Traffic-Flow Port-Mirrored Traffic

RouterOS General
1

We're wanting to set up Traffic-Flow for sfp-sfpplus3 [on our CCR1072].

sfp-sfpplus3 is receiving mirrored traffic from an adjacent Juniper Router. The Juniper does not support J-Flow [Juniper's version of Traffic-Flow/NetFlow, hence why we've mirrored traffic and we're attempting to shift this duty to our CCR1072].

Ether1 on the MikroTik Router has access to the Traffic-Flow target [we'll say 10.0.0.1].

When we monitor interface ether1, the target receives our Traffic-Flow output; but when we monitor sfp-sfpplus3, no output ever arrives. Configuration below:

ip traffic-flow print
enabled: yes
interfaces: ether1: Uplink to RB3011
cache-entries: 2M
active-flow-timeout: 30s
inactive-flow-timeout: 15s

ip traffic-flow target print

SRC-ADDRESS -DST-ADDRESS -PORT VERSION

0 0.0.0.0 -10.0.0.1 -2055 5

2

I am reading that mirrored traffic won’t be picked up on Traffic-Flow because mirrored packets are dropped before they reach the input chain.

Link directly below for reference:
https://help.mikrotik.com/docs/display/ROS/Packet+Flow+in+RouterOS

Is there a workaround to this? For instance, I’ve tried to force mirrored traffic onto a bridge, and now I can torch the bridge and observe the traffic. Unfortunately, it’s still not being picked up by Traffic-Flow.

Syntax used to force traffic onto bridge:
/interface bridge nat
add action=redirect chain=dstnat comment=“” disabled=no

I’m wondering if we can do something similar so that they reach the input chain and get picked up by Traffic-Flow.