CRS310-8G+2S+IN

The CRS310-8G+2S+IN is a small switch with a pleasant combination: eight copper ports that do 2.5 Gbit and two 10 Gbit SFP+ cages. It fits behind a router with a fast uplink, in a home office with a NAS that deserves more than a gigabit, or as the switch for a handful of desks and access points that are happy at 2.5 Gbit.

There is no Wi-Fi in it. This is a switch, not an access point. There is no PoE-out on this model either, so the PoE-out per port field does not appear; access points and cameras need an injector here.

The ports

• ether1 through ether8: eight copper ports at 2.5 Gbit. That is the difference with an ordinary gigabit switch, and the reason to pick this model: a desk or a NAS with a 2.5 Gbit adapter gets more here than it would on gigabit.
• sfp-sfpplus1 and sfp-sfpplus2: two 10 Gbit SFP+ cages. One of them is usually your trunk to the router or the core switch; the other can go to a second switch or a server.

The catalogue records no WAN port for this model, because a switch does not have one: in the Switch role nothing is routed and there is no internet side. Which port becomes the trunk and which are access ports is decided at the VLAN step; by default the role makes the last port a trunk. See VLANs and Bridge and ports.

Mind your cabling if you want 2.5 Gbit. An old cable or a poorly terminated run quietly falls back to a gigabit, and then you are staring at a switch that is doing nothing wrong. See Cabling and PoE in practice.

What the tool does with it

The catalogue knows this model as a switch. The roles that route are therefore greyed out with the message "This is a switch": Home router, Office router with VLANs, VPN gateway, Router + CAPsMAN and Hotspot. Access point, CAP, Wi-Fi repeater and Wireless CPE are greyed out with "No wifi radio", and LTE / 5G router with "No LTE modem".

What is left is Switch, plus Harden only (baseline) for a switch that already runs. The Switch role writes:

• every wired port in one bridge, with RSTP on;
• a VLAN table through /interface bridge vlan, with the last port as a trunk and the rest as access ports;
• a static management address on the management VLAN, with a gateway towards your router;
• no DHCP server, no NAT and no routing: only a firewall that protects the device itself.

The Hardware offloading (switch chip) toggle under Ports is on by default and should stay on. This model is not listed with hw_vlan: switch-menu, so bridge VLAN filtering is the right route here and you do not get the warning about losing offload.

What is inside

The catalogue records ARM 32bit, 256 MB of memory, the 98DX226S switch chip and RouterOS licence level 5. At 256 MB the small-board note never appears here, and level 5 is ample for what a switch does.

Where it runs out: routing between VLANs belongs on your router, not here. Put an address on every VLAN on this switch and you are building something the Switch role does not write for you. Our catalogue holds no throughput figures, so this page does not quote any.

The quickest route to a working configuration

1. Pick One device and search for CRS310.
2. Pick the Switch role and walk through the wizard.
3. Decide which SFP+ cage becomes your trunk and which VLAN is your management VLAN.
4. Fill in the management address and gateway, and check them before you paste.
5. Set an admin password, reset the device and paste the script. See Using the script.

If this switch sits between a router and a few access points, Multiple devices is faster: you draw the cables on the network board and the cabling decides the trunks.

What trips people up

• Expecting 2.5 Gbit against a gigabit device. Both ends have to support it. A laptop or NAS with a gigabit port will not do more than a gigabit here.
• Old cabling. A cable that only just managed a gigabit will not do 2.5 Gbit. Check the negotiated speed with /interface ethernet print.
• An empty SFP+ cage. Without a matching module or DAC the uplink never comes up.
• Locking yourself out. After pasting, the switch is only reachable on the management address in the management VLAN. See Switch unreachable.
• Forgetting to tag the trunk on the other side. A VLAN that exists on only one end does not work. See VLAN checks.