CRS309-1G-8S+IN

The CRS309-1G-8S+IN is a small switch with a lot of fibre: eight 10 Gbit SFP+ cages and one gigabit copper port. It fits in a server cabinet, behind a router with a 10 Gbit uplink, or as the core of a small network where servers, a NAS and switches all want to sit at 10 Gbit. It is passively cooled and small enough to live on a shelf.

There is no Wi-Fi in it. This is a switch, not an access point. The catalogue puts this model in the switches category, and that has consequences for the roles you get; see below.

The ports

• sfp-sfpplus1 through sfp-sfpplus8: eight 10 Gbit SFP+ cages. This is what the device is for.
• ether1: one gigabit copper port. In practice your management port: plug a laptop in and you can reach the switch, even when something is wrong with the fibre links.

There is no PoE-out on this model. The PoE-out per port field does not appear, and anything that wants power over the cable needs an injector here. The catalogue also records no WAN port for this model, because a switch does not have one: in the Switch role nothing is routed and there is no internet side.

With eight identical fibre ports the main question is which port becomes your trunk. The Switch role makes the last port a trunk and the rest access ports by default; you can change that at the VLAN step. See VLANs and Bridge and ports.

What the tool does with it

Because the catalogue knows this model as a switch, the roles that route are greyed out with the message "This is a switch": Home router, Office router with VLANs, VPN gateway, Router + CAPsMAN and Hotspot. The roles that need a radio are greyed out with "No wifi radio", and LTE / 5G router with "No LTE modem".

What is left is the Switch role, plus Harden only (baseline) for a switch that is already running. The Core router role is technically still offered, but it writes routed interfaces without a bridge, which is not what this device is for.

In RouterOS terms, the Switch role produces:

• every wired port in one bridge, with RSTP on;
• a VLAN table through /interface bridge vlan, with the last port as a trunk and the rest as access ports;
• a static management address on the management VLAN, with a gateway towards your router;
• no DHCP server, no NAT and no routing: only a firewall that protects the device itself.

Under Ports there is the Hardware offloading (switch chip) toggle, on by default. Leave it on: this model is not listed with hw_vlan: switch-menu, so bridge VLAN filtering is the right route here and you do not get the warning about losing offload.

What is inside

The catalogue records ARM 32bit, 512 MB of memory, the 98DX8208 switch chip and RouterOS licence level 5. Ample for what a switch is for. The small-board note never appears here.

Where it runs out: in this role it is a layer-2 device. Routing between VLANs happens on your router, not here. If you start putting an address on every VLAN on this switch, you are building something the role does not write for you. And as ever: our catalogue says nothing about throughput figures, so neither do we.

The quickest route to a working configuration

1. Pick One device and search for CRS309.
2. Pick the Switch role and walk through the wizard.
3. Watch two things: which port becomes your trunk, and which VLAN is your management VLAN.
4. Fill in the management address and the gateway. That address will be the only way to reach the switch.
5. Set an admin password, reset the device and paste the script. See Using the script.

If the switch sits between a router and a few access points, Multiple devices is faster: you draw the cables on the network board and the cabling decides which ports become trunks. The site checks then tell you whether the management VLAN reaches everything.

What trips people up

• Empty SFP+ cages. Without a matching module or DAC a port does not come up. Check with /interface ethernet print.
• Using the gigabit port as an uplink. ether1 is one gigabit. Your uplink belongs on an SFP+ cage.
• Locking yourself out. After pasting, the switch is only reachable on the management address in the management VLAN. If you are sitting on an access port in another VLAN, it is gone. See Switch unreachable.
• The management VLAN untagged on an ordinary port. That leaves your management network open. Send it tagged towards your router.
• Forgetting to tag the trunk on the other side. A VLAN that exists on only one end of the cable does not work. See VLAN checks.