How to Configure VLANs on MikroTik

Virtual Local Area Networks (VLANs) enable network administrators to logically separate network devices into distinct groups. VLANs improve performance, enhance security, and streamline network management. In this guide, we explain VLANs, their benefits, and provide step-by-step instructions for configuring them on MikroTik devices.

Table of Contents

• What is a VLAN?
• Key Benefits of VLANs
• VLAN Components and Types of Connections
• Step-by-Step VLAN Configuration on MikroTik
  • Step 1: Create VLAN Interfaces
  • Step 2: Configure Trunk Ports
  • Step 3: Configure Access Ports
  • Step 4: Enable Routing Between VLANs
  • Step 5: Assign IP Addresses and Default Gateway
• Troubleshooting Common Issues
• Conclusion

What is a VLAN?

A Virtual Local Area Network (VLAN) is a network setup that allows devices across different physical locations to behave as if they are on the same local network. VLANs, defined by the IEEE 802.1Q standard, help segment networks without changing physical cabling. They reduce broadcast traffic, improve security, and simplify network management.

Key Benefits of VLANs

• Better Performance: VLANs reduce the amount of broadcast traffic by splitting a network into smaller, manageable sections.
• Enhanced Security: VLANs isolate traffic, protecting sensitive data and reducing unauthorized access.
• Simplified Management: VLANs allow easy network changes without physical alterations, enabling flexible network setups.

VLAN Components and Types of Connections

MikroTik VLAN setups have two main types of connections:

• Access Ports: These untagged ports connect end devices to a single VLAN.
• Trunk Ports: These tagged ports carry traffic from multiple VLANs between switches or between a switch and router.

Understanding these types of ports is key to setting up VLANs correctly on a MikroTik device.

Step-by-Step VLAN Configuration on MikroTik

Step 1: Create VLAN Interfaces

To start, create VLAN interfaces on your MikroTik device to handle traffic tagged for specific VLAN IDs.

1. Open WinBox or SSH: Log in to your MikroTik device using WinBox or SSH.
2. Go to Interfaces: Navigate to the “Interfaces” tab.
3. Add VLAN Interface: Click the “+” button, name your VLAN, select the physical interface, and set the VLAN ID.

/interface vlan add name=vlan10 interface=ether1 vlan-id=10

Step 2: Configure Trunk Ports

Trunk ports transport traffic for multiple VLANs. Set up a trunk port to allow devices from different VLANs to communicate through a central switch.

1. Open Bridge Menu: Go to “Bridge” and create a new bridge if not already set up.
2. Tag VLANs on Trunk Port: Specify which VLANs to pass through the trunk port.

/interface bridge add name=bridge1
/interface bridge port add bridge=bridge1 interface=ether1
/interface bridge vlan add bridge=bridge1 tagged=ether1 vlan-ids=10,20

Step 3: Configure Access Ports

Access ports allow devices to connect to a single VLAN without VLAN tagging.

1. Set Port VLAN ID (PVID): Go to “Bridge Ports” and set the PVID for each access port to assign it to a specific VLAN.

/interface bridge port add bridge=bridge1 interface=ether2 pvid=10

Step 4: Enable Routing Between VLANs

For communication between VLANs, a Layer 3 device (such as a router or L3 switch) is required. MikroTik routers support this by creating subinterfaces.

1. Create Subinterfaces: Each VLAN needs a subinterface for routing. Set an IP address for each subinterface as the default gateway for that VLAN.

/interface vlan add name=vlan10 interface=ether1 vlan-id=10
/interface vlan add name=vlan20 interface=ether1 vlan-id=20

/ip address add address=192.168.10.1/24 interface=vlan10
/ip address add address=192.168.20.1/24 interface=vlan20

Step 5: Assign IP Addresses and Default Gateway

Assign IP addresses to devices within each VLAN range and set the router’s subinterface IP as the default gateway for each VLAN.

Troubleshooting Common Issues

• Incorrect VLAN Tagging: Ensure trunk ports are tagged with the correct VLAN IDs. Incorrect tagging can prevent devices from receiving VLAN traffic.
• Access Port Misconfiguration: Confirm that access ports have the right PVID set to ensure they belong to the correct VLAN.
• Inter-VLAN Routing Not Working: If VLANs cannot communicate, confirm routing is enabled on the router, and check firewall rules to allow traffic between VLANs.

Conclusion

Configuring VLANs on MikroTik devices improves network performance, security, and management. Following these steps, you can set up VLANs effectively on a MikroTik device and segment your network efficiently. For further learning, consult MikroTik’s official documentation and IEEE 802.1Q standards for in-depth technical guidance.