I'm currently in the process of converting a ScreenOS configuration to a JunOS router and am a bit confused by the current configuration of two bridge groups on the old router. It's my understanding that bridge groups aim to bridge two or more interfaces as a physical bridge would. However, on the ScreenOS router, the two bridge groups only have one interface each.

Does having a bridge group with one interface serve any purpose, or can it be configured as a regular interface would? I've looked at the setup of both bgroups, and they are configured exactly the same way as the other interfaces on the router are. The only difference is that the interfaces sit under a bgroup, which to me appears to be redundant. If my understanding of this is skewed, please correct me - I'll admit that this is the first time I've had to work with bridge groups, and there seems to be little about them on the Internet for me to work with.

  • 3
    I can't tell you a reason, but make an educated guess. If you use a bridge group from the beginning, you can point all your configuration to that bridge interface. If then, later on, another interface should actually be bridged with the first one, the bridge group already exists. No further configuration change is necessary, as everything already points to the brdige group, and only the second interface needs to be added. As I said, just a guess, but that might make sense.
    – xpac
    Feb 16 '16 at 9:50
  • So if this wasn't the case, would it be safe to simply set the two bgroup interfaces up as if they were regular interfaces? The only reference to the bgroups I can find in the whole configuration file is to set their interface and ip, and a few other things, but nothing that distinguishes it from a regular interface.
    – Andre C
    Feb 16 '16 at 10:03
  • If I were you, I would check on the net and with Juniper documentation, if you can find anything on one-interface-bridges for JunOS... and if I couldn't find a good reason why it should be done this way, I would just use regular interfaces without bridging, and in case bridging is required later on, try to solve that using a switch inbetween.
    – xpac
    Feb 16 '16 at 11:29
  • 1
    There is one side-effect that I use on Fortinet firewalls with enough ports: I can assign any name to the port group (LACP interface). That helps identifying networks in the config a lot. The drawback which I see is that the switch interface which you connect the bgroup port(s) to need to have LACP enabled, or else the link won't come up. So you have an additional dependency external to the firewall's config which needs documentation. Feb 19 '16 at 9:37
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 13 '17 at 6:19

The bridge-group in ScreenOS is identical to a VLAN in Junos.

In ScreenOS you can either assign a security-zone/IP Addresses to a physical port, or alternatively, assign them to a bridge-group that contains multiple ports.

In Junos, you would assign security-zones/IP Addresses to a vlan.x interface which is bound to a VLAN via the l3-interface command, and then multiple ports can be members of that VLAN.

The reason for having a single-port bridge-group would be to allow simpler changes in the future - in ScreenOS, if you had a single L3 port in a zone, and wanted to change it to two, it would involve:

  • creating a bridge-group and assigning it to the zone
  • removing the security zone from the existing L3 interface (and IP)
  • putting both interfaces into the bridge-group
  • adding the IP to the bridge-group

This would be a disruptive change, whereas in Junos it could be handled in a single commit.


xpac is the right assumption.

the bgroup on ScreenOS is primarly for grouping interfaces for easier configuration assignment. A brige-group is not to be confused with a networking bridge (similar to a switch). A bridge-group is poor terminalogy on Juniper's part for sure.

On JUNOS, you would actually find that a Security Zone takes the place of a bridge-group and then some. All of your policies, NATs, IPsec VPNS and more are based off of your Security Zones rather than the interfaces themselves. So Security Zones take the place of a bridge-group but also do a whole lot more.

Hope this helps.

  • That's not entirely true - a bgroup does actually function as a VLAN in that all ports assigned to it can communicate regardless of the security zone. Security Zones and policy apply to L3 interfaces (transparent mode not withstanding) May 24 '16 at 4:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.