~!~ Mikrotik with Cisco VLAN made easy ~!~ ~!~ For Beginners ~!~
Virtual LANs (VLANs) are a solution to allow you to separate users into individual network segments for security and other reasons. VLAN membership can be configured through software instead of physically relocating devices or connections. VLANs allow you to break up devices on your network regardless of their location.
The main advantage of VLAN are
- Broadcast Control
- Security / Client Isolation
- DMZ
- Controlled Network Management
- Costing
It is very useful for any network including large/small offices, ISP’s, Cable.Internet services providers etc. The main problem of any large network is broadcast and specially for network operators when any single user swap his wan router LAN cable to wan cable thus broadcast his router DHCP to operator network, or single user effected with virus/trojans broadcast to whole network. VLAN can help you in many situations like these or others.
TASK:
To avoid broadcasting/flooding and above all for better better management +security and monitoring, we want to break the network in smaller segments.
Scenario:
Consider the following scenario
We have Mikrotik Router which is acting as a DHCP and PPPoE Server as well. and we want to isolate the different network areas by breaking them in smaller segments. Each area will get different IP series from the mikrotik dhcp server.
In this example following ports are used for
- Mikrotik = Port 1 [as TRUNK port]
- Dealer-1 = Port 2
- Dealer-2 = Port 3
- Dealer-3 = Port 4
Hardware Used in this Guide:
- Mikrotik RB2011
- Cisco 3750-E Series
- Two Laptops for testing
As showed in the image below …
MIKROTIK CONFIG
# Create VLAN Interfaces and provide them name and VLAN#ID /interface vlan add interface=LAN l2mtu=1594 name=DEALER-1 vlan-id=10 add interface=LAN l2mtu=1594 name=DEALER-2 vlan-id=20 add interface=LAN l2mtu=1594 name=DEALER-3 vlan-id=30 # Assign IP addresses to the interfaces /ip address add address=192.168.1.1/24 interface=LAN network=192.168.1.0 add address=192.168.10.1/24 interface=DEALER-1 network=192.168.10.0 add address=192.168.20.1/24 interface=DEALER-2 network=192.168.20.0 add address=192.168.30.1/24 interface=DEALER-3 network=192.168.30.0 # Create DHCP Server and assign different Pools for the dealers # You can DHCP wizard as well if CLI is a bit hectic /ip dhcp-server add address-pool=DEALER-1-POOL disabled=no interface=DEALER-1 lease-time=6h name=dhcp1 add address-pool=DEALER-2-POOL disabled=no interface=DEALER-2 lease-time=6h name=dhcp2 add address-pool=DEALER-3-POOL disabled=no interface=DEALER-3 lease-time=6h name=dhcp3 /ip dhcp-server network add address=192.168.10.0/24 dns-server=192.168.10.1 gateway=192.168.10.1 add address=192.168.20.0/24 dns-server=192.168.20.1 gateway=192.168.20.1 add address=192.168.30.0/24 dns-server=192.168.30.1 gateway=192.168.30.1
Some screenshots for the reference purpose …
Done. Now we have to create VLANs at CISCO Switch…
CISCO VLAN CONFIGURATION
I assume that you have Cisco switch with any IP address for the management purposes.
Telnet to the switch
telnet 192.168.0.1
# Enter your Cisco switch password User Access Verification Password: xxxxxx # Switch to change mode enable Password: xxxxxxxxx # Enter in Config mode config t # Select Port number which will be connected with the Mikrotik and change encapsulation method interface gigabitEthernet 1/0/1 switchport trunk encapsulation dot1q switchport mode trunk switchport trunk allowed vlan all switchport nonegotiate #Create VLAN id and name for dealers/areas vlan 10 name DEALER-1 vlan 20 name DEALER-2 vlan 30 name DEALER-3 exit # Now Select Dealer1 interface , like port 2 and assign it with the vlan id interface gigabitEthernet 1/0/2 # OR RANGE like interface range gigabitEthernet 1/0/1-4 (Port Range 1 to 4) switchport mode access switchport access vlan 10 interface gigabitEthernet 1/0/3 switchport mode access switchport access vlan 20 interface gigabitEthernet 1/0/4 switchport mode access switchport access vlan 30 exit exit # SAVE the configuration you just made above wr
Some screenshots for reference…
Done!
TEST!
Now connect your PC with the port 2 and port3 , 4
You will get different IP in each port.
As showed in the image below from mikrotik dhcp server’s
Test From Dealer-1 System
Dealer-1 have receive 192.168.10.x series ip, exactly the one we configured in mikrotik.
Now try to ping any dealer-2 series and to the internet as well. You will see that you will be able to ping the internet and mikrotik LAN ip, but not with dealer-2 subnet or likewise.
NOTE: For the client isolation / to block communication between all VLAN’s , you must create FILTER rule as explained in TIP’s n TRICK section below …
TIP’S n TRICKS
1- Block communication between all or specific VLAN Subnet
It is usually required to block all communication between specific or all VLAN subnets for security or other reasons. By default mikrotik will allow communications between all vlan. You can block them by creating FILTER rules. Example is we want that users of all vlans can access internet via WAN interface but should not be able to communicate with any other VLAN subnet. use following as an example
Note: there are many other ways to achieve this either at switch level or mikrotik, i am showing just an example only here.
/ip firewall filter add chain=forward comment="Accept traffic from VLAN subnets to WAN" out-interface=WAN add action=reject chain=forward comment="Block Communication between all vlan subnets" reject-with=icmp-net-prohibited src-address=\ 192.168.0.1-192.168.255.255 # Masquerade rule to allow internet , wan link interface /ip firewall nat add action=masquerade chain=srcnat out-interface=WAN
Snapshots of Working VLAN config with pppoe server
Pending work:
– Add pppoe or hotspot configuration
– Firewall configuration for isolation in pppoe/hotpost
– Few more tips n tricks with VLAN
Regard’s
Syed Jahanzaib
Syed Jahanzaib - Personal Blog to Share Knowledge ! 