Mikrotik CRS326-24G-2S+ (RouterOS 6.49.5)

Forwarding

• Full non-blocking wirespeed switching

• Large Unicast FDB for Layer 2 unicast forwarding

• Forwarding Database works based on SVL or IVL

• Port Isolation

• Jumbo frame support - 10218 bytes

VLAN

• Fully compatible with IEEE802.1Q

• Port-based VLAN

• Up to 250 VLAN entries (limited by SwOS)

• VLAN filtering

Multicast Forwarding

• IGMP Snooping support

• Unknown Multicast Filtering

Access Control List

• Ingress ACL tables

• Up to 32 ACL rules (limited by SwOS)

• Classification based on ports, L2, L3, L4 protocol header fields

• ACL actions include filtering, forwarding, and modifying the protocol header fields

Quality of Service (QoS)

• Ingress traffic limiting

Security

• Port Lock

• Broadcast Storm Control

• DHCP & PPPoE Snooping

Mirroring

• Port-based mirroring

Spanning Tree Protocol

• RSTP support

Link Aggregation

• Supports 802.3ad LACP groups

• Supports static link aggregation groups

• Up to 16 link aggregation groups

• Up to 8 member ports per a group

• Hardware automatic failover and load balancing

Model

Switch Chip

Serial console

Dual Boot

PoE-in support

PoE-out support

Health monitor

CSS326-24G-2S+

Marvell-98DX3216

-

SwOS

ether1, Passive PoE

-

CPU temperature

CRS326-24G-2S+

Marvell-98DX3236

+

RouterOS/SwOS

ether1, Passive PoE

-

CPU temperature

CRS328-24P-4S+

Marvell-98DX3236

+

RouterOS/SwOS

-

ether1 - ether24, 802.3af/at

CPU and board temperature, fan speed, PSU voltage and current, PoE-out monitoring

CRS328-4C-20S-4S+

Marvell-98DX3236

+

RouterOS/SwOS

-

-

CPU temperature, fan speed, PSU state

CRS317-1G-16S+

Marvell-98DX8216

+

RouterOS/SwOS

-

-

CPU temperature, fan speed, PSU state

CRS305-1G-4S+

Marvell-98DX3236

-

RouterOS/SwOS

ether1, 802.3af/at

-

CPU temperature

CRS309-1G-8S+

Marvell-98DX8208

+

RouterOS/SwOS

ether1, 802.3af/at

-

CPU temperature

CRS312-4C+8XG

Marvell-98DX8212

+

RouterOS/SwOS

-

-

CPU temperature, fan speed, PSU state

CRS326-24S+2Q+

Marvell-98DX8332

+

RouterOS/SwOS

-

-

CPU temperature, fan speed, PSU state

CRS318-16P-2S+

Marvell-98DX226S

-

RouterOS/SwOS

-

ether1 - ether16, 802.3af/at

CPU temperature, PSU voltage and current, PoE-out monitoring.

CRS318-1Fi-15Fr-2S

Marvell-98DX224S

-

RouterOS/SwOS

ether1-ether14, ether16, Passive PoE

ether15, Passive PoE

CPU temperature

CRS354-48G-4S+2Q+

Marvell-98DX3257

+

RouterOS/SwOS

-

-

CPU and board temperature, fan speed, PSU voltage and current

CRS354-48P-4S+2Q+

Marvell-98DX3257

+

RouterOS/SwOS

-

ether1 - ether48, 802.3af/at

CPU and board temperature, fan speed, PSU voltage and current, PoE-out monitoring

Address Acquisition

Specify which address acquisition method to use:

• DHCP with fallback - switch is trying to request an IP address from a DHCP server. If the requests are unsuccessful, then the switch can be accessed using a Static IP Address value

• static - address is set as a Static IP Address value

• DHCP only - switch uses DHCP client to acquire address

Static IP Address

IP address of the switch in case of Address Acquisition is set as DHCP with fallback or static

Identity

Name of the switch (for Mikrotik Neighbor Discovery protocol)

Allow From

IP address from which the switch is accessible. Default value is '0.0.0.0/0' - any address

Allow From Ports

List of switch ports from which it is accessible

Allow From VLAN

VLAN ID from which the service is accessible. Make sure to first configure VLANs and VLAN pages

Watchdog

Enable or disable system Watchdog. It will reset CPU of the switch in case of fault condition

Independent VLAN Lookup

Enable or disable independent VLAN lookup in the Host table for packet forwarding

IGMP Snooping

Enable or disable IGMP Snooping

IGMP Fast Leave

Enables or disables IGMP fast leave feature on the switch port. This property only has an effect when IGMP Snooping is enabled.

