SonicOS 7 System

Download PDF
Technical Documentation > SonicOS 7 System > Interfaces > Interface Settings IPv4 > Layer 2 Bridged Mode > L2 Bridge Path Determination

L2 Bridge Path Determination

Packets received by the appliance on Bridge-Pair interfaces must be forwarded along to the appropriate and optimal path toward their destination, whether that path is the Bridge-Partner, some other physical or subinterface, or a VPN tunnel. Similarly, packets arriving from other paths (physical, virtual or VPN) bound for a host on a Bridge-Pair must be sent out over the correct Bridge-Pair interface.

The following summary describes, in order, the logic applied to path determinations for these cases:

  1. If present, the most specific non-default route to the destination is chosen. This would cover, for example:

    1. A packet arriving on X3 (non-L2 Bridge LAN) destined for host 15.1.1.100 subnet, where a route to the 15.1.1.0/24 subnet exists through 192.168.0.254 through the X0 (Secondary Bridge Interface, LAN) interface. The packet would be forwarded through X0 to the destination MAC address of 192.168.0.254, with the destination IP address 15.1.1.100.
    2. A packet arriving on X4 (Primary Bridge Interface, LAN) destined for host 10.0.1.100, where a route to the 10.0.1.0/24 exists through 192.168.10.50 through the X5 (DMZ) interface. The packet would be forwarded through X5 to the destination MAC address of 192.168.10.50, with the destination IP address 10.0.1.100.

  2. If no specific route to the destination exists, an ARP cache lookup is performed for the destination IP address. A match indicates the appropriate destination interface. This would cover, for example:

    1. A packet arriving on X3 (non-L2 Bridge LAN) destined for host 192.168.0.100 (residing on L2 Primary Bridge Interface X2). The packet would be forwarded through X2 to the known destination MAC and IP address of 192.168.0.100, as derived from the ARP cache.
    2. A packet arriving on X4 (Primary Bridge Interface, LAN) destined for host 10.0.1.10 (residing on X5 – DMZ). The packet would be forwarded through X5 to the known destination MAC and IP address of 10.0.1.10, as derived from the ARP cache.

  3. If no ARP entry is found:

    1. If the packet arrives on a Bridge-Pair interface, it is sent to the Bridge-Partner interface.
    2. If the packet arrives from some other path, the appliance sends an ARP request out both interfaces of the Bridge-Pair to determine on which segment the destination IP resides.

    In this last case, as the destination is unknown until after an ARP response is received, the destination zone also remains unknown until that time. This precludes the appliance from being able to apply the appropriate Access Rule until after path determination is completed. Upon completion, the correct Access Rule is applied to subsequent related traffic.

With regard to address translation (NAT) of traffic arriving on an L2 Bridge-Pair interface, if it is determined to be bound for:

  1. The Bridge-Partner interface, no IP translation (NAT) is performed.

  2. A different path, appropriate NAT policies applies; if the path is:

    1. Another connected (local) interface, there is likely no translation. That is, it is effectively routed as a result of hitting the last-resort Any > Original NAT Policy.
    2. Determined to be through the WAN, then the default Auto-added [interface] outbound NAT Policy for X1 WAN applies, and the packet’s source is translated for delivery to the Internet. This is common in the case of Mixed-Mode topologies as described in Internal Security.

Was This Article Helpful?

Help us to improve our support portal

Yes! Not Really

Techdocs Article Helpful form

  • Hidden
  • Hidden

Techdocs Article NOT Helpful form

  • Still can't find what you're looking for? Try our knowledge base or ask our community for more help.
  • Hidden
  • Hidden