Being new to Miktrotik devices (but not to networking) I've been struggling quite a while with an more than unpleasent issue in the following setup:
- 2 HP Procurve 2510 switches, connected to each other, named sw1 and sw2
- 2 Mikrotik CRS309-1G-8S+ as MLAG, identically configured, named sw5 and sw6
- sfp-sfplus8 set up as MLAG peer port (implemented as bond), transporting all vlans, using vlan 777 untagged as means for MLAG protocol
- sfp-sfpplus6 as bond6, currently transporting only one vlan, that tagged
- spf-sfpplus 1-3 as bonds 1-3, each bond serves a Proxmox server (server 1-3), carrying almost all vlans, tagged
- setup made according to the official documentation
- firmware 7.23.1
- sw5 is connected with port ether1 to sw1 portX, carrying all vlans tagged
- sw6 is connected with port ether1 to sw2 portX, carrying all vlans tagged
- port X on sw2 is disabled by STP so sw6 can be reached by sw5 only (no loops, expected STP behaviour)
Now the strange issue: I can see on interface 2 of server pmx1 traffic that is between servers pmx2 and pmx3 (either direction). The mac address table on either of sw5 and sw6 has the correct bond interface as destination so each switch actually knows where to forward the specific traffic to. But it also floods it to interface bond1. The same applies to any combination (take one server and its port on sw6 and notice traffic being actually between the other two server ports).
Configuration of sw05:
# 2026-07-02 19:06:41 by RouterOS 7.23.1
# software id = SP8X-IMJ4
#
# model = CRS309-1G-8S+
/interface ethernet
set [ find default-name=sfp-sfpplus1 ] mtu=1584
set [ find default-name=sfp-sfpplus2 ] mtu=1584
set [ find default-name=sfp-sfpplus3 ] mtu=1584
set [ find default-name=sfp-sfpplus8 ] mtu=1584
/interface bonding
add lacp-rate=1sec mode=802.3ad name=bond-mlag slaves=sfp-sfpplus8 \
transmit-hash-policy=layer-2-and-3
add lacp-rate=1sec mlag-id=1 mode=802.3ad name=bond1 slaves=sfp-sfpplus1 \
transmit-hash-policy=layer-2-and-3
add lacp-rate=1sec mlag-id=2 mode=802.3ad name=bond2 slaves=sfp-sfpplus2 \
transmit-hash-policy=layer-2-and-3
add lacp-rate=1sec mlag-id=3 mode=802.3ad name=bond3 slaves=sfp-sfpplus3 \
transmit-hash-policy=layer-2-and-3
add lacp-rate=1sec mlag-id=6 mode=802.3ad name=bond6 slaves=sfp-sfpplus6 \
transmit-hash-policy=layer-2-and-3
add lacp-rate=1sec mlag-id=7 mode=802.3ad name=bond7 slaves=sfp-sfpplus7 \
transmit-hash-policy=layer-2-and-3
/interface bridge
add admin-mac=redacted auto-mac=no comment=defconf igmp-snooping=yes \
mlag-peer-port=bond-mlag mlag-priority=50 name=bridge vlan-filtering=yes
/interface vlan
add interface=bridge name=mgmt vlan-id=206
/interface bridge port
add bridge=bridge comment=defconf frame-types=admit-only-vlan-tagged \
interface=ether1 pvid=206
add bridge=bridge comment=defconf interface=sfp-sfpplus4
add bridge=bridge comment=defconf interface=sfp-sfpplus5
add bridge=bridge frame-types=admit-only-vlan-tagged interface=bond-mlag \
pvid=777
add bridge=bridge frame-types=admit-only-vlan-tagged interface=bond1
add bridge=bridge frame-types=admit-only-vlan-tagged interface=bond2
add bridge=bridge frame-types=admit-only-vlan-tagged interface=bond3
add bridge=bridge interface=bond7
add bridge=bridge frame-types=admit-only-vlan-tagged interface=bond6
/ipv6 settings
