Mikrotik CRSxxx STP/RSTP/MSTP block on ports.

RouterOS General
1

Hi Im trying to understand what Im doing wrong when I try to apply these settings to block STP|RSTP|MSTP on customer ports in our L2 network.

From wiki:

Don’t send out BPDUs from a certain port
/interface bridge
add name=bridge1
/interface bridge port
add bridge=bridge1 interface=ether1
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=ether3
/interface bridge filter
add action=drop chain=output dst-mac-address=01:80:C2:00:00:00/FF:FF:FF:FF:FF:FF out-interface=ether1

In this example BPDUs will not be sent out through ether1. In case the bridge is the root bridge, then loop detection will not work on this port. If another bridge is connected to ether1, then the other bridge will not receive any BPDUs and therefore might become as a second root bridge. You might want to consider blocking received BPDUs as well.

When I add this example all traffic dies/blocks thru that port…


I think this is working with blocking incoming..
Dropping received BPDUs on a certain port can be done on some switch chips using ACL rules, but the Bridge Filter Input rules cannot do it if bridge has STP/RSTP/MSTP enabled because then received BPDUs have special processing in the bridge.
On CRS3xx:

/interface ethernet switch rule
add dst-mac-address=01:80:C2:00:00:00/FF:FF:FF:FF:FF:FF new-dst-ports=“” ports=ether1 switch=switch1

2

Try adding


add stp-type=config

to your filter rule and then create another filter rule for TCN. This should match and only drop BPDUs and not all outbound traffic.

3

Hi thanks for the reply. I added those two.. but I still recive RSTP from those ports… but now the traffic is not blocket.. and I cant see any traffic gets blocked.