The latest articles on Forem by J M C Dias (@jmcdias). https://forem.com/jmcdias https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F3333311%2F13e808e4-038d-40ea-b7ed-2a114d03b6fc.png https://forem.com/jmcdias en J M C Dias Tue, 08 Jul 2025 23:22:26 +0000 https://forem.com/jmcdias/mastering-mikrotik-managed-switches-routing-vlans-pppoe-failover-qos-security-25cm https://forem.com/jmcdias/mastering-mikrotik-managed-switches-routing-vlans-pppoe-failover-qos-security-25cm <h2> 📘 Complete Guide: MikroTik in Practice — VLANs, PPPoE, Failover, NAT, Mangle, QoS &amp; Firewall </h2> <p>This guide is the result of <strong>in-depth, real-world study in networking</strong> using MikroTik and Cisco managed switches.</p> <p>It covers everything from the <strong>OSI model</strong> to real configurations — including <strong>VLANs</strong>, <strong>PPPoE</strong>, <strong>routing marks</strong>, <strong>NAT</strong>, <strong>firewalling</strong>, <strong>automatic failover</strong>, and <strong>Queue Tree QoS</strong>.</p> <p>If you're aiming to <strong>level up your networking skills</strong> for professional environments, this is a hands-on starting point.</p> <blockquote> <p>🧠 <strong>This article is part of my upcoming eBook:</strong><br><br> 🛠️ <em><strong>The Practical Network Blueprint: Real Infrastructure with MikroTik, Cisco &amp; Cloud Edge</strong></em><br><br> A complete and evolving resource that compiles content from all my technical posts into one cohesive reference.</p> </blockquote> <h2> 📘 Module 1 — Networking Fundamentals: Layers, Switches &amp; Routers </h2> <h3> 🧠 OSI Model Explained with Real-Life Analogy </h3> <p>The OSI model breaks network communication into 7 logical layers.<br><br> Think of it like sending a letter:</p> <ul> <li> <strong>Layer 1: Physical</strong> → The envelope being passed hand-to-hand → <em>Cables, signals</em> </li> <li> <strong>Layer 2: Data Link</strong> → Sender/receiver address → <em>MAC address, Switches</em> </li> <li> <strong>Layer 3: Network</strong> → ZIP/Postal code → <em>IP, Routing</em> </li> <li> <strong>Layer 4: Transport</strong> → Type of delivery (express, registered) → <em>TCP, UDP</em> </li> <li> <strong>Layers 5–7: Session–Application</strong> → The letter content → <em>Browser, Email, WinBox</em> </li> </ul> <h4> 🔎 In daily usage: </h4> <ul> <li> <strong>Layer 2</strong> → Plugging a cable into a switch </li> <li> <strong>Layer 3</strong> → MikroTik routing packets by IP </li> <li> <strong>Layer 4</strong> → Browser initiating a TCP connection</li> </ul> <h3> 🔹 How This Applies to MikroTik </h3> <p>When configuring VLANs, PPPoE, NAT, or mangle rules, you're working across:</p> <ul> <li> <strong>Layer 2</strong> → VLANs, MAC addresses </li> <li> <strong>Layer 3</strong> → IP addresses and routing </li> <li> <strong>Layer 4+</strong> → Ports like 80, 443, etc.</li> </ul> <h2> 🖧 Switches and VLANs (Layer 2) </h2> <h3> 🎯 What is a VLAN? </h3> <p>A <strong>VLAN (Virtual LAN)</strong> is a logically isolated network on the same physical switch.</p> <p><strong>Example – A 24-port switch:</strong></p> <ul> <li>Ports 1–8 → VLAN 10 (Admin) </li> <li>Ports 9–16 → VLAN 20 (Finance) </li> <li>Ports 17–24 → VLAN 30 (Guests) </li> </ul> <p>💡 Devices in different VLANs cannot communicate unless routed.</p> <h3> 🔀 Tagged vs Untagged Traffic </h3> <div class="table-wrapper-paragraph"><table> <thead> <tr> <th>Type</th> <th>Where</th> <th>Meaning</th> </tr> </thead> <tbody> <tr> <td>Tagged</td> <td>Trunk port</td> <td>Packet includes VLAN ID</td> </tr> <tr> <td>Untagged</td> <td>Access port</td> <td>Packet already assigned VLAN</td> </tr> </tbody> </table></div> <h3> 🔄 Access vs Trunk Ports </h3> <ul> <li> <strong>Access port</strong> → Connects to end devices (PCs, printers). One VLAN. </li> <li> <strong>Trunk port</strong> → Connects to MikroTik or other switches. Multiple VLANs (tagged).</li> </ul> <h2> 🧪 Topology Example (Cisco Switch + MikroTik) </h2> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code> \[Fiber ISP] | Cisco Switch (Gi1/1/2 — trunk) | MikroTik (ether13) | VLAN 13 → Link C VLAN 10 → Link A VLAN 20 → Internal LAN </code></pre> </div> <h2> 🔧 Cisco Switch Configuration </h2> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code>vlan 10 name LINK_A vlan 13 name LINK_C vlan 20 name LAN_LOCAL interface Gi1/1/2 description Trunk to MikroTik switchport trunk encapsulation dot1q switchport mode trunk switchport trunk allowed vlan 10,13,20 </code></pre> </div> <h2> 📘 How MikroTik Sees This </h2> <p>MikroTik uses <strong>virtual VLAN interfaces</strong> over physical ports.