http://wiki.mikrotik.com/wiki/Manual:Switch_Chip_Features

http://wiki.mikrotik.com/wiki/Manual:CRS_features

http://wiki.mikrotik.com/wiki/Manual:CRS_examples

http://wiki.mikrotik.com/wiki/Manual:Interface/VLAN

Interesting: http://forum.mikrotik.com/viewtopic.php?f=13&t=82386

The switching feature allows wire speed traffic passing among a group of ports, like the ports were a regular Ethernet switch. You configure this feature by setting a “master-port” property to one ore more ports in /interface Ethernet menu.

A 'master' port will be the port through which RouterOS will communicate to all ports in the group. Interfaces for which the 'master' port is specified become inactive - no traffic is received on them and no traffic can be sent out.

Passing a packet 'up' or giving it to RouterOS is also called sending it to switch chips' 'cpu' port.

/interface ethernet print
/interface ethernet switch print
/interface ethernet switch port print

Here we divide the switch into two switch groups of 17 and 6 ports each.

We reserve the SFP and ether1 ports for routing and upstream connectivity.

We erase all configuration before starting.

Reset the router to no configuration:

/system reset-configuration no-defaults=yes

First, we rename all of the interfaces to match our plan:

ether1 and sfp1 are WAN interfaces.

ether2 and ether19 are switch master ports.

/interface
  set ether1 name=ether1-wan
  set ether2 name=ether2-master
  set ether3 name=ether3-slave
  set ether4 name=ether4-slave
  set ether5 name=ether5-slave
  set ether6 name=ether6-slave
  set ether7 name=ether7-slave
  set ether8 name=ether8-slave
  set ether9 name=ether9-slave
  set ether10 name=ether10-slave
  set ether11 name=ether11-slave
  set ether12 name=ether12-slave
  set ether13 name=ether13-slave
  set ether14 name=ether14-slave
  set ether15 name=ether15-slave
  set ether16 name=ether16-slave
  set ether17 name=ether17-slave
  set ether18 name=ether18-slave
  set ether19 name=ether19-master
  set ether20 name=ether20-slave
  set ether21 name=ether21-slave
  set ether22 name=ether22-slave
  set ether23 name=ether23-slave
  set ether24 name=ether24-slave
  set sfp1 name=sfp1-wan
  
print

Then we modify the switch configuration:

/interface ethernet
  set ether3-slave master-port=ether2-master
  set ether4-slave master-port=ether2-master
  set ether5-slave master-port=ether2-master
  set ether6-slave master-port=ether2-master
  set ether7-slave master-port=ether2-master
  set ether8-slave master-port=ether2-master
  set ether9-slave master-port=ether2-master
  set ether10-slave master-port=ether2-master
  set ether11-slave master-port=ether2-master
  set ether12-slave master-port=ether2-master
  set ether13-slave master-port=ether2-master
  set ether14-slave master-port=ether2-master
  set ether15-slave master-port=ether2-master
  set ether16-slave master-port=ether2-master
  set ether17-slave master-port=ether2-master
  set ether18-slave master-port=ether2-master
  set ether20-slave master-port=ether19-master
  set ether21-slave master-port=ether19-master
  set ether22-slave master-port=ether19-master
  set ether23-slave master-port=ether19-master
  set ether24-slave master-port=ether19-master

print

Use the master ports for bridging and routing.

We don't actually use these bridges here.

/interface bridge
  add name=bridge1 comment="Bridge for Port Group 1" disabled=no
  add name=bridge2 comment="Bridge for Port Group 2" disabled=no

print

To use the SFP port as the gateway, just substitute the name of the interface (sfp1-wan instead of ether1-wan).

Adjust the IP addressing to your needs.

Here we add IP addresses for the upstream link and the two master switch ports:

/ip address
  add address=172.16.1.2/30 interface=ether1-wan comment="Gateway to Upstream Router"
  add address=10.10.4.1/24 interface=ether2-master comment="Gateway for Private Subnet"
  add address=xxx.xxx.xxx.xxx/xx interface=ether19-master comment="Gateway for Public Subnet"

print

Here we set the host name, DNS servers and the default route:

/system identity set name=CRS125
/ip dns set servers=8.8.8.8,8.8.4.4
/ip route add dst-address=0.0.0.0/0 gateway=172.16.1.1 distance=1 comment="Default Route"

Neighbor discovery is a broadcast protocol limited to the broadcast domain.

Here we disable neighbor discovery except on the gateway port connected to our upstream router:

/ip neighbor discovery set ether2-master,ether19-master discover=no