...
| Features | Description |
|---|---|
| Forwarding |
|
| Routing |
|
| Spanning Tree Protocol |
|
| Mirroring |
|
| VLAN |
|
| Bonding |
|
| Traffic Shaping |
|
| Port isolation |
|
| Access Control List |
|
...
| Model | Switch Chip | CPU | Cores | 10G SFP+ | 10G Ethernet | 25G SFP28 | 40G QSFP+ | 100G QSFP28 | ACL rules | Unicast FDB entries | Jumbo Frame (Bytes) |
| netPower 15FR (CRS318-1Fi-15Fr-2S) | Marvell-98DX224S | 800MHz | 1 | - | - | - | - | - | 128 | 16,000 | 10218 |
| netPower 16P (CRS318-16P-2S+) | Marvell-98DX226S | 800MHz | 1 | 2 | - | - | - | - | 128 | 16,000 | 10218 |
| CRS310-1G-5S-4S+ (netFiber 9/IN) | Marvell-98DX226S | 800MHz | 1 | 4 | - | - | - | - | 128 | 16,000 | 10218 |
| CRS326-24G-2S+ (RM/IN) | Marvell-98DX3236 | 800MHz | 1 | 2 | - | - | - | - | 128 | 16,000 | 10218 |
| CRS328-24P-4S+ | Marvell-98DX3236 | 800MHz | 1 | 4 | - | - | - | - | 128 | 16,000 | 10218 |
| CRS328-4C-20S-4S+ | Marvell-98DX3236 | 800MHz | 1 | 4 | - | - | - | - | 128 | 16,000 | 10218 |
| CRS305-1G-4S+ | Marvell-98DX3236 | 800MHz | 1 | 4 | - | - | - | - | 128 | 16,000 | 10218 |
| CRS309-1G-8S+ | Marvell-98DX8208 | 800MHz | 2 | 8 | - | - | - | - | 1024 | 32,000 | 10218 |
| CRS317-1G-16S+ | Marvell-98DX8216 | 800MHz | 2 | 16 | - | - | - | - | 1024 | 128,000 | 10218 |
| CRS312-4C+8XG | Marvell-98DX8212 | 650MHz | 1 | 4 (combo ports) | 8 + 4 (combo ports) | - | - | - | 512 | 32,000 | 10218 |
| CRS326-24S+2Q+ | Marvell-98DX8332 | 650MHz | 1 | 24 | - | - | 2 | - | 256 | 32,000 | 10218 |
| CRS354-48G-4S+2Q+ | Marvell-98DX3257 | 650MHz | 1 | 4 | - | - | 2 | - | 170 | 32,000 | 10218 |
| CRS354-48P-4S+2Q+ | Marvell-98DX3257 | 650MHz | 1 | 4 | - | - | 2 | - | 170 | 32,000 | 10218 |
| CRS504-4XQ -(IN/OUT) | Marvell-98DX4310 | 650MHz | 1 | - | - | - | - | 4 | 1024 | 128,000 | 10218 |
| CRS510-8XS-2XQ-IN | Marvell-98DX4310 | 650MHz | 1 | - | - | 8 | - | 2 | 1024 | 128,000 | 10218 |
| CRS518-16XS-2XQ | Marvell-98DX8525 | 650MHz | 1 | - | - | 16 | - | 2 | 1024 | 128,000 | 10218 |
| CCR2116-12G-4S+ | Marvell-98DX3255 | 2000MHz | 16 | 4 | - | - | - | - | 512 | 32,000 | 9570 |
| CCR2216-1G-12XS-2XQ | Marvell-98DX8525 | 2000MHz | 16 | - | - | 12 | - | 2 | 1024 | 128,000 | 9570 |
...
Since RouterOS v6.43 is it possible to create a Private VLAN setup, an example can be found in the Switch chip port isolation manual page. Hardware offloaded bonding interfaces are not included in the switch port-isolation menu, but it is still possible to configure port-isolation individually on each secondary interface of the bonding.
IGMP/MLD Snooping
| Note |
|---|
Port isolation can be used with vlan-filtering bridge and it is possible to isolate ports that are members of the same VLAN. The isolation works per-port, it is not possible to isolate ports per-VLAN. |
IGMP/MLD Snooping
...
CRS3xx, CRS5xx series switches and CCR2116, CCR2216 routers are capable of using CRS3xx, CRS5xx series switches and CCR2116, CCR2216 routers are capable of using IGMP/MLD Snooping on a hardware level. To see more detailed information, you should check out the IGMP/MLD snooping manual page.
...
Controller Bridge (CB) and Port Extender (PE) is an IEEE 802.1BR standard implementation in RouterOS. It allows virtually extending the CB ports with a PE device and managing these extended interfaces from a single controlling device. Such configuration provides a simplified network topology, flexibility, increased port density, and ease of manageability. See more details on Controller Bridge and Port Extender manual.
