Manual

CRS326-24G-2S+RM

Twenty-four gigabit ports and two 10-gigabit SFP+ cages, as a RouterOS switch at the bottom of your rack.

The CRS326-24G-2S+RM is the standard access switch for an office: twenty-four wired desks, a fast uplink to the router, and VLANs keeping the whole thing apart. It does not route, it switches. Your router stays your router; this box distributes.

RouterOS or SwOS

This is the question to settle first, because a whole script hangs off it. In our catalogue the CRS326-24G-2S+RM is a RouterOS device. So the configurator writes an ordinary RouterOS script for it, with a bridge, a VLAN table and a management address.

If you are after the SwOS variant, that is a different product: the CSS326-24G-2S+RM has its own entry in the list and the tool treats it differently, with a setup sheet and a push script in beta instead of a RouterOS script. Read SwOS switches if that is the box on your desk. Pick the wrong entry here and you get a script that means nothing on your hardware.

The ports

  • ether1 through ether24 — twenty-four gigabit ports. These are your desks, printers, phones and access points.
  • sfp-sfpplus1 and sfp-sfpplus2 — two 10 Gbit SFP+ cages. One of them is your trunk to the router. The second one can go to a second switch, a server, or a NAS that deserves it.

There is no PoE-out on this model. Access points and cameras that want power over the cable need an injector here. If the switch itself should do the powering, look at the CRS328-24P-4S+RM, which has PoE-out on all twenty-four ports.

What the tool does with it

The catalogue marks this model as a switch, and that has a visible consequence: the roles that route, such as Home router and Office router with VLANs, are disabled with the message "This is a switch". What is left is the Switch role, plus Harden only for a switch that is already running.

In RouterOS terms, the Switch role produces:

  • every wired port in one bridge, with RSTP on;
  • a VLAN table through /interface bridge vlan, with the last port as a trunk and the rest as access ports;
  • a static management address on the management VLAN, with a gateway towards your router;
  • no DHCP server, no NAT and no routing: only a firewall that protects the device itself.

Under Ports there is a Hardware offloading (switch chip) toggle, on by default. Leave it on unless you have a reason not to; off means RouterOS gets hw=no on your bridge ports and the CPU does the work. This model is not one of the older boards the tool warns about, where the VLAN table really belongs in the switch menu, so bridge VLAN filtering is the right route here.

What it is good at, and where it runs out

Good at: a lot of ports, VLANs, a 10-gigabit uplink, and sitting quietly in a rack. Where it runs out:

  • No Wi-Fi. Access points hang off the ports, with their VLANs tagged over the cable.
  • No PoE-out. See above.
  • Not a router. Routing between VLANs happens on your router, not here. If you start putting an address on every VLAN on this switch, you are building something this role does not write for you.
  • Not everything is in our data. We know the memory (512 MB) and the architecture (32-bit ARM), but not the switch chip or the licence level. Look those up at MikroTik; the ports and speeds have been checked.

The quickest route to a working configuration

If the switch stands on its own, pick the model, pick the Switch role and walk through the wizard. Watch two things above all: which port becomes your trunk, and which VLAN is your management VLAN. The management VLAN belongs tagged towards your router, not untagged on a desk port.

If the switch sits between a router and a few access points, Multiple devices is the faster way. You draw the cables on the network board, and the cabling decides which ports become trunks. The site checks then tell you whether the management VLAN reaches everything and whether a VLAN stops halfway along a cable. A worked case is in Example: an office.

What trips people up

  • Configuring the SwOS version as RouterOS. Check the box, or check in WinBox what is running, before you paste a script.
  • Locking yourself out. After pasting, the switch is only reachable on the management address in the management VLAN. If you are sitting on an access port in another VLAN, it is gone. Check your address and gateway before you press paste, and keep a serial or MAC-WinBox route in reserve.
  • The management VLAN untagged on desk ports. That puts your management network within reach of every chair.
  • Forgetting to tag the trunk on the router side. A VLAN that exists on only one end of the cable does not work. The site checks catch this; see also VLAN checks.
  • An SFP+ cage without a module. Without a matching module the uplink never comes up. Check with /interface ethernet print.

Want to try it right away? Open the configurator