Filter on bonding interface issue

RouterOS General
1

I have an issue with my CCR1036-12G-4S. When i try to use firewall on bonding interface, it match only for one interface from bonding group.
My RouterOS version 6rc11
My config -
[admin@MikroTik] > interface bonding pr
Flags: X - disabled, R - running
0 R name=“bonding1” mtu=1500 mac-address=D4:CA:6D:88:FA:E5 arp=enabled
slaves=ether2,ether3 mode=802.3ad primary=none link-monitoring=none
arp-interval=100ms arp-ip-targets=“” mii-interval=100ms down-delay=0ms
up-delay=0ms lacp-rate=30secs transmit-hash-policy=layer-2-and-3[admin@MikroTik] > interface bridge port pr
Flags: X - disabled, I - inactive, D - dynamic

INTERFACE BRIDGE PRIORITY PATH-COST HORIZON

0 bonding1 bridge1 0x80 10 none
1 ether4 bridge1 0x80 10 none
2 I ether5 bridge1 0x80 10 none
3 I ether6 bridge1 0x80 10 none[admin@MikroTik] > interface bridge filter print
Flags: X - disabled, I - invalid, D - dynamic
0 chain=forward action=accept mac-protocol=ip src-address=xxx.xxx.167.65/32

1 chain=forward action=accept mac-protocol=ip src-address=xxx.xxx.167.66/32

2 ;;; Default drop
chain=forward action=drop in-bridge=bridge1 out-bridge=bridge1[admin@MikroTik] > interface bridge filter print stats
Flags: X - disabled, I - invalid, D - dynamic

CHAIN ACTION BYTES PACKETS

0 forward accept 0 0
1 forward accept 149479709 1045430
2 ;;; Default drop
forward drop 59050267215 134710263When i check torch both IPs are presented on bonding1 interface. When i check torch on ether2 and ether3, and try to match any ip that presented at ehter2 it is ok, but but when try to match any ip from ether3 it is not matched.
[admin@MikroTik] > tool torch ether2 src-address=“xxx.xxx.167.64/30”
MAC-PROTOCOL SRC-ADDRESS TX RX
ip xxx.xxx.167.67 0bps 1378.7kbps
ip xxx.xxx.167.66 0bps 2.2Mbps
0bps 3.6Mbps

[admin@MikroTik] > tool torch ether3 src-address=“xxx.xxx.167.64/30”
MAC-PROTOCOL SRC-ADDRESS TX RX
ip xxx.xxx.167.65 0bps 3.3Mbps
ip xxx.xxx.167.64 0bps 2.4Mbps
0bps 5.7MbpsWith IP->Firewall tha same issue

2

well. filter only match the mac address of bridge interface. try to set admin mac, static, and do the filtering. I use to set the mac static to whatever present, but change first 2 variables to 66. eg 00:42:c2::xx will be 66:42:c2::xx

3

i try to do it, but there are no result. Again IP traffic from one port matched, from another not matched

4

We solve our problem with some workaround.

There was strange behavior of bonding interface. In one ether all traffic was tagged, in other untagged. So i think it was cause. But i cant say is that issue on mikrotik or on our cisco, because now it is not possible to directly connect to cisco with some analizer and all other portchannels on that cisco works perfect.