Bridge + VRF — combining Layer 2 and Layer 3 segmentation

A bridge can be associated with a VRF, putting the bridge’s IP address and routing in the VRF. This pattern combines Layer 2 forwarding with Layer 3 segmentation: the bridge forwards frames between members, and the bridge’s IP traffic lives in a specific VRF.

Bridge in a VRF

flowchart TB
  subgraph vrf_default[default VRF]
    A[eth0]
  end
  subgraph vrf_lab[VRF lab]
    B[br0]
    C[eth1]
    D[eth2]
  end
  A -. vrf boundary .-> B
  C --> B
  D --> B

The bridge br0 has eth1 and eth2 as members. Both are in the VRF lab. The bridge’s IP address 192.0.2.1/24 lives in the lab VRF.

Configuration

[edit]
vyos@vyos# set interfaces bridge br0
[edit]
vyos@vyos# set interfaces bridge br0 member interface eth1
[edit]
vyos@vyos# set interfaces bridge br0 member interface eth2
[edit]
vyos@vyos# set interfaces bridge br0 address '192.0.2.1/24'
[edit]
vyos@vyos# set vrf name lab
[edit]
vyos@vyos# set interfaces bridge br0 vrf 'lab'
[edit]
vyos@vyos# set interfaces ethernet eth1 vrf 'lab'
[edit]
vyos@vyos# set interfaces ethernet eth2 vrf 'lab'
[edit]
vyos@vyos# commit
[edit]
vyos@vyos# save

The bridge is in the lab VRF. Its members are also in the lab VRF. The bridge’s IP address lives in the lab VRF.

Use cases

• Lab network isolation. A bridge for the lab network with all traffic in the lab VRF. Production traffic stays in the default VRF.
• Tenant isolation. A bridge per tenant, each in its own VRF. Tenants cannot see each other’s traffic.
• Service chaining. A bridge in a VRF connecting to a service chain (firewall, IDS) that operates in the same VRF.

Reading the bridge in VRF

vyos@vyos:~$ show vrf
Name      Interfaces
-------   ---------
default   eth0
lab       br0, eth1, eth2

vyos@vyos:~$ show ip route vrf lab
C    192.0.2.0/24 is directly connected, br0

The show vrf command lists VRFs and their interfaces. The show ip route vrf lab command shows the routing table for the lab VRF.

How the result is validated

show vrf
show ip route vrf lab
ip link show br0
ip vrf exec lab ping 192.0.2.10

The first two show the VRF configuration; the third shows the bridge state; the fourth pings a host from within the lab VRF.

How it fails

The production failure modes the engineer must recognise:

• Bridge in VRF but members in default. The kernel rejects the configuration because the bridge would cross VRF boundaries.
• IP on bridge in wrong VRF. The IP is reachable from the wrong VRF.
• Routing table missing. No route to other VRFs means the bridge cannot reach them.
• Firewall on the bridge blocks traffic. The bridge is in the VRF; firewall rules apply in the VRF context.

Rollback

The recovery from a bad bridge + VRF configuration:

• Wrong VRF: delete interfaces bridge br0 vrf 'lab'; commit; save.
• Members in wrong VRF: reconfigure members to match the bridge’s VRF.
• Missing route: reconfigure routing.

Production discipline

Cross-course references

The Linux course’s XXII-Linux-NetTroubleshoot covers the underlying network troubleshooting. The OPNsense course’s XIV-OPNsense-VLAN covers the equivalent L2/L3 concepts. The Observability course’s LX-Observability-NetworkObs covers how to alert on VRF changes.

Quiz