MikroTik CRS Switch: Layer 2 and Layer 3 Management

Introduction

MikroTik CRS (Cloud Router Switch) series devices combine a powerful switch chip with a full RouterOS instance. They can function as pure Layer 2 switches, routers, or a hybrid of both. Understanding when to use the switch chip vs CPU is critical for performance.

CRS Architecture

Switch chip: Hardware forwarding at wire speed — handles VLANs, port isolation, trunks
CPU (RouterOS): Software processing — handles routing, firewall, queues

Rule: Always use the switch chip for L2 operations. Never route through CPU on a CRS.

VLAN Configuration on CRS (Bridge VLAN Filtering)

RouterOS 7 uses Bridge VLAN Filtering — the modern recommended approach.

Step 1: Create a bridge

BASH

/interface bridge
add name=br1 vlan-filtering=yes pvid=1 frame-types=admit-all

Step 2: Add ports to bridge

BASH

/interface bridge port
add bridge=br1 interface=ether1 pvid=10 frame-types=admit-only-untagged-and-priority-tagged
add bridge=br1 interface=ether2 pvid=20 frame-types=admit-only-untagged-and-priority-tagged
add bridge=br1 interface=ether3 frame-types=admit-only-vlan-tagged  # Trunk port

Step 3: Configure VLANs on bridge

BASH

/interface bridge vlan
add bridge=br1 vlan-ids=10 tagged=ether3 untagged=ether1
add bridge=br1 vlan-ids=20 tagged=ether3 untagged=ether2
add bridge=br1 vlan-ids=10,20 tagged=br1  # Management VLAN on CPU

Step 4: Assign IPs for management

BASH

/interface vlan
add name=vlan10-mgmt interface=br1 vlan-id=10
/ip address add address=192.168.10.1/24 interface=vlan10-mgmt

Inter-VLAN Routing on CRS

For CRS to route between VLANs (using CPU — only for low-traffic management):

BASH

/interface vlan
add name=vlan10 interface=br1 vlan-id=10
add name=vlan20 interface=br1 vlan-id=20

/ip address
add address=192.168.10.1/24 interface=vlan10
add address=192.168.20.1/24 interface=vlan20

Warning: Inter-VLAN routing goes through CPU, not the switch chip. For high-traffic inter-VLAN routing, use a dedicated router.

Port Isolation (Private VLAN)

Prevent ports from talking to each other (useful for hotels, apartments):

BASH

/interface bridge port
set [find interface=ether1] horizon=1
set [find interface=ether2] horizon=1
set [find interface=ether3] horizon=1
# Ports with same horizon cannot communicate with each other
# Only the uplink (no horizon) can reach all ports

STP/RSTP Configuration

Prevent loops in redundant topologies:

BASH

/interface bridge
set br1 protocol-mode=rstp priority=0x1000

# Set port cost for STP path calculation
/interface bridge port
set [find interface=ether1] path-cost=4  # Faster link = lower cost

Checking Switch Chip Usage

BASH

# Verify hardware offload is working
/interface bridge port print detail
# Look for "hw=yes" — this means the switch chip handles forwarding

# If hw=no, check why CPU is doing the forwarding
/interface bridge print detail

Common CRS Models

Model	Switch Chip	Ports	Routing
CRS305-1G-4S+	88E6393X	4x SFP+	Yes
CRS317-1G-16S+	98DX8216	16x SFP+	Limited
CRS354-48G-4S+2Q+	98DX3257	48x GbE	Yes

Best Practices

Enable vlan-filtering=yes on the bridge — this enables hw offload
Don't add unnecessary services to CRS — keep it as a switch
Use RSTP, not STP, for faster convergence (1-2 sec vs 30-50 sec)
Always keep a management VLAN separate from data VLANs
Monitor CPU usage — if it's high, something is being processed in software