When I want any NO vlan traffic (normal ethernet packages) to go from port 5 to 6 and vice versa, I use on both ports "U". The "ID" I set is just some random number since it actually has no other meaning then to give a data stream an ID. Only if one of the ports has a "T" where previously untagged (no vlan) traffic is leaving switch the switch will put a vlan header that is set in the "ID" field.
Now if I want ONLY vlan traffic to pass from one port to another, I set "T" on both switch ports. Port that receives traffic only accepts packages when they have a vlan header same as what I set in the ID field. In my case 2000. All other traffic is not accepted.
So these accepted packages now leave the switch to the other port(s) with same ID if that port has "T" set. Did it have "U" set the vlan header would have been stripped and the packages just leave the switch as normal ethernet traffic.
But since I have packages coming from both ends with vlan headers ID=2000 I have to set "T" on both ends. Actually there is no option to set one of the two port with "U" since "U" is already set for the normal ethernet traffic stream.. (With another ID)
So this is what I have done now, and there is no vlan2000 headers packages passing the switch......
- Screenshot 2015-10-23 23.24.22.png (49.09 KiB) Viewed 6002 times
Somewhere something is not right...
Setup of my MT router is sort of similar as your Cisco. The vlan interface is just a virtual interface residing on a real one. The real one has the normal ethernet traffic where the vlan interface has the vlan (2000) traffic.
The only difference in my CCR compared to your Cisco is that my CCR is not stripping the vlan headers. The virtual interface is just brought in a bridge so traffic with that vlan header can go to the rest of its virtual network towards the set default gateway. And on this bridge in the CCR is actually a dhcp-server assigning vlan2000 IP range addresses to requesting clients (hotspot clients)
I did actually tested the setup like you have, with the virtual lan just stripping the headers or adding them. I set a dhcp-server and IP on that virtual interface but on the other end of the switch the vlan clients don't see this interface nor get an IP from it dhcp server..... So the bridge setup is not to blame...
The only other parameters we can play with are the ARP settings and Service Tag setting of the virtual lan interfaces of the Mikrotik routers.
But it works in a full MT devices network so I am a bit hesitating to start playing with these settings which took me months to figure out how they had to be set....
ARP can be set on each vlan interface as 'disabled', 'enabled', 'proxy-arp' and 'reply only'
The "Use Service Tag" option, in my case always enabled. According documentation is means 802.1ad setting.