# TP21.1 — crs326-branch Bootstrap (Stand 2026-08-08, Rev 4)
#
# Hintergrund:
# - WinBox-MAC-Scan zeigt 0.0.0.0, solange das Gerät auf dem Discovery-VLAN keine IP hat.
# - Sichere Bring-up-Reihenfolge: Ports → VLAN-Tabelle → VLAN-Interfaces → IPs →
#   vlan-filtering → Werkseinstellungen bereinigen.
# - bridge MUSS in jeder Bridge-VLAN-Zeile tagged sein, sonst sieht die CPU das VLAN nicht.
# - NAS-Ports (ether2/8) sind tagged VLAN20 (NAS spricht selbst tagged).
#
# Vor dem Import: ether1 (Uplink) und ether24 (ap2) abziehen.
# Nach dem Import: WinBox auf 10.40.10.2 verbinden, dann uplink einstecken.

/system identity set name=crs326-branch

/interface bridge port
# Trunk-Ports (Uplink + AP + NAS)
set [find interface=ether1]  pvid=1 disabled=no
set [find interface=ether2]  pvid=1 disabled=no
set [find interface=ether8]  pvid=1 disabled=no
set [find interface=ether24] pvid=1 disabled=no

# ACCESS-Ports
set [find interface=ether3]  pvid=10 disabled=no
set [find interface=ether4]  pvid=10 disabled=no
set [find interface=ether5]  pvid=40 disabled=no
set [find interface=ether6]  pvid=40 disabled=no
set [find interface=ether7]  pvid=20 disabled=no

# Restliche Ethernet-Ports flexibel als INFRA vorbelegen, aber enabled
set [find interface=ether9]  pvid=20 disabled=no
set [find interface=ether10] pvid=20 disabled=no
set [find interface=ether11] pvid=20 disabled=no
set [find interface=ether12] pvid=20 disabled=no
set [find interface=ether13] pvid=20 disabled=no
set [find interface=ether14] pvid=20 disabled=no
set [find interface=ether15] pvid=20 disabled=no
set [find interface=ether16] pvid=20 disabled=no
set [find interface=ether17] pvid=20 disabled=no
set [find interface=ether18] pvid=20 disabled=no
set [find interface=ether19] pvid=20 disabled=no
set [find interface=ether20] pvid=20 disabled=no
set [find interface=ether21] pvid=20 disabled=no
set [find interface=ether22] pvid=20 disabled=no
set [find interface=ether23] pvid=20 disabled=no
set [find interface=sfp-sfpplus1] pvid=1 disabled=yes
set [find interface=sfp-sfpplus2] pvid=1 disabled=yes

/interface bridge vlan
add bridge=bridge tagged=ether1,ether24,bridge untagged=ether3,ether4 vlan-ids=10 comment=MAIN
add bridge=bridge tagged=ether1,ether2,ether8,ether24,bridge untagged=ether7,ether9,ether10,ether11,ether12,ether13,ether14,ether15,ether16,ether17,ether18,ether19,ether20,ether21,ether22,ether23 vlan-ids=20 comment=INFRA
add bridge=bridge tagged=ether1,ether24,bridge vlan-ids=30 comment=IOT
add bridge=bridge tagged=ether1,ether24,bridge untagged=ether5,ether6 vlan-ids=40 comment=MEDIA
add bridge=bridge tagged=ether1,ether24,bridge vlan-ids=50 comment=UNTRUSTED
add bridge=bridge tagged=ether1,ether24,bridge vlan-ids=90 comment=GUEST
add bridge=bridge tagged=ether1,ether24,bridge vlan-ids=99 comment=MGMT

/interface vlan add name=vlan10 interface=bridge vlan-id=10 comment="TEMP Mgmt VLAN10"
/interface vlan add name=vlan99 interface=bridge vlan-id=99 comment=MGMT

/ip address
add address=10.40.99.2/24 interface=vlan99 comment="TP21-mgmt-target"
add address=10.40.10.2/24 interface=vlan10 comment="TEMP Bring-up VLAN10"

/ip dns set servers=10.40.99.1 allow-remote-requests=no

/interface bridge set [find name=bridge] vlan-filtering=yes

/ip route add dst-address=0.0.0.0/0 gateway=10.40.99.1 comment="TP21-default"

:do { /ip address remove [find address="192.168.88.1/24"] } on-error={}
:do { /ip dhcp-client disable [find interface=bridge] } on-error={}