You currently have a misconfiguration. sfp-sfpplus2 and sfp-sfpplus3 are member port of a bridge bridge and thus are slave ports, but you are assigning an IP address directly to sfp-sfpplus2, which is wrong.
You need to edit the /ip address entry and move the interface of the address 192.168.251.254/24 from sfp-sfpplus2 to bridge to correct this issue.
As for this:
Check the Windows Defender Firewall configuration. By default, in the "Public" or "Private" zone (not the "Domain" zone) the Windows firewall only accepts pings from within the same subnet (192.168.252.0/24). You need to edit the firewall rules to be able to answer ping incoming from any networks. See my screenshots from a few days ago here: PBR Routing Rules in ROS 7.22 Stable - #9 by CGGXANNX
Also, if you intend to use your CRS309 as a router between two subnets without firewall, then it's best to properly implement a configuration that can make use of L3HW offload. For that you'll need:
- To put all the SFP+ ports, including
sfp-sfpplus1in a single bridge. - Configure Bridge VLAN Filtering (
sfp-sfpplus1becomes access port of avlan252,sfp-sfpplus2andsfp-sfpplus3access port ofvlan251),/ip addressentries are configured for those two VLAN intefaces. - Enable L3HW offload, following the documentation that @rplant linked above.
People in this thread will assist you if you need the detailed instruction on how to implement those steps.