At quick glance I can spot only one error:
.
/interface ethernet switch vlan
add ports=switch1-cpu,ether5 switch=switch1 vlan-id=131
.
In order to "pull" VLAN from switch chip to router's CPU (read: bridge1), switch1-cpu "port" has to be member of said VLAN.
And I assume that in
/interface ethernet switch port you really wanted to configure ports ether5, ether6 and ether7 ...
Thanks!
I take notes. In lab we now use the bridged only, and it is working, it eats some cpu cycles, it will eventually go in to production.
We now test to upgrade another CCR to see if the switched variant with higher routeros version also works. Then we will decide how to do.
I spotted an error myself, it should not be ether1, ether2, ether4 and ether4 in the example, it should off course be ether5, ether6 and ether7
Wrong:
/interface ethernet switch port
set ether1 vlan-mode=secure vlan-header=add-if-missing
set ether2 vlan-mode=secure vlan-header=add-if-missing
set ether3 vlan-mode=secure vlan-header=add-if-missing
set ether4 vlan-mode=secure vlan-header=add-if-missing
Correct:
/interface ethernet switch port
set ether5 vlan-mode=secure vlan-header=add-if-missing
set ether6 vlan-mode=secure vlan-header=add-if-missing
set ether7 vlan-mode=secure vlan-header=add-if-missing