Hi, just for information, I found the root issue.
My backbone consists of a 1Gig and a 10Gig link. I block the 1Gig via RSTP, so it will come up only if the 10Gig link fails.
Unfortunately, you cant configure in ROS which ports are sending out (R)STP BPDUs. Mikrotik recommends a Birdge → Filter rule:
In case bridge filter rules are used, make sure you allow packets with DST-MAC address 01:80:C2:00:00:00 since these packets carry BPDUs that are crucial for STP to work properly.
A rule like the follwing is requires and youll find such a rule in my config (posted above):
/interface bridge filter add action=drop chain=forward in-interface=wan dst-mac-address=01:80:C2:00:00:00/FF:FF:FF:FF:FF:FF
This rule broke my network in random time intervals!!!
There is nothing wrong with this rule, it should drop outgoing STP-BPDUs on non-STP-Ports. UNFORTUNATELY it will drop way more than only the DST-MAC “01:80:C2:00:00:00”!
Described here as well:
http://forum.mikrotik.com/t/bridge-port-egress-stop-stp-bpdu/140361/5
I changed my drop-rule like the suggested one:
/interface bridge filter add 802.3-sap=0x42 action=drop chain=output comment="Filter STP" mac-protocol=length out-interface=sfp-sfpplus1
I can confirm, as the user mducharme said, this is bug in ROS!!
The Bridge → Filter rule with DST-MAC “01:80:C2:00:00:00” will drop way(!!) more packets, which will crash your network in random intervals.
PS @Zacharias: There is no Firewall rule in my config…??
There are a few non-routable networks defined as address-list. This is a default config in all my routers, used to distinguish between internal and public IP-(networks).