2

I'm currently in the process of converting a ScreenOS configuration to a JunOS router and am a bit confused by the current configuration of two bridge groups on the old router. It's my understanding that bridge groups aim to bridge two or more interfaces as a physical bridge would. However, on the ScreenOS router, the two bridge groups only have one interface each.

Does having a bridge group with one interface serve any purpose, or can it be configured as a regular interface would? I've looked at the setup of both bgroups, and they are configured exactly the same way as the other interfaces on the router are. The only difference is that the interfaces sit under a bgroup, which to me appears to be redundant. If my understanding of this is skewed, please correct me - I'll admit that this is the first time I've had to work with bridge groups, and there seems to be little about them on the Internet for me to work with.

Improve this question
5
  • 3
    I can't tell you a reason, but make an educated guess. If you use a bridge group from the beginning, you can point all your configuration to that bridge interface. If then, later on, another interface should actually be bridged with the first one, the bridge group already exists. No further configuration change is necessary, as everything already points to the brdige group, and only the second interface needs to be added. As I said, just a guess, but that might make sense.
    – xpac
    Commented Feb 16, 2016 at 9:50
  • So if this wasn't the case, would it be safe to simply set the two bgroup interfaces up as if they were regular interfaces? The only reference to the bgroups I can find in the whole configuration file is to set their interface and ip, and a few other things, but nothing that distinguishes it from a regular interface.
    – Andre C
    Commented Feb 16, 2016 at 10:03
  • If I were you, I would check on the net and with Juniper documentation, if you can find anything on one-interface-bridges for JunOS... and if I couldn't find a good reason why it should be done this way, I would just use regular interfaces without bridging, and in case bridging is required later on, try to solve that using a switch inbetween.
    – xpac
    Commented Feb 16, 2016 at 11:29
  • 1
    There is one side-effect that I use on Fortinet firewalls with enough ports: I can assign any name to the port group (LACP interface). That helps identifying networks in the config a lot. The drawback which I see is that the switch interface which you connect the bgroup port(s) to need to have LACP enabled, or else the link won't come up. So you have an additional dependency external to the firewall's config which needs documentation.
    – user1016274
    Commented Feb 19, 2016 at 9:37
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Commented Aug 13, 2017 at 6:19

2 Answers 2

Reset to default
2

The bridge-group in ScreenOS is identical to a VLAN in Junos.

In ScreenOS you can either assign a security-zone/IP Addresses to a physical port, or alternatively, assign them to a bridge-group that contains multiple ports.

In Junos, you would assign security-zones/IP Addresses to a vlan.x interface which is bound to a VLAN via the l3-interface command, and then multiple ports can be members of that VLAN.

The reason for having a single-port bridge-group would be to allow simpler changes in the future - in ScreenOS, if you had a single L3 port in a zone, and wanted to change it to two, it would involve:

  • creating a bridge-group and assigning it to the zone
  • removing the security zone from the existing L3 interface (and IP)
  • putting both interfaces into the bridge-group
  • adding the IP to the bridge-group

This would be a disruptive change, whereas in Junos it could be handled in a single commit.

Improve this answer
1

xpac is the right assumption.

the bgroup on ScreenOS is primarly for grouping interfaces for easier configuration assignment. A brige-group is not to be confused with a networking bridge (similar to a switch). A bridge-group is poor terminalogy on Juniper's part for sure.

On JUNOS, you would actually find that a Security Zone takes the place of a bridge-group and then some. All of your policies, NATs, IPsec VPNS and more are based off of your Security Zones rather than the interfaces themselves. So Security Zones take the place of a bridge-group but also do a whole lot more.

Hope this helps.

Improve this answer
1
  • That's not entirely true - a bgroup does actually function as a VLAN in that all ports assigned to it can communicate regardless of the security zone. Security Zones and policy apply to L3 interfaces (transparent mode not withstanding)
    – Benjamin Dale
    Commented May 24, 2016 at 4:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.