Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Does bridging VLANs or VLANs on a bridge make a difference?

I have an APX320 on Port1 of an XGS. The original setup was to first bridge Port1, PortF1, and Port4 onto a bridge, LAN_Bridge, and then have the AP send three of its SSIDs down VLANs and bridge the other SSID to its LAN (LAN_Bridge). So the VLANs (LAN_Bridge.10, LAN_Bridge.20, etc) were associated with the bridge LAN_Bridge. I'm calling this approach "VLANs on a bridge".

I was thinking that, logically, I might want to instead have the VLANs aligned with the idea that the APX is assigning each SSID to a VLAN (and I would throw the fourth VLAN, which is currently bridged, onto its own VLAN) so I should make the VLANs on Port1 not the bridge: Port1.10, Port1.20, etc, and then I would bridge, say, Port1.10 (a VLAN), PortF1, and Port4 onto LAN_Bridge. This seems logically simpler and potentially more secure and traceable. (Secure in that the AP's subnet would be isolated from the no-longer-bridged SSID that would shift to a VLAN.) I'm calling this approach "bridging VLANs".

But I'm having a complication with trying to turn on a hotspot on my Guest SSID (a separate issue) and it's got me rethinking the new approach.

QUESTION: Is there a preferred approach: Bridge first and have VLANs within the bridge, or VLAN first, then bridge individual VLANs (and ports)?

Two areas I'm thinking of: 1) a bridge between VLANs might force bridging to occur higher in the stack and hence be less efficient, and 2) in the Sophos context, could the more granular bridging cause issues with services (like hotspots needing the captive portal service)? Since this is an XGS, could fast-path be affected by the choice?



This thread was automatically locked due to age.
Parents
  • It does not make a difference. The VLAN is on top of the Bridge Interface object anyway (so to speak, when you create a bridge, the object gets a freetext name - And the VLAN will be placed here). 

    __________________________________________________________________________________________________________________

Reply
  • It does not make a difference. The VLAN is on top of the Bridge Interface object anyway (so to speak, when you create a bridge, the object gets a freetext name - And the VLAN will be placed here). 

    __________________________________________________________________________________________________________________

Children
  • Good to know that whether I see LAN_BRIDGE.30 or PORT1.30, it ends up being the same thing.

    I got almost all the way on my reorgainzation and the last step (deleting the current bridge) was prohibited by SFOS because it would break everything, evidently because the main LAN IP address is associated with the bridge and breaking the bridge would cause issues wherever that subnet is used throughout the system. So I now have both LAN_BRIDGE.30 and PORT1.20, and it does seem to work so I'm going to leave it mixed-mode since it's only a visual issue.