VSX Bridge Mode in STP

[CyberBreaker]

Hi Guys, I would like to check with you if the CP in VSX bridge mode is also participating in STP negotiations when connected to switches? Thank you.

[Timothy_Hall]

Not directly, all BPDUs received on a bridged interface are automatically forwarded as-is to all other interfaces of the same bridge group.  This process is controlled by the Gaia OS via sysctl variable net.bridge.bpdu_forwarding which is set to 1 by default and should generally be left that way.  So the firewall's bridge mode interfaces are essentially transparent to the adjacent switches performing STP with each other, and no special policy rule is required.

However in a VSX cluster, when a failover occurs a flood of special packets is generated on the newly-active member to ensure the switch's forwarding table is updated properly.  For more info on this special flooding behavior see sk71520: Failover in a bridge-mode VS in ClusterXL Active/Standby bridge state setup causes outage i....