Mikrotik Discovery Protocol

Enable or disable Mikrotik Neighbor Discovery protocol

MAC Address

MAC address of the switch (read-only)

Serial Number

Serial number of the switch (read-only)

Board Name

MikroTik model name of the switch (read-only)

Uptime

Current switch uptime (read-only)

Temperature

Shows CPU temperature in celsius temperature scale (read-only, CSS326-24G-2S+, CRS326-24G-2S+, CRS305-1G-4S+, CRS309-1G-8S+, CRS318-1Fi-15Fr-2S models only)

Trusted Ports

Group of ports, which allows DHCP or PPPoE servers to provide a requested information. Mainly used to limit unauthorized servers to provide malicious information for users, access ports usually do not configure as trusted

Add Information Option

Enables or disables DHCP Option-82 information. When enabled, the Option-82 information (Agent Remote ID and Circuit ID) is added for DHCP packets received from untrusted ports. Can be used together with Option-82 capable DHCP server to assign IP addresses and implement policies.

For Agent Remote ID, SwOS uses interface name where DHCP client resides. For Agent Circuit ID, SwOS uses identity of the SwOS device, internally used port ID and VLAN ID. For example:

Agent Remote ID - Port1

Agent Circuit ID - MikroTik eth 0/1:100

Enabled

Enable or disable port

Name

Editable port name

Link Status

Current link status (read-only)

Auto Negotiation

Enable or disable auto-negotiation

Speed

Specify speed setting of the port (requires auto-negotiation to be disabled)

Full Duplex

Specify the duplex mode of the port (requires auto-negotiation to be disabled)

Flow control Tx/Rx

Enable or disable 802.3x Flow control

PoE Out

Specifies PoE-Out state:

• auto - the board will attempt to detect if power can be applied to the port. For powering there should be resistance in the range from 3kΩ to 26.5kΩ

• on - detection range is removed. As a result power over Ethernet will be always on

• off - all detection and power is turned off for this port

PoE Priority

The PoE Priority specifies the importance of PoE-Out ports, in cases when a total PoE-Out limit is reached, interface with the lowest port priority will be powered off first.

Highest priority is 1, lowest priority is 8. If there are 2 or more ports with the same priority then port with the smallest port number will have a higher priority. For example, if ether2 and ether3 have the same priority and over-current is detected then PoE-Out on ether3 will be turned off.

Every 6 seconds ports will be checked for a possibility to provide PoE-Out if it was turned off due to port priority.

Voltage Level

Feature which allows to manually switch between two voltage outputs on PoE-Out ports. Will take effect only on PSE with switchable voltage modes (CRS328-24P-4S+RM, netPower 16P, CRS354-48P-4S+2Q+RM).

PoE Status

Shows current PoE-Out status on port:

• powered on - power is applied to the port, and PoE-Out is operating normally,

• waiting for load - PSE attempts to detect if power can be applied to the port. For powering there should be resistance in the range from 3kΩ to 26.5kΩ,

• short circuit - short-circuit is detected on PoE-Out port, power is switched off, the only detection with low voltage takes place,

• overload - the PoE-Out current limit is exceeded, power is switched off on PoE-Out port. For port limits see each model specifications,

• disabled - all detection and power is turned off for this port,

• voltage too low - PD can not be powered with the voltage provided from PSE,

• current too low - means that PD draws too low current  (<10mA) than normal PoE-Out device should, the reason for this can be:

The delivered voltage at PD is too low for normal powering (for example Vmin =>30V, but provided 24V);

PD uses a second power source which has a higher voltage than PSE, so all current is taken from the second DC source, not PSE PoE-Out port.

PoE Current

Shows current usage on the port measured in milliamperes

PoE Voltage

Shows voltage on the port measured in volts

PoE Power

Shows PoE out power on the port measured in watts

Mode (default: passive)

Specify LACP packet exchange mode or Static LAG mode on ports:

• Passive: Places port in listening state, use LACP only when its contrary port uses active LACP mode

• Active: Prefers to start LACP regardless of contrary port mode

• Static: Sets port in a Static LAG mode, it requires to set the same Group setting for all ports that need to be included in the same static LAG

Group

Specify a Static LAG group.

