MikroTik MTCNA lab 7 of 19
VLANs with bridge VLAN filtering
Split one switched network into staff, guest and management VLANs the RouterOS 7 way: one bridge per switch, access and trunk ports with PVID and frame types, the bridge VLAN table, VLAN filtering switched on last, and a router-on-a-stick for routing between VLANs.
Run this lab
It needs Lite: its 6 nodes are set to 6 vCPU and 3,840 MB in total. That fits the free demo too.
In your workspace: Shared, then MikroTik MTCNA RouterOS v7 guided labs, then 07 - VLANs with bridge VLAN filtering
- Level
- Intermediate
- Time
- About 60 minutes
- Nodes need
- 6 vCPU, 3,840 MB
- Smallest plan
- Lite
The scenario
A small hotel has staff PCs and a guest network on the same switches. Today everything is one flat network, so a guest can see the reception PC. You will split it into three VLANs: 10 Staff, 20 Guest and 99 Management for the switches themselves. GW routes between them (the guest firewall comes in lab 10).
| Device | Port | Mode | VLANs |
|---|---|---|---|
| SW1 | ether1 → GW | trunk | 10, 20, 99 tagged |
| SW1 | ether2 → SW2 | trunk | 10, 20, 99 tagged |
| SW1 | ether3 → Staff1 | access | 10 untagged |
| SW1 | ether4 → Guest1 | access | 20 untagged |
| SW2 | ether1 → SW1 | trunk | 10, 20, 99 tagged |
| SW2 | ether2 → Staff2 | access | 10 untagged |
| GW | ether2 → SW1 | trunk | VLAN interfaces 10, 20, 99 |
| Interface | Address |
|---|---|
| GW vlan10 / vlan20 / vlan99 | 192.168.10.1/24 · 192.168.20.1/24 · 192.168.99.1/24 |
| SW1 / SW2 management (VLAN 99) | 192.168.99.2/24 · 192.168.99.3/24, gateway 192.168.99.1 |
| Staff1 · Guest1 · Staff2 | 192.168.10.11 · 192.168.20.11 · 192.168.10.12 (already set) |
What you’ll practise
- Explain 802.1Q tagging, access ports, trunk ports and the PVID
- Configure bridge ports with pvid, frame-types and ingress filtering
- Build the bridge VLAN table, including the bridge itself for management
- Enable vlan-filtering safely, last
- Give a switch a management address in its own VLAN
- Route between VLANs with VLAN interfaces on a router
The tasks
- Plan the ports
- Build SW1's bridge and ports (filtering still off)
- Fill SW1's VLAN table and give it a management address
- Switch on VLAN filtering on SW1
- Do the same on SW2
- Route between the VLANs on GW (router on a stick)
- Look at VLAN-aware MAC learning
The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.
Topology and devices
The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.
Every link, as text
- GW
ether2to SW1ether1 - SW1
ether2to SW2ether1 - SW1
ether3to Staff1eth0 - SW1
ether4to Guest1eth0 - SW2
ether2to Staff2eth0
| Node | Device | Image in Add Node | Set to |
|---|---|---|---|
| GW | MikroTik RouterOS | mikrotik-7.14.2 | 1 vCPU, 256 MB |
| SW1 | MikroTik RouterOS | mikrotik-7.14.2 | 1 vCPU, 256 MB |
| SW2 | MikroTik RouterOS | mikrotik-7.14.2 | 1 vCPU, 256 MB |
| Staff1 | VPCS host | Built in to EVE-NG | Counted as 1 vCPU, 1,024 MB |
| Guest1 | VPCS host | Built in to EVE-NG | Counted as 1 vCPU, 1,024 MB |
| Staff2 | VPCS host | Built in to EVE-NG | Counted as 1 vCPU, 1,024 MB |
How to open this lab
Sign in to your workspace at
lab.cloudlabbox.com.In File Manager, open Shared, then the folder
MikroTik MTCNA RouterOS v7 guided labs.Open
07 - VLANs with bridge VLAN filteringand start its nodes, then open Lab Tasks for the scenario and the steps.
The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.
More MikroTik MTCNA labs
Related labs in other courses
CloudLabBox is independent of MikroTik. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.