Notes on configuring MikroTik switches

I'm using a MikroTik manageable Ethernet switch (the CRS304-4XG-IN).

RouterOS is MikroTik's operating system running on the switch. That's a bit overkill for a switch, if you ask me, but SwOS doesn't work with this one.

WebFig is the web-based UI for configuring RouterOS.

RouterOS exposes implementation details that a networking textbook tends to abstract away.

I know I'll forget these details in a couple of weeks, so I'm keeping these notes as a reference for later.

A simple Layer-2 network

       Internet
          │
       Router
          │
        Port 1
          │
 ┌─────────────────┐
 │      CRS304     │
 │                 │
 │    L2 switch    │
 └─────────────────┘
   │      │      │
 Port2  Port3  Port4
   │      │      │
MacBook  NAS    PS5

The bridge

There is a "bridge" menu in WebFig.

The bridge is a logical construct (a software-defined interface) through which RouterOS groups Ethernet interfaces into a forwarding domain:

bridge (logical switch)
│
├── ether1   ← router
├── ether2   ← MacBook
├── ether3   ← NAS
└── ether4   ← PS5

In this configuration:

• all four ports belong to the same bridge and to the same broadcast domain
• devices connected to them are part of the same network

The bridge is also where port switching, or at least part of it, is configured.

Switch ASIC

A switch ASIC (Application-Specific Integrated Circuit) is specialized hardware designed to perform switching-related operations.

A switch could perform these operations using a general-purpose CPU, but that would be a terrible design for a high-speed switch:

• the CRS304 has four 10-Gigabit Ethernet ports
• at 10 Gbit/s, a port can carry up to 10 billion bits per second

So instead, the CRS304 uses specialized switching hardware designed to operate at very high speed.

For the CRS304:

• Marvell = manufacturer (Marvell Technology, Inc.)
• Prestera = switch ASIC family
• 98DX2528 = specific switch ASIC used by the CRS304

MikroTik lists the 98DX2528 as both the switch chip and the CPU. It smells like a switch SoC (System-on-Chip): a chip that combines a general-purpose CPU with dedicated Ethernet-switching hardware.

Hardware offload

RouterOS can program the switch ASIC to perform forwarding in hardware.

This is called hardware offload.

In the RouterOS interface, the H flag indicates that hardware offloading is being used for the bridge port.

WebFig: "bridge" and "switch" menus

WebFig has both a "Bridge" menu and a "Switch" menu.

I don't fully understand why there are two menus. It looks like the switch menu is for chip-specific features that can't be expressed through the bridge configuration.

Which menu owns a feature may depend on the chip…

The day Ethernet switch manufacturers make a decent user interface will be the day pigs fly.

Anyway, in my case:

• Bridge UI = what should my Layer-2 network look like?
• Switch UI = what can the switch do?

Mental model

          RouterOS
             │
           Bridge
        configuration
             │
      hardware offload
             │
          Switch
       configuration
             │
       Marvell Prestera
          98DX2528
       switch ASIC chip
             │
   ┌─────────┼─────────┐
   ▼         ▼         ▼
ether1     ether2    ether3 …

Port based mirroring

Port-mirroring is part of Marvell Prestera switch chip features.

Example goal = everything the NAS receives, copied to the MacBook:

ether1 = Router
ether2 = MacBook   ← mirror target
ether3 = NAS       ← mirror source
ether4 = PS5

In switch terminology:

• ether3 = source port
• ether2 = mirror target = the port to which the copies of mirrored packets are sent
• mirror-ingress=yes = copy traffic entering ether3
• mirror-egress=yes = copy traffic leaving ether3

For this example, only mirror-egress is enabled because we want traffic going from the switch toward the NAS.

Via UI

Port mirroring is under the "Switch" menu:

1. go to "Switch → Settings"
   • set "Mirror Target" to ether2
2. go to "Switch → Ports"
   • find ether3
   • Mirror Egress → yes (copy frames leaving ether3 toward the NAS)

Via CLI

Inspect the current switch configuration:

/interface ethernet switch print
/interface ethernet switch print detail

Inspect the switch ports:

/interface ethernet switch port print
/interface ethernet switch port print detail
/interface ethernet switch port print detail where name=ether3

Mirror the traffic the NAS receives (ether3) on the MacBook (ether2):

/interface ethernet switch set [switch-name] mirror-target=ether2
/interface ethernet switch port set ether3 mirror-ingress=no mirror-egress=yes

Revert the mirroring configuration:

/interface ethernet switch set [switch-name] mirror-target=none
/interface ethernet switch port set ether3 mirror-ingress=no mirror-egress=no

Reset the configuration

To reset the configuration:

• unplug the device from power
• press and hold the Reset button
• plug the device
• release the Reset button when the USER (USR) LED starts flashing