A bridge group is a virtual interface that groups one or more interfaces. The main reason to group interfaces is to create a group of switched interfaces. Thus, you can attach workstations or other endpoint devices directly to the interfaces included in the bridge group. You do not need to connect them through a separate physical switch, although you can also attach a switch to a bridge group member.
The group members do not have IP addresses. Instead, all member interfaces share the IP address of the Bridge Virtual Interface (BVI). If you enable IPv6 on the BVI, member interfaces are automatically assigned unique link-local addresses.
You typically configure a DHCP server on the bridge group interface (BVI), which provides IP addresses for any endpoints connected through member interfaces. However, you can configure static addresses on the endpoints connected to the member interfaces if you prefer. All endpoints within the bridge group must have IP addresses on the same subnet as the bridge group IP address.
Note | For ISA 3000, the device comes pre-configured with bridge group BVI, named inside, which includes all data interfaces except for the outside interface. Thus, the device is pre-configured with one port used for linking to the Internet or other upstream network, and all other ports enabled and available for direct connections to endpoints. If you want to use an inside interface for a new subnet, you must first remove the needed interfaces from BVI. |
FDM-managed devices only support one bridge group; therefore, Cisco Defense Orchestrator can only manage that one bridge group and cannot create additional bridge groups on the device.
After you create a bridge group on CDO, you will not know the bridge group ID until after the configuration is deployed to the FDM-managed device. FDM-managed device assigns the bridge group ID, for example, BVI1. If the interface is deleted and a new bridge group is created, the new bridge group receives an incremented number, for example, BVI2.
Before you Begin
Configure the interfaces that will be members of the bridge group. Specifically, each member interface must meet the following requirements:
-
The interface must have a name.
-
The interface cannot be configured as management-only.
-
The interface cannot be configured for passive mode.
-
The interface cannot be an EtherChannel interface or an EtherChannel subinterface.
-
The interface cannot have any IPv4 or IPv6 addresses defined for it, either static or served through DHCP. If you need to remove the address from an interface that you are currently using, you might also need to remove other configurations for the interface, such as static routes, DHCP server, or NAT rules, that depend on the interface having an address. If you try to add an interface with an IP address to a bridge group, CDO will warn you. If you continue to add the interface to the bridge group, CDO will remove the IP address from the interface configuration.
-
BVI can have either VLAN interfaces or other routed interfaces as a member interface, but you cannot have both as member interfaces on a single BVI.
-
The interface cannot be Point-to-Point Protocol over Ethernet (PPPoE)
-
The interface cannot be associated with a security zone (if it is in a zone). You must delete any NAT rules for the interface before you can add it to a bridge group.
-
Enable and disable the member interfaces individually. Thus, you can disable any unused interfaces without needing to remove them from the bridge group. The bridge group itself is always enabled.
-
Bridge groups do not support clustering.
Note | Bridge groups are not supported on Firepower 2100 devices in routed mode or on VMware with bridged ixgbevf interfaces. |
FAQs
To configure bridging, you must perform the following tasks in the modes indicated: In global configuration mode: – Enable bridging of IP packets. – Select the type of Spanning Tree Protocol (STP) (optional). In interface configuration mode: – Determine which interfaces belong to the same bridge group.
In which mode of ASA is BVI necessary to configure bridge groups? ›
In routed mode, to route between bridge groups and other routed interfaces, you must name the BVI.
What is a bridge group cisco? ›
The bridge-group command is used to configure a Cisco device to bridge traffic between two interfaces. In your configuration above traffic is being bridged between physical ethernet interfaces and tunnel interfaces.
What is the difference between bridge domain and bridge group? ›
These meanings vary if you are dealing with IOS or IOS XR. On XR, a bridge group has no specific function (I am aware of) other than organizing the configuration. The bridge domain is the component that performs L2 forwarding and bridging.
What is bridge configuration? ›
Bridging is a data link layer (Layer 2) process that enables multiple physical LAN segments to be interconnected into a single larger network. Bridges forward and flood traffic based on MAC addresses. Bridging can also be used to connect two remote sites to the same broadcast domain.
What is the bridge setting on a router? ›
Bridge mode is a setting within a router that turns off the router's Wi-Fi broadcast, turning it into a bridge between the network and another Wi-Fi router.
What is the purpose of a bridge group? ›
A bridge group is a virtual interface that groups one or more interfaces. The main reason to group interfaces is to create a group of switched interfaces.
What is the bridge group? ›
The Bridge Group is a non-profit consultancy that uses research to promote social equality.
How many people are in a bridge group? ›
In its basic format, it is played by four players in two competing partnerships, with partners sitting opposite each other around a table. Millions of people play bridge worldwide in clubs, tournaments, online and with friends at home, making it one of the world's most popular card games, particularly among seniors.
Is a bridge domain a VLAN? ›
A bridge domain is a set of logical ports that share the same flooding or broadcast characteristics. Like a virtual LAN (VLAN), a bridge domain spans one or more ports of multiple devices.
The bridge groups feature works the same way as a VLAN. Multiple VLANS can be bound to a single bridge group, and all VLANs bound to same bridge group form a single broadcast domain.
Does bridge connect two different networks? ›
Bridging is distinct from routing. Routing allows multiple networks to communicate independently and yet remain separate, whereas bridging connects two separate networks as if they were a single network. In the OSI model, bridging is performed in the data link layer (layer 2).
How do I setup a bridge connection? ›
Here's how to do it.
- Position the bridge. Place the wireless bridge within range of your wireless router's signal, and also within a cable's length of your wired devices.
- Connect the bridge to your network. If your router supports Wi-Fi Protected Setup, or WPS, setup is easy. ...
- Plug in network devices.
To ensure that a switch has the lowest bridge priority value, use the spanning-tree vlan vlan-id root primary command in global configuration mode. The priority for the switch is set to the predefined value of 24,576 or to the highest multiple of 4096 less than the lowest bridge priority detected on the network.
How do I set my access point to bridge mode? ›
Type the IP address of your access point in your Web browser's location or address line and press ENTER. When prompted, enter your user name and password for the access point and press ENTER. Click the Wireless tab. For the Wireless Network Type, select Bridge.
