MikroTik Switching with LABS

Discover how MTU differs between layer two and layer three, why MTU is 1500 bytes for internet, and how VLAN or MPLS headers raise layer two MTU.

Learn how to adjust layer 3 and layer 2 MTU on MikroTik switches in a hands-on lab. Observe how 4000-byte pings reveal MTUs using a packet sniffer and IP addressing.

Explain virtual local area networks and how VLANs segment layer 2 networks, reduce broadcasts, and support scenarios like department separation, VoIP priority, and ISP customer VLANs, with q-in-q tagging basics.

Configure port-based VLANs on MikroTik Cres 300 switches using bridges, trunk and access ports, and verify with DHCP servers and clients across VLAN 20 and VLAN 30.

Explain and demonstrate configuring q-in-q (vlan under vlan) with bridging and hardware offload on mikrotik switches, creating vlan 22 and 33 across trunks to pass through.

Configure a management vlan across two MikroTik switches using trunk links, enable vlan filtering, and assign vlan 99 with IP addresses to enable remote switch access and verification.

Learn how dynamic bridge VLAN entries and ingress filtering control access on MikroTik switches by separating Ethernet ports into distinct VLANs, enabling VLAN filtering, and restricting tagged frames.

Master mac based vlan concepts, differentiate from port based vlans, and implement it with Mikrotik 300 switches by mapping a device's mac to vlan 20 and verifying dhcp IPs.

Master vlan tag stacking with a hands-on lab, learning how to pass vlan 100 and 200 under vlan ten using q-in-q techniques across switches and routers.

Explore why MikroTik switch redundancy matters and how the spanning tree protocol prevents broadcast storms, duplicate frames, and MAC address instability on layer-two networks.

Explore how the spanning tree protocol prevents loops in redundant switches, elects a root bridge by priority and mac address, and uses bpdu exchanges to determine root and designated ports.

Explore the spanning tree protocol by examining interface states, including blocking, listening, learning, forwarding, and disabled. Understand root and designated port roles and the potential 50-second convergence delay.

Explore the classical spanning tree protocol on MikroTik switches, designating a root bridge and configuring root ports, designated ports, and alternate ports across three bridges.

Learn how topology change notification in spanning tree rapidly updates mac address table aging from 300 seconds to 15 seconds across switches, preventing traffic loss during link changes.

Compare rapid spanning tree with classic STP, showing discarding replaces blocking and listening, and describe faster convergence via keepalive, BPDU version 2, and negotiation.

Explore the rapid spanning tree protocol's negotiation mechanism in RSTP, where root and non-root bridges exchange proposals and agreements to enable fast forwarding and convergence.

Configure rapid spanning tree protocol on three MikroTik switches and verify root bridge roles and how quickly the alternate port forwards when an Ethernet interface is disabled.

Explore the multiple spanning tree protocol (mstp) for MikroTik, using regions, instances, and vlan mapping to manage VLANs 100–300 and per-vlan root bridges.

Configure mstp on MikroTik switches by enabling vlan filtering, creating vlans 10, 20, 30, 40, defining mstp regions and identifiers, mapping vlans to mstis, and designating root bridges.

Explore bonding and link aggregation to combine two links into one interface. See how lccp, the open standard, provides fault tolerance and load balancing for efficient traffic across links.

Configure bonding with lacp on two switches to create a two-link aggregation between ethernet nine and ten. Assign IPs to bonding interfaces, enable balance-rr, and verify traffic uses both links.

Discover port isolation on Mikrotik CR 300 series switches, including isolated switch groups and private vlan, with hardware offload and lab demonstrations.

Configure a private vlan to enforce port isolation, allowing devices to obtain IP addresses via dhcp from the router while preventing them from communicating with each other.

Bridge horizon provides port isolation on MikroTik switches by applying horizon values to bridge interfaces and disables hardware offload. Set identical horizon values to block communication between devices.

Learn layer two quality of service on Mikrotik switches, using 802.1p PCP for class of service and mapping layer three to layer two, with software and hardware offload labs.

Explore layer 2 quality of service without hardware offload across two scenarios by configuring a bridge, enabling IP firewall, and MAC based marks to control upload and download speeds with queues.

Enable layer two quality of service with the switch chip using hardware offload. Learn ingress policing and egress shaping on a bridged interface through practical lab steps.

Enable igmp snooping on a MikroTik switch to limit multicast traffic to interested receivers, improving security and reducing unnecessary broadcasts.

Enable DHCP snooping to secure layer two networks, distinguishing trusted router interfaces from untrusted ones and blocking rogue DHCP servers to ensure IPs come from the legitimate DHCP server.

Learn how loop protect prevents single-switch loops and how traffic storm control limits broadcast, unknown unicast, and multicast traffic to a percentage of interface bandwidth.

Explore layer 2 firewall filtering on a MikroTik bridge using RouterOS bridge filter features to drop a specific mac address and observe hardware offload effects on ping.

Master layer 2 security with ARP and DHCP, using ARP leases and static entries, and explore ARP modes including enabled, reply only, proxy ARP, and local proxy ARP.

Learn to secure a MikroTik switch by hardening access, disabling unused services, changing admin credentials and ports, enabling IP-restricted logins, upgrading the OS, and limiting management protocols and bandwidth tests.