1, unless it is really-really needed because the consequences of using it (depending also on how other devices connected to the network behave) are often unpredictable and - historically - can range from "nothing" to "strange intermittent errors without apparent explanation".
tdw gave an explanation here (that may or may not apply to your case, it is about RouterOS):
viewtopic.php?t=206946#p1071170
Rules of Mikrotik Club (JFYI)![:wink:]( "Wink")
viewtopic.php?t=212419#p1108288
Anyway, I agree and do not argue. In fact, so far I have not been using VLAN 1 at all. The only reason and logic behind it was (I think it's coming from switch os documentation) that VLAN strict mode allows only packets with VLAN ID where that port is a member of that VLAN ID.
So logic was: if I want to replace port-isolation with VLANs only, I have to use strict mode. If I use strict mode, I must define VLAN ID 1 for those ports where ISP's network goes.
I have also proposed alternative solution in my #3 above. So if I am not to use VLAN 1 in this way, that means the yellow ports cannot be in strict mode, but must be in optional (or enabled?) mode. In that case, green and blue remain strict = there should be no native VLAN appearing on these ports, while yellow ports will accept IPTV VLAN as well as native VLAN. However, I am not sure if in this case yellow ports will also see VLAN communication from other VLANs where they do not belong (I hope not).
Would you then propose that this is the way to go to achieve ISP separation from my local VLANs while allowing native VLAN on ISP ports?
This would then answer and close #3
...in fact, it would perhaps not answer #1, but definitely it would close #1 as well, as I would not have to use port-isolation at all then.Cheers,
B.
Statistics: Posted by BrandonSk — Tue Jan 07, 2025 7:34 pm