<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code>/interface vlan add <span class="nv">name</span><span class="o">=</span>vlan13 vlan-id<span class="o">=</span>13 <span class="nv">interface</span><span class="o">=</span>ether13 <span class="nv">comment</span><span class="o">=</span><span class="s2">"LINK C"</span> /ip address add <span class="nv">address</span><span class="o">=</span>192.0.2.2/30 <span class="nv">interface</span><span class="o">=</span>vlan13 </code></pre> </div> <h2> 📌 Use Case — Isolating Departments </h2> <ul> <li>VLAN 100 → Management</li> <li>VLAN 200 → Finance</li> <li>VLAN 300 → Guest Wi-Fi</li> <li>VLAN 400 → IP Cameras</li> </ul> <p>Use MikroTik firewall rules to allow or deny communication between them.</p> <h2> 🧠 Module Summary </h2> <ul> <li> <strong>VLAN</strong> → Logical network segmentation</li> <li> <strong>Trunk</strong> → Port carrying multiple VLANs</li> <li> <strong>Access</strong> → Port for end-user device (1 VLAN)</li> <li> <strong>Tagged</strong> → Packet includes VLAN ID</li> <li> <strong>Untagged</strong> → Already assigned to VLAN</li> </ul> <h2> 📘 Module 2 — Creating VLANs on Cisco Switch + MikroTik </h2> <h3> 🧠 Real Scenario </h3> <p>You’ve added a new internet link (Link C) via Ethernet to your Cisco switch.<br> You must deliver this link to MikroTik using <strong>VLAN 13</strong>.</p> <p>You’ll need to:</p> <ul> <li>Create VLAN 13 on Cisco</li> <li>Allow it on the trunk port to MikroTik</li> <li>Create VLAN interface in MikroTik</li> <li>Assign public IP and routing</li> </ul> <h3> 🎯 Setup Summary </h3> <div class="table-wrapper-paragraph"><table> <thead> <tr> <th>Device</th> <th>Task</th> </tr> </thead> <tbody> <tr> <td>Cisco Switch</td> <td>Create VLAN, allow on trunk</td> </tr> <tr> <td>MikroTik</td> <td>Create <code>/interface vlan</code>, IP</td> </tr> </tbody> </table></div> <h3> 🧪 Example Setup </h3> <ul> <li> <strong>VLAN ID:</strong> 13</li> <li> <strong>Switch Port:</strong> Gi1/1/2</li> <li> <strong>MikroTik Port:</strong> ether13</li> <li> <strong>Public IP:</strong> 192.0.2.2/30</li> <li> <strong>Gateway:</strong> 192.0.2.1</li> </ul> <h3> 🔧 Cisco Configuration </h3> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code>conf t vlan 13 name LINK_C <span class="nb">exit </span>interface Gi1/1/2 description Trunk to MikroTik switchport trunk encapsulation dot1q switchport trunk allowed vlan add 13 switchport mode trunk <span class="nb">exit</span> </code></pre> </div> <p>⚠️ Make sure the port is set to <strong>trunk</strong> mode.</p> <h3> 🌐 MikroTik VLAN Configuration </h3> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code>/interface vlan add <span class="nv">name</span><span class="o">=</span>vlan13 vlan-id<span class="o">=</span>13 <span class="nv">interface</span><span class="o">=</span>ether13 <span class="nv">comment</span><span class="o">=</span><span class="s2">"LINK C - VLAN 13"</span> /ip address add <span class="nv">address</span><span class="o">=</span>192.0.2.2/30 <span class="nv">interface</span><span class="o">=</span>vlan13 <span class="nv">comment</span><span class="o">=</span><span class="s2">"Public IP - LINK C"</span> </code></pre> </div> <p>✅ MikroTik now sees VLAN 13 as a <strong>normal interface</strong>.</p> <h3> 📈 Connectivity Test (in MikroTik) </h3> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code>ping 192.0.2.1 </code></pre> </div> <p>✅ If it replies, the VLAN and trunk are working correctly.</p> <h3> 💡 Use Clear Naming </h3> <div class="table-wrapper-paragraph"><table> <thead> <tr> <th>Interface</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td>vlan10</td> <td>Link A (VLAN 10)</td> </tr> <tr> <td>vlan13</td> <td>Link C (VLAN 13)</td> </tr> <tr> <td>vlan20</td> <td>Internal LAN</td> </tr> </tbody> </table></div> <h3> ⚠️ Common Problems &amp; Fixes </h3> <div class="table-wrapper-paragraph"><table> <thead> <tr> <th>Symptom</th> <th>Likely Cause</th> <th>Solution</th> </tr> </thead> <tbody> <tr> <td>No ping to gateway</td> <td>VLAN not in trunk</td> <td>Check <code>switchport trunk allowed</code> </td> </tr> <tr> <td>No MikroTik traffic</td> <td>Wrong VLAN ID/port</td> <td>Confirm VLAN + physical port</td> </tr> <tr> <td>No public IP</td> <td>PPPoE required</td> <td>See <strong>Module 3</strong> for config</td> </tr> </tbody> </table></div> <h2> 🧠 Module Summary </h2> <ul> <li>Create VLANs on the switch</li> <li>Allow them on trunk ports</li> <li>Use <code>/interface vlan</code> on MikroTik</li> <li>Assign IPs as if physical interface</li> <li>Use <code>ping</code> to test connectivity</li> <li>Use <strong>clear naming</strong> conventions</li> </ul> <h2> 🔗 What’s Next? </h2> <p>This is just the beginning. Modules 3–7 cover:</p> <ul> <li>PPPoE</li> <li>Routing marks</li> <li>NAT &amp; Mangle</li> <li>QoS</li> <li>Firewall security</li> <li>Real-world failover diagnostics</li> </ul> <p>👉 <a href="https://medium.com/@joaodiasworking/mastering-mikrotik-managed-switches-routing-vlans-pppoe-failover-qos-security-1b19e471106e" rel="noopener noreferrer">Continue the full 7-module series on Medium</a></p> network