Vlan, VOIP, grandstrem, mikrotik. How to isolate traffic?

Question

VoIP

Good afternoon, colleagues.
I have never worked with vlans. I am reading about them for the second week.
I try to set up in my test grid does not work. especially after removing the master port on Mikrotik, everything was mixed up in general. one guide says one another another.
in general, the essence of the problem:
The network is built on mikrotiks. almost everywhere in the network there are Grandstrem IP phones. I want to isolate VOIP separately from network traffic over the vlan. Tell me, is this even real? on cisco I know what is real and everything is ingenious and simple there, but with Mikrotik I still can’t give birth ...

Answer 1

on cisco I know what is real and everything is ingenious and simple there, but with Mikrotik I still can’t give birth ...

almost a paraphrase "skip physics at school and the whole world will be fabulous and magical for you")
you just need to smoke and understand what vlan is, and then all the magic and witchcraft will turn gray and become ordinary primitivism ...
yes, isolate voice traffic on Mikrotik, even more precisely, all telephony from hamsters with VKontakte and photos is simple, even probably using winbox, it will turn out to be a little faster to call than to scribble in cli ciss ... (at least for the average person who owns a mouse and types not like a professional typist)

Answer 2

In order:
1) Yes, you can isolate, even prioritize.
2) Yes, Mikrotiks have their own ideology.
3) What to do. Diagnostics of course:
a) We start ping from Mikrotik to the test ip-phone. Let it work all the time. The use of tracert is also not prohibited :)
b) Each interface and VLAN has a Torch button that shows which packets are running on this interface.
c) We pay great attention to the bridge tab. It is advisable not to include your experimental interface in any bridge for the duration of the tests.
d) Then we carefully look at the firewall, at the prohibiting rules.
e) Well, ip-> route
What is the purpose of diagnostics: abstract from the hardware vendor. Just imagine that in front of you is a la black box. Well, step by step, using all standard tools, make sure that the traffic "flies where it needs to." And for convenience, use winboxom at least for the first time.

Answer 3

on cisco I know what is real and everything is ingenious and simple there

If you have no problems understanding Vlan on a cisco, then just consider one thing - the terminology on Mikrots and ciscos is different. it is enough to understand that ciscos have trunk, access and native, and Mikrotas have tagged, untagged and default. Once you understand this, everything will work out as it should.
not just realistic, but even desirable.

Answer 4

It would be easier for you to suggest the right path if you specify the network structure - is Mikrotik used only for terminating vlan or are access switches also on them? SwOS or RouterOS on access switches? what models?

Answer 5

There is a good guide
https://youtu.be/Np7rAwvAzq4
Personally, my hands do not reach to make a video.
In short:
tik has several variations of vlan.
Historically, it was possible to configure via a switch chip or a software method.
At the same time, on 3xx series switches, everything goes in hardware.
The software method is moved to the bridge zone (I remind you that in the 3xx series it is hardware)
To understand certain possibilities for vlan and the rest, you need to look at the wiki on tik.
At the same time, on the 1xx / 2xx series, another vlan option is waiting for us (more precisely, the menu)
Yes, this is a pain, alas and ah.
Now about quickly setting up, I throw in the bridge option.
After all the sweeps, you can activate in the bridge vlan
I do not recommend doing this remotely without understanding, since there is a big risk of losing control of the piece of iron.
well, we create a vlan interface, if we need to distribute dhcp / dns there or do something in general.
It will not be clear, ask.
PVID - in simple terms, the default untaget port. Those if suddenly there is also a taget , and the device on the other side does not understand, it will receive the network that was set up.

Answer 6

If you have stupid L2 switches, then be aware that they can cut the vlan tag.

Answer 7

Use aggregation.

{$group: {
    _id: {$substr: ["$name", 0, 1]}, count: {$sum: 1}
}}

Answer 8

It is possible through map-reduce.
But by itself, such a request is not effective, because iterates over all the data. At least cache.