CRS354-48G-4S+2Q+RM

The CRS354-48G-4S+2Q+RM is the big access switch: in our catalogue, forty-nine gigabit ports, four 10 Gbit SFP+ cages and two 40 Gbit QSFP+ ports, in 1U. It belongs in a patch cabinet on a floor, where dozens of desks arrive on copper and the link to the core goes out over fibre.

There is no Wi-Fi in it. This is a switch. Access points hang off the gigabit ports with their VLANs tagged over the cable, and they get their power from an injector or a PoE switch: this model has no PoE-out, so the PoE-out per port field does not appear. If you want power from the switch, look at a PoE model such as the CRS328-24P-4S+RM.

The ports

• ether1 through ether49: forty-nine gigabit ports according to our catalogue. These are your desks, printers, phones and access points.
• sfp-sfpplus1 through sfp-sfpplus4: four 10 Gbit SFP+ cages. One of them usually goes to your router or core switch.
• qsfpplus1-1 and qsfpplus2-1: two 40 Gbit QSFP+ ports. The catalogue records one interface per cage; how a cage splits depends on the module and on RouterOS, and our catalogue does not record that. Check on the device with /interface ethernet print which interfaces actually exist.

With this many ports the VLAN layout is the real work. The Switch role makes the last port a trunk and the rest access ports by default; at this port count you almost certainly want to change that and designate several trunks. See VLANs and Planning VLANs.

What the tool does with it

The catalogue knows this model as a switch. So the roles that route are greyed out with "This is a switch": Home router, Office router with VLANs, VPN gateway, Router + CAPsMAN and Hotspot. The roles that need a radio are greyed out with "No wifi radio", and LTE / 5G router with "No LTE modem". What is left is Switch and Harden only (baseline).

The Switch role produces every port in one bridge with RSTP, a VLAN table through /interface bridge vlan, a static management address on the management VLAN with a gateway towards your router, and no DHCP, NAT or routing. The Hardware offloading (switch chip) toggle under Ports is on by default. This model is not listed with hw_vlan: switch-menu, so bridge VLAN filtering is the right route here.

What is inside, and where it pinches

The catalogue records MIPSBE as the architecture, 128 MB of memory, the 98DX3257 switch chip and RouterOS licence level 5. That is the striking thing about this device: a fifty-five port switch on a MIPS processor with 128 MB of memory.

The switching itself happens in the chip and notices none of that. The processor handles management: WinBox, the configuration, keeping RSTP going, and whatever else is addressed to the device itself. At 128 MB this model falls just outside the small-board note the configurator gives at 64 MB and below, but it is not roomy for a device this size. Keep the configuration simple: no extra packages, no containers, and no traffic that has to pass through the CPU. After pasting, check what is free with /system resource print.

What the catalogue does not record, this page does not claim: it holds nothing about throughput, about how many VLANs the chip can carry, or about the breakout options of the QSFP+ cages.

The quickest route to a working configuration

1. Pick One device and search for CRS354.
2. Pick the Switch role.
3. At the VLAN step: create your VLANs, designate the trunk ports towards the router and other switches, and set the rest to access with the right VLAN.
4. Choose your management VLAN and fill in the management address and gateway.
5. Set an admin password, reset the device and paste the script. See Using the script.

If this switch sits in a network with a router and access points, use Multiple devices: the cabling on the network board decides which ports become trunks, and the checks report whether a VLAN stops halfway.

What trips people up

• Expecting PoE. This model powers nothing. Access points and phones need an injector or a PoE switch here.
• Setting forty-nine ports by hand. Get the layout right in one pass at the VLAN step; fixing it port by port in WinBox costs an evening.
• Putting too much on the CPU. With 128 MB and a MIPS processor this is a switch, not a router. Leave the routing to your router.
• Taking the QSFP+ interface names on trust. Check what appears on the device before you paste.
• The management VLAN untagged on a desk port. That puts your management network on every desk. See VLAN checks.