Trunk (read-only)

Represents group number port belongs to.

Partner (read-only)

Represents partner mac-address, only available when ports are included in LACP.

Port Lock

• Port Lock - Enables or disables MAC address learning on this port. When the option is enabled, it will restrict MAC address learning and static MAC addresses should be configured. Any received frames with unknown source MAC address will be dropped

• Lock On First - Allows to learn source MAC address from the first received frame, this property should be used together with Port Lock. Learning of the first MAC address will reset every time an interface status changes

Port Mirroring

• Mirror Ingress - Whether traffic entering this port must be copied and forwarded to the mirroring target port

• Mirror Egress - Whether traffic leaving this port must be copied and forwarded to the mirroring target port

• Mirror To - Mirroring target port

Broadcast Storm Control

• Storm Rate (%) - Limit the number of broadcast packets transmitted by an interface. The rate is measured in percents of the link speed.

• Include Unknown Unicast - Include unicast packets without an entry in the host table in Storm Rate limitation

Multicast Flood Control

• Flood Unknown Multicast - Changes the multicast flood option on a switch port, only controls the egress traffic. When enabled, the bridge allows flooding multicast packets to the specified switch port, but when disabled, it restricts multicast traffic from being flooded. The setting affects all multicast traffic, this includes non-IP, IPv4, IPv6 and the link-local multicast ranges (e.g. 224.0.0.0/24 and ff02::1).

Bandwidth Limit

• Ingress Rate - Limit traffic entering this port (bps)

Bridge Priority (hex)

RSTP bridge priority for Root Bridge selection

Port Cost Mode

There are two methods for automatically detecting RSTP port cost depending on link speed.

• short: 40G - 1; 10G - 2; 1G - 4; 100M - 10; 10M - 100

• long: 40G - 500; 10G - 2000; 1G - 20000; 100M - 200000; 10M - 2000000

Root Bridge

The priority and MAC address of the selected Root Bridge in the network (read-only)

RSTP

Enable or disable STP/RSTP functionality on this port

Mode

Shows STP/RSTP functionality mode on a specific port (read-only):

• RSTP

• STP

Role

Shows specific port role (read-only):

• root - port that is facing towards the root bridge and will be used to forward traffic from/to the root bridge

• alternate - port that is facing towards root bridge, but is not going to forward traffic (a backup for root port)

• backup - port that is facing away from the root bridge, but is not going to forward traffic (a backup for non-root port)

• designated - port that is facing away from the root bridge and is going to forward traffic

• disabled - port that is not strictly part of STP (RSTP functionality is disabled)

Root Path Cost

Shows root path cost for ports that are facing root bridge (read-only)

Type

• edge - ports that are not supposed to receive any BPDUs, should be connected to the end station (read-only)

• point-to-point - ports that operate in full-duplex links, can be part of STP and operate in a forwarding state (read-only)

State

Shows each port state (read-only):

• forwarding - port participates in traffic forwarding and is learning MAC addresses, is receiving BPDUs

• discarding - port does not participate in traffic forwarding and is not learning MAC addresses, is receiving BPDU

• learning - port does not participate in traffic forwarding but is learning MAC addresses

VLAN Mode (disabled | optional | enabled | strict; Default: optional)

VLAN filtering mode, these options are relevant to egress ports (except for strict mode).

• disabled - VLAN table is not used. The switch discards packets with a VLAN tag on egress ports. If the packet has a VLAN tag and the VLAN ID matches Default VLAN ID on egress ports, then with VLAN Receive=any the switch will remove the VLAN tag and forward the packet.

• optional - Disabled VLAN filtering. Handle packets with VLAN tag ID that is not present in the VLAN table just like packets without VLAN tag.

• enabled - Enabled VLAN filtering. Drop packets with VLAN tag ID that is not present in the VLAN table. Default VLAN ID must be specified for access ports since it will be used to tag ingress traffic and untag egress traffic for a certain port.

• strict - Enabled VLAN filtering with additional ingress filtering, which checks if the ingress port is a member of the received VLAN ID in the VLAN table. Received packets on the ingress port with a VLAN ID that does not match with the VLAN table will be dropped. Default VLAN ID must be specified for access ports since it will be used to tag ingress traffic and untag egress traffic for a certain port.

