http://wiki.mikrotik.com/wiki/Manual:Switch_Chip_Features

http://wiki.mikrotik.com/wiki/Manual:CRS_features

http://wiki.mikrotik.com/wiki/Manual:CRS_examples

http://wiki.mikrotik.com/wiki/Manual:Interface/VLAN

Interesting: http://forum.mikrotik.com/viewtopic.php?f=13&t=82386

The switching feature allows wire speed traffic passing among a group of ports, like the ports were a regular Ethernet switch. You configure this feature by setting a “master-port” property to one ore more ports in /interface Ethernet menu.

A 'master' port will be the port through which RouterOS will communicate to all ports in the group. Interfaces for which the 'master' port is specified become inactive - no traffic is received on them and no traffic can be sent out.

Passing a packet 'up' or giving it to RouterOS is also called sending it to switch chips' 'cpu' port.

/interface ethernet switch print

/interface ethernet print

Here we divide the switch into two switch groups of 17 and 6 ports each.

We reserve the SFP and ether1 ports for routing and upstream connectivity.

We erase all configuration before starting.

Reset the router to no configuration:

/system reset-configuration no-defaults=yes

First, we define two master ports and assign the slave ports:

/interface ethernet

set 0 name=ether1-wan
set 1 name=ether2-master
set 18 name=ether19-master
set 24 name=sfp1-wan

set 2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17 master-port=ether2-master
set 19,20,21,22,23 master-port=ether19-master

print

We don't actually use these bridges here.

/interface bridge
add name=bridge1 comment="Bridge for Port Group 1" disabled=no
add name=bridge2 comment="Bridge for Port Group 2" disabled=no

print

To use the SFP port as the gateway, just substitute the name of the interface (sfp1-wan instead of ether1-wan).

Adjust the IP addressing to your needs.

Here we add IP addresses for the upstream link and the two master switch ports:

/ip address

add address=172.16.1.2/30 interface=ether1-wan comment="Gateway to Upstream Router"
add address=10.10.4.1/24 interface=ether2-master comment="Gateway for Private Subnet"
add address=198.167.189.17/28 interface=ether19-master comment="Gateway for Public Subnet"

print

/ip route add dst-address=0.0.0.0/0 gateway=172.16.1.1 distance=1 comment="Default Route"

Neighbor discovery is a broadcast protocol limited to the broadcast domain.

Here we disable neighbor discovery except on the gateway port connected to our upstream router:

/ip neighbor discovery set ether2-master,ether19-master discover=no