Ethernet bridges provide a means for hosts to communicate through layer 2, by connecting all of the physical and logical interfaces in the system into a single layer 2 domain. The bridge is a logical interface with a MAC address and an MTU (maximum transmission unit). The bridge MTU is the minimum MTU among all its members. The bridge's MAC address is inherited from the first interface that is added to the bridge as a member. The bridge MAC address remains unchanged until the member interface is removed from the bridge, at which point the bridge will inherit from the next member interface, if any. The bridge can also be assigned an IP address, as discussed below.
Bridge members can be individual physical interfaces, bonds or logical interfaces that traverse an 802.1Q VLAN trunk.
Cumulus Networks recommends using VLAN-aware mode bridges, rather than traditional mode bridges. The bridge driver in Cumulus Linux is capable of VLAN filtering, which allows for configurations that are similar to incumbent network devices. While Cumulus Linux supports Ethernet bridges in traditional mode, Cumulus Networks recommends using VLAN-aware mode.
For a comparison of traditional and VLAN-aware modes, read this knowledge base article.
Cumulus Linux does not put all ports into a bridge by default.
Creating a VLAN-aware Bridge
To learn about VLAN-aware bridges and how to configure them, read VLAN-aware Bridge Mode for Large-scale Layer 2 Environments.
Creating a Traditional Mode Bridge
To create a traditional mode bridge, see Traditional Mode Bridges.
Configuring Bridge MAC Addresses
The MAC address for a frame is learned when the frame enters the bridge via an interface. The MAC address is recorded in the bridge table, and the bridge forwards the frame to its intended destination by looking up the destination MAC address. The MAC entry is then maintained for a period of time defined by the
bridge-ageing configuration option. If the frame is seen with the same source MAC address before the MAC entry age is exceeded, the MAC entry age is refreshed; if the MAC entry age is exceeded, the MAC address is deleted from the bridge table.
The following example output shows a MAC address table for the bridge:
MAC Address Ageing
By default, Cumulus Linux stores MAC addresses in the Ethernet switching table for 1800 seconds (30 minutes). You can change this setting using NCLU.
bridge-ageing option is in the NCLU blacklist, as it's not frequently used. To configure this setting, you need to remove the
bridge-ageing keyword from the
/etc/netd.conf. Restart the
netd service after you edit the file.
Now you can change the setting using NCLU. For example, to change the setting to 600 seconds, run:
These commands create the following configuration in the
Configuring an SVI (Switch VLAN Interface)
Bridges can be included as part of a routing topology after being assigned an IP address. This enables hosts within the bridge to communicate with other hosts outside of the bridge, via a switch VLAN interface (SVI), which provides layer 3 routing. The IP address of the bridge is typically from the same subnet as the bridge's member hosts.
To configure the SVI, use NCLU:
These commands create the following SVI configuration in the
vlan-raw-device keyword, which NCLU includes automatically. NCLU uses this keyword to associate the SVI with the VLAN-aware bridge.
Alternately, you can use the bridge.VLAN-ID naming convention for the SVI. The following example configuration can be manually created in the
/etc/network/interfaces file, which functions identically to the above configuration:
Keeping the SVI in an UP State
When a switch is initially configured, all southbound bridge ports may be down, which means that, by default, the SVI is also down. However, you may want to force the SVI to always be up, to perform connectivity testing, for example. To do this, you essentially need to disable interface state tracking, leaving the SVI in the UP state always, even if all member ports are down. Other implementations describe this feature as "no autostate".
In Cumulus Linux, you can keep the SVI perpetually UP by creating a dummy interface, and making the dummy interface a member of the bridge. Consider the following configuration, without a dummy interface in the bridge:
With this configuration, when swp3 is down, the SVI is also down:
Now add the dummy interface to your network configuration:
Create a dummy interface, and add it to the bridge configuration. You do this by editing the
/etc/network/interfacesfile and adding the dummy interface stanza before the bridge stanza:
Continue editing the
interfacesfile. Add the dummy interface to the
bridge-portsline in the bridge configuration:
Save and exit the file, then reload the configuration:
Now, even when swp3 is down, both the dummy interface and the bridge remain up:
Caveats and Errata
- A bridge cannot contain multiple subinterfaces of the same port. Attempting this configuration results in an error.
- In environments where both VLAN-aware and traditional bridges are in use, if a traditional bridge has a subinterface of a bond that is a normal interface in a VLAN-aware bridge, the bridge will be flapped when the traditional bridge's bond subinterface is brought down.