CRS328-24P-4S+RM

The CRS328-24P-4S+RM is the switch you install when the cables have to carry power as well as data. Access points in the ceiling, cameras on the facade, phones on the desk: one cable each, and one box you can switch on or off. Beyond that it is an ordinary 24-port VLAN switch with four fast uplinks.

RouterOS or SwOS

In our catalogue this model is a RouterOS device. The configurator therefore writes a RouterOS script for it, with a bridge, a VLAN table through /interface bridge vlan and a management address. No setup sheet, no push script: that path is only for the SwOS models, which SwOS switches covers.

The ports

• ether1 through ether24 — twenty-four gigabit ports, all with PoE-out. Every one of them can power an access point, a camera or a phone.
• sfp-sfpplus1 through sfp-sfpplus4 — four 10 Gbit SFP+ cages. One is your trunk to the router. The other three are there for a second switch, a server, or a second path to your core.

PoE-out is set per port in the tool. Which ports to switch on, and why you never turn it on everywhere by default, is in PoE-out. Keep in mind that a switch has a total power budget: twenty-four ports that can deliver power is not the same as twenty-four devices drawing full power at once. Do that sum before you fill every port.

What is inside

From the catalogue: a 32-bit ARM processor, 512 MB of RAM, a 98DX3236 switch chip and a level 5 RouterOS licence. The data for this model has been checked against real hardware.

512 MB is plenty for a switch and not enough to run anything heavy beside it. Containers and a large routing table do not belong here; this device switches, and it does that well. Level 5 is comfortable for a switch role. See RouterOS licences for what a level actually limits.

What the tool does with it

The catalogue marks this model as a switch, so the roles that route are disabled with "This is a switch". What is left is the Switch role, plus Harden only for a switch already in service.

The Switch role writes every wired port into one bridge with RSTP, a VLAN table with the last port as a trunk and the rest as access ports, a static management address on the management VLAN with a gateway, and no DHCP server or NAT.

Under Ports there is Hardware offloading (switch chip), on by default. Leave it on: off means hw=no on your bridge ports and the CPU doing the forwarding, and a 32-bit ARM is not a switch chip. This model is not one of the older boards the tool warns about, where the VLAN table really belongs in the switch menu; bridge VLAN filtering is the normal route here.

What it is good at, and where it runs out

Good at: VLANs, a lot of ports, four fast uplinks and power over the cable. Where it runs out:

• No Wi-Fi. The wireless roles are not available here; access points hang off it.
• Not a router. Routing between VLANs is your router's job.
• Gigabit to the desk. The fast ports are the four SFP+ cages; the twenty-four copper ports stay at 1 Gbit.
• A PoE budget, not a PoE promise. See above: every port can do it, not every port at full power at the same time.

The quickest route to a working configuration

Pick the model, pick the Switch role, walk through the wizard and watch the trunk port and the management VLAN. Then, in advanced, turn PoE-out on for exactly the ports where an access point or camera hangs, and leave the rest off.

If this switch is part of something larger, start at Multiple devices: the router, this switch and your access points then share VLANs, SSIDs and password, you draw the cables on the network board, and you get checks across the whole site. A fully worked office is in Example: an office.

What trips people up

• PoE-out on the trunk port. The switch or router at the other end of that cable does not want power arriving on it. Turn PoE on only where a powered device hangs.
• Locking yourself out. After pasting, the switch is only reachable on the management address in the management VLAN. Check address and gateway before you paste, and keep MAC WinBox in reserve.
• The management VLAN untagged on desk ports. Management belongs tagged towards your router, not on every desk.
• An access point that keeps rebooting after you enable PoE. That is nearly always too little power, or a cable that is too long or too poor, not your configuration.
• Expecting the four SFP+ cages to make a 10-gigabit network. They are there for uplinks and servers; your desks stay on gigabit.