CRS326-24S+ VLAN management lost Access

Hi,

I have a CRS326 (B) behind another CRS326 (A)
Bridge filtering is activated on Switch A and VLAN44 is entered for SwitchB and for the uplink.
A router with vlan44 and IP 10.9.0.3/24 is attached to this switch on the uplink via Vlan44

At Switch B I can reach the router via Layer3. From the router via Layer3 also the switch B. So far so good. The MAC address of switch B is entered in the router’s ARP.
BUT: after a while, the MAC address on the router for Switch B and on Switch B for the router is out and Layer3 no longer goes from the router to Switch B. Only when I try from Switch B via Layer2-MAc-telnet ICMP to Make router, everything works again.
For a few minutes.

If I set everything up so that there is another router between switch A and switch B and put the Vlan44 in a bridge, everything runs permanently.
What can be wrong with the programming on Switch B?

/interface bridge
add admin-mac=48:A9:8A:B4:BD:BA auto-mac=no igmp-snooping=yes \
    ingress-filtering=no name=bridge1 protocol-mode=none pvid=44 \
    vlan-filtering=yes
/interface ethernet
set [ find default-name=qsfpplus1-1 ] disabled=yes
set [ find default-name=qsfpplus1-2 ] disabled=yes
set [ find default-name=qsfpplus1-3 ] disabled=yes
set [ find default-name=qsfpplus1-4 ] disabled=yes
set [ find default-name=qsfpplus2-1 ] disabled=yes
set [ find default-name=qsfpplus2-2 ] disabled=yes
set [ find default-name=qsfpplus2-3 ] disabled=yes
set [ find default-name=qsfpplus2-4 ] disabled=yes
set [ find default-name=sfp-sfpplus1 ] name=sfp-sfpplus1-uplink
set [ find default-name=sfp-sfpplus2 ] name=sfp-sfpplus2-frei
set [ find default-name=sfp-sfpplus3 ] name=\
    "sfp-sfpplus3-20"
/interface vlan
add interface=bridge1 name=vlan44-mgnt vlan-id=44
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/port
set 0 name=serial0
/system logging action
set 1 disk-file-name=log
/user group
add name=ip policy="local,telnet,reboot,read,write,test,winbox,!ssh,!ftp,!poli\
    cy,!password,!web,!sniff,!sensitive,!api,!romon,!rest-api"
/interface bridge port
add bridge=bridge1 fast-leave=yes interface=sfp-sfpplus1-uplink
add bridge=bridge1 broadcast-flood=no fast-leave=yes interface=\
    sfp-sfpplus2-frei multicast-router=disabled pvid=406 \
    unknown-unicast-flood=no
add bridge=bridge1 broadcast-flood=no fast-leave=yes interface=\
    "sfp-sfpplus3-20" multicast-router=disabled \
    pvid=406 unknown-unicast-flood=no
/interface ethernet switch l3hw-settings advanced
set neigh-discovery-interval=1m31s neigh-keepalive-interval=5s \
    route-index-delay-max=5s route-index-delay-min=100ms \
    route-queue-limit-high=512 route-queue-limit-low=16
/ipv6 settings
set disable-ipv6=yes forward=no
/interface bridge vlan
add bridge=bridge1 tagged=bridge1,sfp-sfpplus1-uplink vlan-ids=44
add bridge=bridge1 tagged=sfp-sfpplus1-uplink,sfp-sfpplus2-frei vlan-ids=406
/interface ethernet switch rule
add ports=sfp-sfpplus1-uplink switch=switch1
add mac-protocol=pppoe-discovery ports=\
    "sfp-sfpplus2-frei,sfp-sfpplus3-20" switch=\
    switch1
add mac-protocol=pppoe ports=\
    "sfp-sfpplus2-frei,sfp-sfpplus3-20" switch=\
    switch1
add new-dst-ports="" ports=\
    "sfp-sfpplus2-frei,sfp-sfpplus3-20" switch=\
    switch1
/ip address
add address=10.9.0.2/24 interface=vlan44-mgnt network=10.9.0.0
/ip route
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=10.9.0.1 pref-src="" \
    routing-table=main scope=30 suppress-hw-offload=no target-scope=10
/system clock
set time-zone-autodetect=no time-zone-name=Europe/Berlin
/system identity
set name=switchb
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp client servers
add address=10.0.250.13
/system routerboard settings
set auto-upgrade=yes boot-os=router-os enter-setup-on=delete-key
/tool graphing interface
add
/tool graphing resource
add

many thanks for your help

Why did you set pvid on the bridge?

In order to be able to admin the switch via vlan44 (management Vlan) and with the bridge filter switched on, this should be according to the description

https://wiki.mikrotik.com/wiki/Manual:Interface/Bridge#Management_access_configuration

be so.

The Access Ports sfpsfpplus2,3 has pvid 406 to tag untagged traffic in my pppoe-server

OK. Thanks. I see it.
I have now set the pvid of the bridge back to “1”.
Thanks for the hint. I’ll see if it’s better now.

Bridge filter usage should only be done if absolutely necessary ( normal firewall rules etc. dont meet the requirements ).

OK. after i have now set the pvid back to 1 at the bridge interface, unfortunately the same error occurs.
After a few minutes, the switch is no longer accessible via layer3.
I need bridge filters. I must translate pvid 406 on access-ports to uplink. and bridge some other vlans to specially ports later.
The question is why I lose the Layer3 connection to the switch after a few minutes, but Layer2 works.

Layer3 works again from an another router, when i log in via layer2 on the switch and ping ip of this router in vlan44 mgnt vlan.

Has No one this setup? CRS behind CRS?