VLAN Receive (any | only tagged | only untagged; Default: optional)

Received traffic filtering based on VLAN tag presence.

• any - allows tagged and untagged packets on a certain port

• only tagged - allows only packets with a VLAN tag. The "Default VLAN ID" will not work, because it only applies for untagged traffic

• only untagged - Allows only packets without a VLAN tag

Default VLAN ID (integer: 1..4095; Default: 1)

The switch will place received untagged packets in the "Default VLAN ID" VLAN. Only has an effect on untagged traffic, and when VLAN Receive is set to "any" or "only untagged". It does not apply for tagged traffic. This parameter is usually used to allocate access ports with specific VLAN. It is also used to untag egress traffic if the packet's VLAN ID matches Default VLAN ID.

Force VLAN ID (integer: yes | no; Default: no)

Assigns the Default VLAN ID value to all ingress traffic (tagged and untagged). Has effect in all VLAN Modes. If the port receives tagged traffic and Default VLAN ID is set to 1, then with this parameter the egress traffic will be untagged.

VLAN ID (integer: 1..4095; Default: 0)

VLAN ID to which assign ports.

Name (text; Default: )

Short description of the VLAN.

Port Isolation (yes | no; Default: yes)

Use settings from Port Isolation menu to isolate the defined VLAN to only certain ports. When disabled, the switch will ignore port isolation configuration and forward traffic with the defined VLAN ID only to ports that are checked as members.

Learning (yes | no; Default: yes)

Enables or disables MAC address learning on the defined VLAN. If disabled, then all learned MAC addresses will appear as they have had been learned from VLAN 1.

Mirror (yes | no; Default: no)

Enables or disables VLAN-based mirroring. When enabled and Mirror To is set in the Forwarding menu, then all traffic from the defined VLAN will be mirrored to the selected port.

IGMP Snooping (yes | no; Default: no)

Enables or disables IGMP Snooping on the defined VLAN. When enabled, the switch will listen to IGMP Join and Leave requests from the defined VLAN and only forward traffic to ports, which have sent IGMP membership requests from the defined VLAN. When disabled, the switch will flood all VLAN member ports with Multicast traffic.

Members (ports; Default: none)

Group of ports, which are allowed to forward traffic on the defined VLAN.

Ports

Ports the packet should be forwarded to

MAC

MAC address

VLAN ID

VLAN ID

Drop

A packet with certain MAC address coming from certain ports can be dropped

Mirror

A packet can be cloned and sent to mirror-target port

Port (read-only)

Ports the packet should be forwarded to

MAC (read-only)

Learned MAC address

VLAN ID (read-only)

Learned VLAN ID

Enabled

Enable or disable SNMP service

Community

SNMP community name

Contact Info

Contact information for the NMS

Location

Location information for the NMS

From

A port that packet came in from

MAC Src

Source MAC address and mask

MAC Dst

Destination MAC address and mask

Ethertype

Protocol encapsulated in the payload of an Ethernet Frame

VLAN

VLAN header presence:

• any

• present

• not present

VLAN ID

VLAN tag ID

Priority

Priority in VLAN tag

IP Src (IP/netmask:port)

Source IPv4 address, netmask, and L4 port number

IP Dst (IP/netmask:port)

Destination IPv4 address, netmask, and L4 port number

Protocol (integer)

IP protocol

DSCP

IP DSCP field

Redirect To

Force new packets destination port

Mirror

Clones packet and sends it to mirror-target port

Rate

Limits bandwidth (bps)

Drop

Drop packet

Set VLAN ID

Changes the VLAN tag ID, if VLAN tag is present

Priority

Changes the VLAN tag priority bits, if VLAN tag is present

CPU Temperature

Shows CPU temperature in celsius temperature scale (read-only)

Board Temperature

Shows PCB temperature in celsius temperature scale (read-only)

FAN

Shows FAN rotational speed (read-only)

PSU

Shows PSU related information depending on device model (read-only):

• PSU state, either failed or ok (for CRS328-20S-4C-4S+, CRS317-1G-16S+, CRS312-4C+8XG, CRS326-24S+2Q+)

• PSU voltage and consumed miliamperes by PoE-out connected devices (CRS328-24P-4S+, CRS318-16P-2S+)