Traffic is routing from my 10gig switch back through the MX

[RumorConsumer]

Hello!

I have an MX68 set up with multiple VLANs.

I have the network hardware and APs on 1, the clients on 4, and a special VLAN 12 set up for me for a specific purpose.

I have a Synology with 2 10gig LAN ports, both connected to a 10gig Mikrotik switch acting in switch mode. One port is set to VLAN 4 and it properly pulls the VLAN 4 IP, no problem. The other port is set to VLAN12, and it properly pulls that VLAN IP. The issue is I just noticed that if I am doing a copy from another 10gig client on VLAN 4 to a SMB share logged into via IP on that VLAN12 NAS port, the traffic is not staying within the MikroTik switch. It is going all the way back to the gigabit port on the MX and then back out. What causes that route to get picked? 

[MilesMeraki · Accepted solution]

Sounds like the Mikrotik is just acting as a layer 2 switch. As you have created multiple different VLAN's (Broadcast domains/Virtual networks) which terminate on to the Meraki MX, if a client from network A tries to communicate with a client in network B it must go through the MX appliance regardless of the shortest physical path. This is called network segmentation. Normally as the MX acts as a firewall you can firewall the traffic to deny or allow it.

To overcome this the NAS and client must be on the same VLAN/Network.

[RumorConsumer]

Damn it. Ok. The switch has a router mode but I don’t love it. But it sounds like it would be aware enough to avoid this problem. Is there any other way to fix this?

[Brash]

For the traffic flow you described, it sounds like the default gateway for VLAN 4 or VLAN 12 (or both) reside on the upstream MX.

[RumorConsumer]

Correct. 

[Brash]

In that case, to keep the network traffic on the Mikrotik switch, you'll need to create a VLAN interface on the Microtik switch for the VLAN's and set it as the default gateway instead. 
Otherwise you can connect both the NAS and the client on the same VLAN.

In theory you can also 

[RumorConsumer]

I just put them on the same VLAN. its fine. I was trying to avoid the chance that somebody uses the wrong port (I want to keep one open) and this was my attempt which failed. its ok this works fine.