Bridge configuration — members, addressing, STP

Bridge configuration in VyOS is more than just adding members. This lesson covers the full configuration surface: members, addressing, STP, VLAN awareness, MTU, and the failure modes the operator must recognise.

Member configuration

[edit]
vyos@vyos# set interfaces bridge br0
[edit]
vyos@vyos# set interfaces bridge br0 member interface eth0
[edit]
vyos@vyos# set interfaces bridge br0 member interface eth0 allowed-vlan 10
[edit]
vyos@vyos# set interfaces bridge br0 member interface eth0 allowed-vlan 20
[edit]
vyos@vyos# set interfaces bridge br0 member interface eth1
[edit]
vyos@vyos# commit
[edit]
vyos@vyos# save

Each member interface is added with member interface ethN. For VLAN-aware bridges, the allowed VLANs are configured per member.

Bridge IP address

[edit]
vyos@vyos# set interfaces bridge br0 address '192.0.2.1/24'
[edit]
vyos@vyos# set interfaces bridge br0 address '2001:db8::1/64'
[edit]
vyos@vyos# commit
[edit]
vyos@vyos# save

The bridge can have IPv4 and IPv6 addresses. The address is the gateway for the segment.

STP configuration

[edit]
vyos@vyos# set interfaces bridge br0 stp
[edit]
vyos@vyos# set interfaces bridge br0 stp priority '4096'
[edit]
vyos@vyos# set interfaces bridge br0 stp hello-time '2'
[edit]
vyos@vyos# set interfaces bridge br0 stp forward-delay '15'
[edit]
vyos@vyos# set interfaces bridge br0 stp max-age '20'
[edit]
vyos@vyos# commit
[edit]
vyos@vyos# save

STP is enabled with stp. The priority affects root bridge election (lower priority is preferred). The hello-time, forward- delay, and max-age are STP timers; the defaults are usually fine.

VLAN-aware bridge

[edit]
vyos@vyos# set interfaces bridge br0 vlan-aware
[edit]
vyos@vyos# set interfaces bridge br0 vlan 10
[edit]
vyos@vyos# set interfaces bridge br0 vlan 20
[edit]
vyos@vyos# commit
[edit]
vyos@vyos# save

A VLAN-aware bridge handles multiple VLANs as separate broadcast domains. Each VLAN has its own FDB and STP state.

Bridge MTU

[edit]
vyos@vyos# set interfaces bridge br0 mtu '9000'
[edit]
vyos@vyos# commit
[edit]
vyos@vyos# save

The bridge MTU is the maximum frame size across all members. A jumbo-frame bridge requires all members to support 9000-byte frames.

How the result is validated

show bridge
show spanning-tree
ip link show br0
brctl show br0
brctl showstp br0

The first shows the VyOS view; the second shows the STP state; the third shows the kernel state; the fourth shows members; the fifth shows detailed STP state.

How it fails

The production failure modes the engineer must recognise:

• Member with incompatible MTU. A bridge member with MTU 1500 in a 9000-byte bridge drops jumbo frames.
• STP not converging. A bridge with STP enabled but mis- configured timers may not converge. The default timers are usually fine.
• VLAN-aware bridge without VLAN IDs. A VLAN-aware bridge without VLANs configured has no VLANs to forward.
• Bridge IP on member. Confuses routing.
• Bridge with no members. Has no forwarding path.

Rollback

The recovery from a bad bridge configuration:

• Wrong member: delete interfaces bridge br0 member interface ethN; commit; save.
• Wrong STP: delete interfaces bridge br0 stp; commit; save.
• Wrong MTU: delete interfaces bridge br0 mtu; commit; save.

Production discipline

Cross-course references

The Proxmox course’s XXIX-Proxmox-Networking covers the host-side bridge configuration. The OPNsense course’s XIV-OPNsense-VLAN covers the equivalent L2 concepts. The Linux course’s XIX-Linux-NetFoundations covers the kernel’s bridge model.

Quiz