Mirroring
...
Mirroring lets the switch sniff all traffic that is going in a switch chip is a function that allows a network switch to duplicate all the data passing through it and send a copy of those packets out to another specified port (, known as the mirror-target). This feature can be used to easily set is useful for setting up a tap device that allows you to inspect the traffic on your network on a traffic analyzer device. It is possible to set up a simple port-based mirroring, but it is also possible to set up more complex mirroring based on various parameters. Note that mirror-target port has to belong to the same switch (see which port belongs to which switch in /interface ethernet menu). Also, mirror-target can have a special 'cpu' value, which means that sniffed packets will be sent out of switch chips CPU port. There are many possibilities that can be used to mirror certain traffic, below you can find the most common mirroring examples:, which allows for analyzing network traffic using a separate device. You can set up mirroring in a simple way by designating source ports (see mirror-egress and mirror-ingress in /interface/ethernet/switch/port), or you can configure more advanced mirroring based on different criteria (see mirror in /interface/ethernet/switch/rule).
It is important to note that the mirror-target port must be on the same switch. You can check the device block diagram or navigate to the /interface/ethernet menu to identify which interfaces are connected where. When setting up the configration, it is not mandatory to add the mirror-target interface to the same hardware offloaded bridge where the source ports are set up. The mirror-target port can be a standalone interface (not configured as a bridge port), or it can be within a bridge setup. When using the mirror-target with a bridge, note that data and mirrored traffic may both travel on the same LAN. In such cases, consider employing RSPAN (Remote Switch Port Analyzer), where mirrored traffic is encapsulated into a separate VLAN before being transmitted over the network.
Additionally, you can set the mirror-target port to a special value "cpu", which means that the copied packets will be sent to the switch chip's CPU port.
Configuration examples
Port Based Mirroring
Starting from RouterOS version 7.15, it is possible to configure multiple source ports and selectively choose whether to mirror incoming traffic, outgoing traffic, or both. In this example, both incoming and outgoing traffic from the ether2 interface will be copied and sent to the ether3 interface for monitoring or analysis.Port Based Mirroring:
| Code Block | ||
|---|---|---|
| ||
/interface# ethernet switch set switch1Since RouterOS v7.15 /interface ethernet switch port set ether2 mirror-sourceegress=ether2yes mirror-target=ether3 |
| Note |
|---|
Property |
| Code Block | ||
|---|---|---|
| ||
ingress=yes /interface ethernet switch set switch1 mirror-source=none mirror-target=ether3 # Older RouterOS: /interface ethernet switch set rule addswitch1 mirror=yes ports=ether1,-source=ether2 switchmirror-target=switch1ether3 |
VLAN Based Mirroring
Using ACL rules, it is possible to mirror packets from multiple
...
interfaces using the ports setting. Additionally, you can specify more detailed criteria such as VLAN ID, MAC/IP address or TCP/UDP port. Only ingress packets are mirrored to mirror-target interface.
...
This example will mirror incoming VLAN 11 traffic from the ether2 interface, and send copies to the ether3 interface. To use an ACL rule with a vlan-id matcher, you need to have bridge vlan-filtering enabled.
| Code Block | ||
|---|---|---|
| ||
/interface bridge
set bridge1 vlan |
VLAN Based Mirroring:
| Code Block | ||
|---|---|---|
| ||
/interface bridge set bridge1 vlan-filtering=yes /interface ethernet switch set switch1 mirror-target=ether3 mirror-source=none /interface ethernet switch rule add mirror=yes ports=ether1 switch=switch1 vlan-id=11 |
| Warning |
|---|
By enabling |
MAC Based Mirroring
This example will mirror incoming traffic with 64:D1:54:D9:27:E6 MAC destination or source address from the ether1 interface, and send copies to the ether3 interface.MAC Based Mirroring:
| Code Block | ||
|---|---|---|
| ||
/interface ethernet switch
set switch1 mirror-target=ether3 mirror-source=none
/interface ethernet switch rule
add mirror=yes ports=ether1 switch=switch1 dst-mac-address=64:D1:54:D9:27:E6/FF:FF:FF:FF:FF:FF
add mirror=yes ports=ether1 switch=switch1 src-mac-address=64:D1:54:D9:27:E6/FF:FF:FF:FF:FF:FF |
IP Based Mirroring
This example will mirror incoming traffic with 192.168.88.0/24 IP destination or source address from the ether1 interface, and send copies to the ether3 interface.Protocol Based Mirroring:
| Code Block | ||
|---|---|---|
| ||
/interface ethernet switch set switch1 mirror-target=ether3 mirror-source=none /interface ethernet switch rule add mirror=yes ports=ether1 switch=switch1 macsrc-protocol=ipx |
IP Based Mirroring:
| Code Block | ||
|---|---|---|
| ||
/interface ethernet switch set switch1 mirror-target=ether3 mirror-source=none /interface ethernet switch rule address=192.168.88.0/24 add mirror=yes ports=ether1 switch=switch1 src-address=192.168.88.0/24 add mirror=yes ports=ether1 switch=switch1 dst-address=192.168.88.0/24 |
There are other options as well, check the ACL section to find out all possible parameters that can be used to match packetsthe ACL section to find out all possible parameters that can be used to match packets.
