Only now, as looking for the difference between your setup and mine, I have noticed that you are setting the rules using ROS 7.0beta8 - it can only be seen in the export header, you don’t mention that anywhere in the text.
On long-term (6.45.9), I’ve just tried the following rules:
[me@MyTik] > interface ethernet switch rule print where !disabled
Flags: X - disabled, I - invalid, D - dynamic
0 switch=switch1 ports=ether5 mac-protocol=arp copy-to-cpu=no redirect-to-cpu=no mirror=no new-dst-ports=switch1-cpu
1 switch=switch1 ports=ether5 mac-protocol=ip copy-to-cpu=no redirect-to-cpu=no mirror=no new-dst-ports=switch1-cpu
2 switch=switch1 ports=ether5 copy-to-cpu=no redirect-to-cpu=no mirror=no new-dst-ports=""
And it just works - if I disable the “accept arp” rule or the “accept ip” rule, it is not possible any more to ping the device connected to ether5; as soon as both are enabled, pinging works again.
So your findings are definitely an important feedback for the ROS 7 development team, but for normal production deployment, there is no issue.
Do you have any special reason why you need to use a ROS 7 beta for the task requiring use of switch chip rules?
@sindy , in posting #9 ACL firewall problem (missing L2 EtherType) - #17 by sindy in reply to you I wrote this sentence:
Btw, this same error is present also in the RouterOS 6.47 version, as I upgraded to that 7.0beta8 b/c of that error, but unfortunately it’s in at least both versions.
Just try also with the latest stable version 6.47 and tell me that it functions. It doesn’t, much like the current 7.0beta8.
Btw, I found just another severe bug with switch rules (ACL): beta8 bug: ACL redirect-to-cpu breaks bridge