A VLAN only works when every device along the way knows about it. That is why most of these messages are not about one device, but about two devices that disagree. They appear above the scripts, under the checks across the whole site, and on a single device in the VLAN section.
An error means the result will not work. A warning can be a fine decision, as long as you took it.
A VLAN stops at a cable
VLAN 30 is on sw-01 but not on ap-01: that VLAN stops at the cable sw-01 ether5 to ap-01 ether1.
A warning, and the single most useful check in the tool. The tag is carried up to that cable and no further, so devices on the far side are on a network that reaches nothing. Either add the VLAN to the other device, or accept it because that part of the network is not supposed to see it.
A device with no VLANs at all
sw-02 carries no VLAN at all.
An error when the rest of the site does use VLANs. The device then passes untagged traffic only, so everything behind it lands outside your VLAN plan. Tick the VLANs it has to carry in its own settings, or take it out of the site.
The management VLAN is missing on a switch or access point
sw-02 does not carry management VLAN 10 and cannot be managed.
An error, and the mistake people make most often. The device does get an address, but on a network you cannot reach it from, so after pasting the script it disappears. Add the management VLAN to the device before you generate.
A server on a VLAN its switch does not carry
nas-01 uses VLAN 20, but sw-01 does not carry it on the port it is cabled to.
A warning about something you drew on the board yourself. The port towards that host does not have the tag, so the machine will not get an address from that network. Add the VLAN to the switch, or move the host to the network it really belongs on.
A VLAN that is not in the site table
ap-01 uses VLAN 40, which is not in the site's VLAN table.
An error. One device was given a VLAN by hand that the rest of the site does not know. A tag means nothing on its own: without the same number in the shared table the router has no address and no DHCP for it. Add the VLAN to the site, or remove it from the device.
The first VLAN in the table is a guest network
The first VLAN in the site table (20 Guests) is marked isolated, so it is a guest network. Wired ports default to the first VLAN, which puts every wired port on the guest network.
An error, and one that looks like a working configuration. Wired ports take the first VLAN in the table as their untagged network, so a guest VLAN at the top quietly puts every desk, printer and server on the guest side. Put a VLAN for the main network at the top, or take the isolation off.
VLAN 1 collides with the bridge itself
VLAN 1 (LAN) is the bridge's own pvid. A VLAN interface for id 1 collides with it: you end up with two interfaces on the same VLAN. If you want an untagged network on the bridge itself, set the port's untagged VLAN to "bridge (untagged, no VLAN)" instead.
An error. The bridge already answers on VLAN 1 by itself, so a second interface on the same tag gives two interfaces on one network and unpredictable traffic. If you want an untagged network on the bridge, set the port untagged VLAN to "bridge (untagged, no VLAN)" instead.
VLAN 4095
VLAN 4095 (Test) is reserved and must not be used as an ordinary VLAN.
A warning that you should treat as an error. RouterOS keeps 4095 for internal use. Pick any other number between 2 and 4094.
No VLAN has a router address
No VLAN has a router address; the router will not route between VLANs.
A warning, and only on a device that has an internet connection. Without an address in a VLAN the router is not a gateway for it, so the network exists at layer 2 and goes nowhere else. Give every VLAN that needs a gateway an address in the shared table.
VLAN filtering without a way back in
VLAN filtering is being switched on, but no VLAN has an address and no port is untagged on the bridge. After applying this the router is no longer reachable over IP. Give a VLAN an address, mark one as the management VLAN, or set a port to "bridge (untagged, no VLAN)".
An error, and it exists to save you a trip to the reset button. Give a VLAN an address, mark one as the management VLAN, or set a port to "bridge (untagged, no VLAN)" so you keep one way in.
No VLAN is marked as the management VLAN
No VLAN is marked as management VLAN; make sure you can still reach the router after applying (MAC WinBox on LAN keeps working).
A warning. The configuration works, but nothing is designated as the network you administer from, and the tool cannot check the rest of the site against it either. MAC WinBox stays as your fallback. Marking one management VLAN costs nothing and turns on several other checks.
A host on a VLAN that does not exist
nas-01 is on VLAN 60, but that VLAN does not exist in the site.
A warning about a number you typed on a node on the board. It is usually a typo, or a leftover from a plan you changed. Correct the number or add the VLAN to the site table.
VLANs planned, no VLAN table yet
Servers or VMs have a VLAN, but the site has no VLANs yet. Add them in the list view, or everything stays on one network.
A note. You have already thought about the split on the board, but the shared table where the VLANs are actually created is still empty. Copy your numbers into it and the rest of the checks start working.
The matrix decides, not the isolated tick
The matrix decides traffic between VLANs, so the Isolated tick on a VLAN is not used.
A note, so you do not go looking for a rule that is not there. The VLAN matrix and the isolated tick are two ways to say the same thing, and the matrix wins. Set the guest network to blocked in the matrix instead of relying on the tick.
The matrix has nothing to choose between
The VLAN matrix is on, but there are not two networks with an address to choose between.
A note. Rules between VLANs need at least two VLANs that this router actually routes, which means two VLANs with an address. Give the networks their addresses first, then fill in the matrix.
Related: VLANs, Checks about cabling and Checks about addresses.