I have changed the config of my CCR1009-1G-1S-1S+ to include a bridge in front of every network.
There are 6 internal networks and 2 ISP connections, before I had all that configured directly on ethernet interfaces but I have decided that it is better to use bridges because:
it is possible to migrate networks to a different port or to a VLAN easily
it is easier to move the entire config to a new router that has different port layout, e.g. when this one breaks and I cannot get an identical new router (this model is no longer made)
I wanted to add some fiters for ARP on 2 of the 6 networks
Now of course the bridge table has lots of hosts (MAC addresses) which is completely unnecessary, each bridge has only 1 external port and the internal router interface.
I have read about “fast forward” on bridges which works without MAC table, exactly what I could use, but it is not enabled due to the filters.
Apparently having any filter (although it specifies in-bridge for every rule) disables fast forward for all bridges in the router, also those which have no filter.
Is there still a way to operate a bridge without MAC table in that case?
When I set learn=no on the ports, will that mean that there is no MAC table but the port still works in this scenario?
Normal decision for a data frame to unknown mac is to broadcast on all ports (=> making it a hub). I vaguely remember something about excluding source port but don’t hold me to that.
Since you only have two ports…might be just enough.
But no experience with it.
Yeah, that was my reasoning as well.
But the “learn” parameter in the documentation has no explanation at all about what would happen when it is set to “no”.
I guess I just have to try it after-hours (or on another router) to see what the behavior is.
Well, it works OK as it is, there is no performance issue, but it is something that could be optimized.
After some testing and carefully enabling it on a little-used network, it looks like it works OK.
When setting learn=no on the single port, the only hosts in the table are the local MAC of the bridges.
And communication still works, so I presume it is being “flooded” to the single port, which is fine.
However, I could not find that in the documentation.
I agree that documentation is not exhaustive.
And thx for the update. I’m guessing all these bridges would be “in software” but on CCR that’s anyways the case?
Yes of course it is all software but the CCR is so powerful that it hardly gets 2-3% of CPU in our network.
(we have two internet links, one with 200 and one with 250 Mbps and it is running a couple of VPNs and some NAT networks, no internet BGP or similar heavy things)