and
I agree that if you are not trying to SSH from the CRS or to the CRS (i.e. the CRS isn’t involved in SSH), then you don’t need a vlan interface on the CRS. A vlan interface is just to allow the CPU on the CRS to connect to the corresponding vlan on the 98DX8322 switch ASIC in the CRS. In addtion to a vlan interface, you need to configure the “internal trunk link” between the CPU and the switch ASIC. This is a post by @sindy worth reading RouterOS bridge mysteries explained. Also see the CRS326-24S+2Q+ block diagram. Traffic within the same vlan (after the 98DX8322 switch ASIC configuration has been completed) will not traverse the 1 Gbs link to the CPU.
Are you able to ssh to machine 2 if you connect a host with a standard untagged ethernet adapter (e.g. a standard laptop’s ethernet port)? If so then machine 2 ssh server is expecting untagged ethernet frames.
Are you sure that machine 2 is expecting tagged ethernet frames? If it isn’t then it will most likely just ignore the packets (because they will have 0x8100 in the ethertype field. See IEEE802.1Q for examples of standard and tagged ethernet frame layouts.
Do the three interfaces on machine 1 all have unique ip addresses?
Are there two ip addresses associated with the port on machine 2?
Perhaps you should step back a a bit, and explain the problem you are trying to solve. Are you sure vlans are the solution? I’m just trying to avoid an xy problem.
Perhaps machine 2 is expecting its management to be done via untagged frames. If that’s the case, you can make the 10-RU bridge-port a hybrid with “native” vlan 5 (i.e. pvid 5) and tagged 1588. Unfortunately, there isn’t a “Hybrid and access ports” example in the doc link.
Before doing the configurations, you really need to know what the configuration needs to do. And what the equipment on the other end of the cable is expecting.
Your latest config has new inconsistencies. You are telling ROS that 02-SOURCE (pvid 1588), 09-TIMING (pvid 1588), 11-DPDK (pvid 5), and 12-SSH (pvid 5) are receiving untagged packets into the vlans specified by the pvid in the /interface bridge port stanza, but then you are telling it that those ports should send the packets tagged in the /interface bridge vlan stanza.
Which is it? tagged or untagged?
If you want 10-RU to be a trunk port carrying vlans 5 and 1588 with vlan 5 native (untagged), then change the following parts:
/interface bridge port
add bridge=bridge comment=defconf interface=10-RU pvid 5 remove the frame-type filtering
/interface bridge vlan
add bridge=bridge tagged=10-RU vlan-ids=1588
add bridge=bridge untagged=10-RU,11-DPDK,12-SSH vlan-ids=5 blue optional because untagged will be added dynamically for ports from the pvid in the /interface bridge port stanza