I am setting up a mikrotik router, but it didn't work as expected.
To sum up:
One Management IP 10.10.0.99 in the VRF main.
For the Public IP-Adresses i have the vrf "PUBLIC-VRF". sfp-sfpplus1 (eg. 122.122.122.2) is facing to my ISP. To that IP-Adress my ISP is routing my private block 123.123.123.0/24. 123.123.123.1/24 is an VLAN-Interface on a bridge (vl80). I did that to have more options later and a trunk is going to a switch.
The Problem:
I am not able to ping 123.123.123.1 from my other IP-Adresses in the same subnet. I see ARP requests coming from the trunk to the mikrotik, but nothing else.
The Configuration:
/interface bridge
add name=bridge-public vlan-filtering=yes
/interface ethernet
set [ find default-name=sfp-sfpplus1 ] comment=ISP-ext
set [ find default-name=sfp-sfpplus2 ] disabled=yes
set [ find default-name=sfp-sfpplus3 ] comment=RESERVED
set [ find default-name=sfp-sfpplus4 ] disabled=yes
set [ find default-name=sfp-sfpplus5 ] disabled=yes
set [ find default-name=sfp-sfpplus6 ] disabled=yes
set [ find default-name=sfp-sfpplus7 ] disabled=yes
set [ find default-name=sfp-sfpplus8 ] disabled=yes
set [ find default-name=sfp-sfpplus9 ] disabled=yes
set [ find default-name=sfp-sfpplus10 ] disabled=yes
set [ find default-name=sfp-sfpplus11 ] comment=Switch-TRUNK
set [ find default-name=sfp-sfpplus12 ] comment=Switch-TRUNK
/interface vlan
add interface=bridge-public name=bridge-public-vl80 vlan-id=80
/interface bonding
add mode=802.3ad name=switch-channel slaves=sfp-sfpplus11,sfp-sfpplus12
/interface list
add name=mgmt
/ip vrf
add interfaces=sfp-sfpplus1,bridge-public-vl80 name=PUBLIC-VRF
/interface bridge port
add bridge=bridge-public interface=switch-channel
/ip neighbor discovery-settings
set discover-interface-list=mgmt
/interface bridge vlan
add bridge=bridge-public tagged=switch-channel,bridge-public vlan-ids=80
/interface list member
add interface=ether1 list=mgmt
/ip address
add address=123.123.123.1/24 interface=bridge-public-vl80 network=123.123.123.0
add address=122.122.122.2/30 interface=sfp-sfpplus1 network=122.122.122.0
add address=10.10.0.99/24 interface=ether1 network=10.10.0.0
/ip route
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=10.10.0.1 routing-table=main scope=30 target-scope=10
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=122.122.122.1@PUBLIC-VRF routing-table=PUBLIC-VRF scope=30 target-scope=10
/ip service
set telnet disabled=yes
/ip ssh
set host-key-type=ed25519 strong-crypto=yes
/system clock
set time-zone-name=Europe/Vienna
/system ntp client
set enabled=yes
/system ntp client servers
add address=10.10.11.1
/system routerboard settings
set auto-upgrade=yes enter-setup-on=delete-key
/tool bandwidth-server
set enabled=no
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=mgmt
/tool mac-server ping
set enabled=no
is the configuration above complete (nothing left out as it "cannot be related")?
what does /interface bridge port monitor [find where bridge=bridge-public]show?
how exactly do you "see the ARP requests coming in", using /tool sniffer? If yes, setting hw=no on the relevant rows of /interface/bridge/port may help seeing the responses.
In another words, nothing in the configuration seems to explain why it does not even respond to ARP requests, of course unless there is a typo in the actual addresses.
It used to be mandatory to manually make the bridge "itself" (actually, the router-facing virtual port of the virtual switch) a member port of each VLAN on that virtual switch you wanted the router to get access to (by means of an /interface vlan attached to the switch-facing interface of the router, again using the same name of "bridge itself"). It is only since ROS 7.16 or so that this is done dynamically as soon as you create the /interface vlan (and it is still still shown in /interface bridge vlan print). So the construct /interface bridge vlan add bridge=br-xyz tagged=...,br-xyz,... vlan-ids=... is still accepted even though not necessary any more.
i did "/tool/sniffer/quick interface=bridge-public-vl80".
after the reboot i see "who has" requests and replys with "at xxxx" but i cannot see arp entrys on the other devices. but on the mikrotik i see arp entrys of the other devides i am trying to ping from.
OK, so the IP stack in the VRF does respond to the ARP requests, that wasn't clear from your OP. So now I'd run the sniffer without restricting to interface=bridge-public-vl80 but instead restricting to mac-protocol=arp to see how far the responses get, and I'd also have a look at /interface bridge host print where vid=80.
Hm, those results prove that the Mikrotik is doing everything right, and you are even lucky enough that the link selection on the bond peers chooses the same link (sfp-sfpplus12) for the ARP request and response. So I'd now refocus the search to the switch and to the Proxmox itself, do you use Linux bridge or OVS bridge?
there was in fact a configuration issue on an other mikrotik to the new mikrotik router. On the bridge at vlan 80 the switch-cannel was allowed but the port configuration was set to "admit only untagged and priority tagged".
so the switch sent out the arp requests to the router but didn't accept them back.