Remote Switch Port Analyzer
This example will mirror incomming and outgoing traffic from the ether2 interface, copies will be encapsulated in 802.1Q VLAN using the 999 as VLAN ID, and packets will be sent to the ether3 interface. If the original traffic is already VLAN tagged, RSPAN will add another layer of VLAN tagging as an outer tag. This results in the mirrored traffic being tagged twice. If the mirror-target port is included in vlan-filtering bridge, it is not required to make the interface as tagged VLAN member under the /interface/bridge/vlan menu for the RSPAN.
| Code Block | ||
|---|---|---|
| ||
/interface ethernet switch port
set ether2 mirror-egress=yes mirror-ingress=yes
/interface ethernet switch
set switch1 mirror-target=ether3 rspan=yes rspan-egress-vlan-id=999 rspan-ingress-vlan-id=999 |
Property Reference
Sub-menu: /interface/ethernet/switch
| Property | Description |
|---|---|
| mirror-target (cpu | name | none; Default:none) | Selects a single mirroring target port. Packets from |
| rspan (no | yes; Default: no) | Enables Remote Switch Port Analyzer (RSPAN) feature on mirror-target. Traffic marked for ingress or egress mirroring is carried over a specified remote analyzer VLAN - rspan-egress-vlan-id and rspan-ingress-vlan-id. |
| rspan-egress-vlan-id (integer: 1..4095; Default: 1) | Selects the VLAN ID for marked egress traffic. Only applies when rspan is enabled. |
| rspan-ingress-vlan-id (integer: 1..4095; Default: 1) | Selects the VLAN ID for marked ingress traffic. Only applies when rspan is enabled. |
Sub-menu: /interface/ethernet/switch/port
| Property | Description |
|---|---|
| mirror-egress (no | yes; Default: no) | Whether to send egress packet copy to the |
| mirror-ingress (no | yes; Default: no) | Whether to send ingress packet copy to the |
Sub-menu: /interface/ethernet/switch/rule
| Property | Description |
|---|---|
| mirror (no | yes; Default: no) | Whether to send a packet copy to mirror-target port. |
Traffic Shaping
...
It is possible to limit ingress traffic that matches certain parameters with ACL rules and it is possible to limit ingress/egress traffic per port basis. The policer is used for ingress traffic, the shaper is used for egress traffic. The ingress policer controls the received traffic with packet drops. Everything that exceeds the defined limit will get dropped. This can affect the TCP congestion control mechanism on end hosts and achieved bandwidth can be actually less than defined. The egress shaper tries to queue packets that exceed the limit instead of dropping them. Eventually, it will also drop packets when the output queue gets full, however, it should allow utilizing the defined throughput better.
...
| Note |
|---|
Currently only |
| Warning |
|---|
The MPLS hardware offloading has been removed since RouterOS v7. |
Switch Rules (ACL)
...
Access Control List contains ingress policy and egress policy engines. See this table on how many rules each device supports. It is an advanced tool for wire-speed packet filtering, forwarding and modifying based on Layer2, Layer3 and Layer4 protocol header field conditions.
| Note |
|---|
ACL rules are checked for each received packet until a match has been found. If there are multiple rules that can match, then only the first rule will be triggered. A rule without any action parameters is a rule to accept the packet. |
| Note |
|---|
It is not required to set |
| Note |
|---|
When switch ACL rules are modified (e.g. added, removed, disabled, enabled, or moved), the existing switch rules will be inactive for a short time. This can cause some packet leakage during the ACL rule modifications. |
...
