Manual

CRS328-4C-20S-4S+RM

Twenty SFP cages plus four 10 Gbit cages: the fibre switch for a rack.

The CRS328-4C-20S-4S+RM is the fibre member of the CRS328 family. Four combo ports, twenty 1 Gbit SFP cages and four 10 Gbit SFP+ cages, in a rack unit. It belongs where a lot of fibre comes together: a cross-connect in a building, the termination room of a park or a campus, a rack where strands arrive from several buildings.

The catalogue files it under switches with the default configuration switch. There is no Wi-Fi in it and no modem.

The port layout of this model is not verified in our catalogue. The tool therefore shows the "port layout not verified" note, and the script opens with a line saying the same. Run /interface print on the device and compare the names before you paste. With twenty-eight ports that is not a wasted step.

The ports

  • combo1 through combo4: four 1 Gbit combo ports. A combo port has a copper socket and an SFP cage that exclude each other: you use one of the two. In practice this is your copper side, and therefore often your management port.
  • sfp5 through sfp24: twenty 1 Gbit SFP cages. The bulk of the device.
  • sfp-sfpplus1 through sfp-sfpplus4: four 10 Gbit SFP+ cages. The uplinks, or an LACP bundle to your core; see Bonding and LACP.

There is no PoE-out: the catalogue records no feeding port on this model, so the PoE-out per port field never appears. If you want to power access points or cameras, a PoE switch belongs alongside it, the CRS112-8P for instance.

The catalogue records no WAN port, which is right for a switch. The Switch role makes the last port a trunk by default; here that is sfp-sfpplus4, which usually works out for this shape. Check it anyway. See VLANs and Bridge and ports.

What is inside

From the catalogue: ARM 32bit, 512 MB of memory, licence level 5 and the 98DX3236 switch chip. With 512 MB the small-board warning never appears here.

hw_vlan is empty, so bridge VLAN filtering is the route we take on this model and the note about losing hardware offload stays away. Leave the Hardware offloading (switch chip) toggle under Ports on; across twenty-eight ports you want traffic to stay on the switch chip.

No radios and no modem, so no Wi-Fi package and no Wi-Fi generation in the catalogue entry.

What it is good at, and where it runs out

Good at: landing a lot of fibre at one point and dividing it tidily into VLANs, with four fast cages to the core. For a campus or a park with fibre to every building this is the distribution switch; see Fibre across a campus and A management network.

Where it runs out:

  • Unverified port names. Check them before you paste.
  • 1 Gbit per cage. Twenty cages at 1 Gbit, not 10. Only the four SFP+ cages are fast.
  • No PoE.
  • Four copper sockets, and they are combo. Copper or fibre, not both.
  • Layer 2. Routing between VLANs happens on your router, not here.

Which roles fit

Because the catalogue knows this model as a switch, the roles that route are greyed out with "This is a switch": Home router, Office router with VLANs, VPN gateway, Router + CAPsMAN and Hotspot. The Wi-Fi roles are greyed out with "No wifi radio", LTE / 5G router with "No LTE modem".

What is left:

  • Switch: the role for this device. Every port in one bridge with RSTP, a VLAN table through /interface bridge vlan, a static management address on the management VLAN, no DHCP server, no NAT and no routing.
  • Harden only (baseline): for a switch that is already running, and the safest choice while you have not verified the port names.
  • Core router: technically offered, but that role writes routed interfaces without a bridge and does not suit this device.

The quickest route to a working configuration

  1. Run /interface print on the device and write the port names down.
  2. Pick One device and search for CRS328. Make sure you take the -4C-20S-4S+RM and not the copper version.
  3. Pick the Switch role and walk through the wizard.
  4. Watch which port becomes the trunk and which VLAN is your management VLAN.
  5. Fill in the management address and the gateway; that address will be the only way to reach the switch.
  6. Set an admin password, reset the device and paste the script. See Using the script.

With several switches and access points behind it, Multiple devices lays the cables and trunks out on the network board, and the site checks tell you whether the management VLAN reaches everything.

What trips people up

  • Confusing the two CRS328 variants. The copper version has twenty-four gigabit ports with PoE-out; this one is fibre and powers nothing.
  • Empty cages. Without a matching module or DAC there is no link; see SFP port does not link.
  • Not checking the port names. Across twenty-eight ports a wrong assumption costs an evening.
  • The management VLAN untagged on an ordinary port. Send it tagged towards your router.
  • Locking yourself out. See Switch unreachable.

Want to try it right away? Open the configurator