VLAN issue in CRS

Hi All,
I have CRS 109 ROS 6.29.1.
have the following config for VLAN:

/interface ethernet
set [ find default-name=ether1 ] name=ether1-gateway
set [ find default-name=ether2 ] name=ether2-master-local
set [ find default-name=ether3 ] master-port=ether2-master-local name=\
    ether3-slave-local
set [ find default-name=ether4 ] master-port=ether2-master-local name=\
    ether4-slave-local
set [ find default-name=ether5 ] master-port=ether2-master-local name=\
    ether5-slave-local
set [ find default-name=ether6 ] master-port=ether2-master-local name=\
    ether6-slave-local
set [ find default-name=ether7 ] master-port=ether2-master-local name=\
    ether7-slave-local
set [ find default-name=ether8 ] master-port=ether2-master-local name=\
    ether8-slave-local
set [ find default-name=sfp1 ] master-port=ether2-master-local name=\
    sfp1-slave-local
/interface ethernet switch
set drop-if-invalid-or-src-port-not-member-of-vlan-on-ports=\
    ether2-master-local,ether5-slave-local,ether7-slave-local
/interface ethernet switch egress-vlan-tag
add tagged-ports=ether2-master-local vlan-id=33
/interface ethernet switch ingress-vlan-translation
add customer-vid=0 new-customer-vid=33 ports=ether5-slave-local sa-learning=\
    yes
add customer-vid=0 new-customer-vid=33 ports=ether7-slave-local sa-learning=\
    yes
/interface ethernet switch vlan
add ports=ether2-master-local,ether5-slave-local,ether7-slave-local vlan-id=\
    33
[admin@MikroTik] /interface ethernet>

VLAN does not seem to be working. Also I can get frames sent thru ether5 to other interfaces like ether8!
What is wrong or missing? How to implement proper VLAN setting? I dont use GUI.

Thanks!

/interface ethernet switch
set drop-if-invalid-or-src-port-not-member-of-vlan-on-ports=
ether2-master-local,ether5-slave-local,ether7-slave-local

I think you should drop invalid vlan on all interfaces..