SwOS lite 2.17 - Violation of broadcast domain isolation with DHCP Option-82 "Add Information Option"

Sumpfdotter · Fri Jan 26, 2024 12:52 am

Hi!

I'm using SwOS lite 2.17 on a MikroTik CSS610-8G-2S+IN Switch. The switch is new and it's my first MirkoTik. Better late than never!

Port nr. 7 is connected to the LAN port of a standard internet router (Fritzbox 5530).
Port nr. 7 is configured to be a member of VLAN 34 only (no other VLAN selected) in strict mode/only untagged/default VLAN ID 34/force VLAN ID disabled
Ports 1&2 are configured as LAG 1 being member of all VLANs (tagged only). They are connected to another switch.

I have DHCP clients on multiple VLANs, meaning their DHCP discover packets will receive the mikrotik on LAG 1 as broadcasts (DHCP) and IPv6 multicasts (DHCPv6). These requests for sure are tagged with some VLAN tag - depending on the network they are coming from. But I'm talking about a devices not being in VLAN 34. E.g. there is a printer device in VLAN 3057.

Now I discovered that the Fritzbox received their DHCP requests although Port 7 is strict and not a member of any of these VLANs. I wiresharked it, filtered for that printer's MAC and discovered this: The broadcast packets received in VLAN 3057 on LAG1 are emitted on port 7 although port 7 is not a member of that VLAN:

Bildschirmfoto 2024-01-25 um 23.35.16.png

For me at first glance it looks like a bug in SwOS that violates the separation of broadcast domains? Of course I'm considering an error in ISO/OSI layer 8, so my question: Is there some setting I might have overlooked or some concept I might have misunderstood?

I found some reports in this forum about IVL, but I don't have duplicate mac addresses.

If somebody could give me a hint would be great! Thank you & cheers!
Sumpfdotter

--
Addition:
I reproduced this behaviour with pretty default settings: I reset the switch completely and attached only two devices to it. Then I emitted the broadcast packet I caputered (tagged for VLAN 3057) on one device and I received it with the other - that's okay because in default settings all ports are in VLAN mode "optional". Now I set the receiving port to "strict/untagged only" and assigned it to Default VLAN ID 2. Now VLAN 3057 MUST not be received by that port anymore, right? But it did - that dedicated broadcast package was transmitted again. I will file a bug attaching all the files. Support ticket SUP-142030.

k6ccc · Tue Jan 30, 2024 12:35 am

Post a screen capture of the VLAN and VLANs tabs on the switch.

Sumpfdotter · Mon Feb 05, 2024 11:30 pm

Post a screen capture of the VLAN and VLANs tabs on the switch.

Thank you much! The bug is already confirmed and reproduced by MikroTik. A fix may appear in one of the next versions. Luckily they found a workaround: Disable the "Add Information Option" setting under the SwOS System page - if you don't need DHCP Option-82.

For those being interested, here the steps to reproduce:

Set the switch to default settings
Go to page VLAN and set port 7 to mode “strict/untagged only” and set Default VLAN ID to 2
Plug a receiving device into port 7
Plug a sending device into port 1
Send the packet to port 1. The packet is tagged with VLAN tag 3057

Observed Behavior:

The switch emits the packet as is (incl. VLAN tag 3057) on port 7

Expected Behavior:

The switch does not forward the package of VLAN 3057 to port 7

Here's the VLAN page:

2024-01-26_CSS610-8G-2S+IN_SwOS_Lite_v2.17_DomainIsolationError_ReproductionPacket_VLAN.png

On VLANs I didn't change anything (default settings).

Here's the package:

0000   ff ff ff ff ff ff 1c c1 de 16 76 1c 81 00 0b f1   ..........v.....
0010   08 00 45 00 01 c9 ea 36 40 00 20 11 6e ee 00 00   ..E....6@. .n...
0020   00 00 ff ff ff ff 00 44 00 43 01 b5 b8 80 01 01   .......D.C......
0030   06 00 0b 90 bd 85 00 2c 00 00 00 00 00 00 00 00   .......,........
0040   00 00 00 00 00 00 00 00 00 00 1c c1 de 16 76 1c   ..............v.
0050   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0060   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0070   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0080   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0090   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
00a0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
00b0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
00c0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
00d0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
00e0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
00f0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0100   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0110   00 00 00 00 00 00 00 00 00 00 63 82 53 63 35 01   ..........c.Sc5.
0120   01 32 04 c0 a8 67 39 39 02 02 40 37 13 01 03 2c   .2...g99..@7...,
0130   06 07 0c fc 0f 16 36 3a 3b 45 12 2b 77 51 99 9a   ......6:;E.+wQ..
0140   0c 08 68 70 34 30 32 35 64 6e 33 04 ff ff ff ff   ..hp4025dn3.....
0150   3c 19 48 65 77 6c 65 74 74 2d 50 61 63 6b 61 72   <.Hewlett-Packar
0160   64 20 4a 65 74 44 69 72 65 63 74 3d 07 01 1c c1   d JetDirect=....
0170   de 16 76 1c 4d 47 46 4d 66 67 3d 48 50 3b 54 79   ..v.MGFMfg=HP;Ty
0180   70 3d 50 72 69 6e 74 65 72 3b 4d 6f 64 3d 48 50   p=Printer;Mod=HP
0190   20 43 6f 6c 6f 72 20 4c 61 73 65 72 4a 65 74 20    Color LaserJet 
01a0   43 50 34 30 32 30 20 53 65 72 69 65 73 3b 53 65   CP4020 Series;Se
01b0   72 3d 4a 50 42 54 42 38 38 47 39 56 3b 51 19 01   r=JPBTB88G9V;Q..
01c0   00 00 68 70 34 30 32 35 64 6e 2e 68 6f 6d 65 2e   ..hp4025dn.home.
01d0   78 78 78 78 78 2e 64 65 ff 00 ff                  xxxxx.de...

SwOS lite 2.17 - Violation of broadcast domain isolation with DHCP Option-82 "Add Information Option" [SOLVED]

SwOS lite 2.17 - Violation of broadcast domain isolation with DHCP Option-82 "Add Information Option"

Re: SwOS lite 2.17 - violation of broadcast domain isolation?

Re: SwOS lite 2.17 - violation of broadcast domain isolation? [SOLVED]

Who is online