# ipv6 neighbor configuration has changed, please restart the device in order to apply the new settings
set allow-fast-path=no disable-ipv6=yes forward=no
/interface bridge vlan
add bridge=bridge tagged=bond-mlag,ether1,bond1,bond2,bond3,bond7 vlan-ids=\
200
add bridge=bridge tagged=bond-mlag,ether1,bond1,bond2,bond3,bond7 vlan-ids=\
201
add bridge=bridge tagged=bond-mlag,ether1,bond1,bond2,bond3,bond7 vlan-ids=\
202
add bridge=bridge tagged=bond-mlag,ether1,bond1,bond2,bond3,bond7 vlan-ids=\
203
add bridge=bridge tagged=bond-mlag,ether1,bond1,bond2,bond3,bond7 vlan-ids=\
204
add bridge=bridge tagged=bond-mlag,ether1,bond1,bond2,bond3,bond7 vlan-ids=\
205
add bridge=bridge tagged=bond-mlag,ether1,bond1,bond2,bond3,bond7 vlan-ids=\
206
add bridge=bridge tagged=bond-mlag,ether1,bond1,bond2,bond3,bond7 vlan-ids=\
207
add bridge=bridge tagged=bond-mlag,ether1,bond1,bond2,bond3,bond7 vlan-ids=\
208
add bridge=bridge tagged=bond-mlag,ether1,bond1,bond2,bond3,bond7 vlan-ids=\
209
add bridge=bridge tagged=bond-mlag,ether1,bond1,bond2,bond3,bond7 vlan-ids=\
210
add bridge=bridge tagged=bond-mlag,ether1,bond1,bond2,bond3,bond7 vlan-ids=\
211
add bridge=bridge tagged=bond-mlag,ether1,bond1,bond2,bond3,bond7 vlan-ids=\
212
add bridge=bridge tagged=bond-mlag,ether1,bond1,bond2,bond3,bond7 vlan-ids=\
213
add bridge=bridge tagged=bond-mlag,ether1,bond1,bond2,bond3,bond7 vlan-ids=\
241
add bridge=bridge tagged=bond-mlag,ether1,bond1,bond2,bond3,bond7 vlan-ids=\
251
add bridge=bridge tagged=bond-mlag,ether1,bond1,bond2,bond3,bond7 vlan-ids=\
253
add bridge=bridge tagged=bond-mlag,ether1,bond1,bond2,bond3,bond7 vlan-ids=\
214
add bridge=bridge tagged=bond-mlag,ether1,bond1,bond2,bond3,bond7 vlan-ids=\
215
add bridge=bridge tagged=bond-mlag,ether1,bond1,bond2,bond3,bond6,bond7 \
vlan-ids=216
add bridge=bridge untagged=bond-mlag vlan-ids=777
/ip address
add address=192.168.6.5/24 interface=mgmt network=192.168.6.0
/ip dns
set servers=192.168.0.1
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=192.168.6.254
/ip service
set ftp disabled=yes
set telnet disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ipv6 nd
set [ find default=yes ] advertise-dns=yes disabled=yes
/system identity
set name=sw5
/system logging
add action=syslogserver topics=warning,error,critical
/system ntp client
set enabled=yes
/system ntp client servers
add address=192.168.0.2
/system routerboard settings
set enter-setup-on=delete-key
Configuration of sw6 differs in just identity, management IP, admin mac and mlag priority.
Any hints are appreciated, additonal state information could be provided. I intensively consulted Claude Opus (nothing to loose than a couple of bucks) - it considered it a bug. For: taking the mac address of one of the servers (say pmx2) whose communication with server pmx3 is not supposed to be seen on any port of server pmx1,
mac address table on sw5 says:
Flags: X - DISABLED; I - INVALID; D - DYNAMIC; L - LOCAL; E - EXTERNAL; A - AGED; a - AGED-PEER
# MAC-ADDRESS VID ON-INTERFACE BRIDGE REMOTE-IP
130 D E 00:11:0A:6B:0C:A4 215 bond3 bridge
131 D E 00:11:0A:6B:0C:A4 216 bond3 bridge
mac address table on sw6 says:
Flags: D - DYNAMIC; E - EXTERNAL
Columns: MAC-ADDRESS, VID, ON-INTERFACE, BRIDGE
# MAC-ADDRESS VID ON-INTERFACE BRIDGE
113 DE 00:11:0A:6B:0C:A4 215 bond3 bridge
114 DE 00:11:0A:6B:0C:A4 216 bond3 bridge
None of it considers the mac being local