| Property | Description |
|---|---|
| copy-to-cpu (no | yes; Default: no) | Clones the matching packet and sends it to the CPU. |
| disabled (yes | no; Default: no) | Enables or disables ACL entry. |
| dscp (0..63) | Matching the DSCP field of the packetof the packet (only applies to IPv4 packets). |
| dst-address (IP address/Mask) | Matching destination IP IPv4 address and mask, also matches the destination IP in ARP packets. |
| dst-address6 (IPv6 address/Mask) | Matching destination IPv6 address and mask, also matches source IP in ARP packets. |
| dst-mac-address (MAC address/Mask) | Matching destination MAC address and mask. |
| dst-port (0..65535) | Matching destination protocol port number (applies to IPv4 and IPv6 packets if mac-protocol is not specified). |
| flow-label (0..1048575) | Matching IPv6 flow label. |
| mac-protocol (802.2 | arp | homeplug-av | ip | ipv6 | ipx | lldp | loop-protect | mpls-multicast | mpls-unicast | packing-compr | packing-simple | pppoe | pppoe-discovery | rarp | service-vlan | vlan | or 0..65535 | or 0x0000-0xffff) | Matching particular MAC protocol specified by protocol name or number |
| mirror (no | yes) | Clones the matching packet and sends it to the mirror-target port. |
| new-dst-ports (ports) | Changes the destination port as specified. An empty setting will drop the packet. A specified port will redirect the packet to it. When the parameter is not used, the packet will be accepted. Multiple "new-dst-ports" are not supported. |
| new-vlan-id (0..4095) | Changes the VLAN ID to the specified value. Requires vlan-filtering=yes. |
| new-vlan-priority (0..7) | Changes the VLAN priority (priority code point). Requires vlan-filtering=yes. |
| ports (ports) | Matching ports on which will the rule apply on received traffic. |
| protocol (dccp | ddp | egp | encap | etherip | ggp | gre | hmp | icmp | icmpv6 | idpr-cmtp | igmp | ipencap | ipip | ipsec-ah | ipsec-esp | ipv6 | ipv6-frag | ipv6-nonxt | ipv6-opts | ipv6-route | iso-tp4 | l2tp | ospf | pim | pup | rdp | rspf | rsvp | sctp | st | tcp | udp | udp-lite | vmtp | vrrp | xns-idp | xtp | or 0..255) | Matching particular IP protocol specified by protocol name or number. Only applies to IPv4 packets if mac-protocol is not specified. To match certain IPv6 protocols, use the mac-protocol=ipv6 setting. |
| rate (0..4294967295) | Sets ingress traffic limitation (bits per second) for matched traffic. |
| redirect-to-cpu (no | yes) | Changes the destination port of a matching packet to the CPU. |
| src-address (IP address/Mask) | Matching source IP IPv4 address and mask, also matches the source IP in ARP packets. |
| src-address6 (IPv6 address/Mask) | Matching source IPv6 address and mask. |
| src-mac-address (MAC address/Mask) | Matching source MAC address and mask. |
| src-port (0..65535).65535) | Matching source protocol port number (applies to IPv4 and IPv6 packets if mac-protocol is not specified)Matching source protocol port number. |
| switch (switch group) | Matching switch group on which will the rule apply. |
| traffic-class (0..255) | Matching IPv6 traffic class. |
| vlan-id (0..4095) | Matching VLAN ID. Requires vlan-filtering=yes. |
| vlan-header (not-present | present) | Matching VLAN header, whether the VLAN header is present or not. Requires vlan-filtering=yes. |
| vlan-priority (0..7) | Matching VLAN priority (priority code point). |
...
| Warning |
|---|
When bridge interface |
Port Security
...
It is possible to limit allowed MAC addresses on a single switch port. For example, to allow 64:D1:54:81:EF:8E MAC address on a switch port, start by switching multiple ports together, in this example 64:D1:54:81:EF:8E is going to be located behind ether1.
...
| Note |
|---|
The configuration will be saved on the same device with |
...
| Note |
|---|
The upgrade command will automatically install the latest available SwOS primary backup version, make sure that your device has access to the Internet in order for the upgrade process to work properly. When the device is booted into SwOS, the version number will include the letter "p", indicating a primary backup version. You can then install the latest available SwOS secondary main version from the SwOS "Upgrade" menu. |
| Property | Description |
|---|---|
| address-acquisition-mode (dhcp-only | dhcp-with-fallback | static; Default: dhcp-with-fallback) | Changes address acquisition method: dhcp-only - uses only a DHCP client to acquire address dhcp-with-fallback - for the first 10 seconds will try to acquire address using a DHCP client. If the request is unsuccessful, then address falls back to static as defined by static-ip-address property static - address is set as defined by static-ip-address property |
| allow-from (IP/Mask; Default: 0.0.0.0/0) | IP address or a network from which the switch is accessible. By default, the switch is accessible by any IP address. |
| allow-from-ports (name; Default: ) | List of switch ports from which the device is accessible. By default, all ports are allowed to access the switch |
| allow-from-vlan (integer: 0..4094; Default: 0) | VLAN ID from which the device is accessible. By default, all VLANs are allowed |
| identity (name; Default: Mikrotik) | Name of the switch (used for Mikrotik Neighbor Discovery protocol) |
| static-ip-address (IP; Default: 192.168.88.1) | IP address of the switch in case address-acquisition-mode is either set to dhcp-with-fallback or static. By setting a static IP address, the address acquisition process does not change, which is DHCP with fallback by default. This means that the configured static IP address will become active only when there is going to be no DHCP servers in the same broadcast domain |
...