If you’re doing it optimally (single bridge with vlan-filtering=yes), then whatever you’d do differently you’d loose performance.
However, when running OSPF (which we are) a bridge dedicated to OSPF with an address equal to the ID of the node e.g. 10.255.255.16 is also recommended: https://wiki.mikrotik.com/wiki/Manual:OSPF-examples
Additionally, on some sites we have two ISPs, and since we are not using BGP, end up with one bridge for each ISP since there is a DMZ associated with each provider. I can supply a diagram if need be, but the idea is that the “external” bridge(s) get the ISP assigned router address and VLANs and ports for the external address space (externally routable addresses) so that they are kept separate from our internal 172.16.0.0/16 network (which has its own bridge)
Is this an optimal solution or should I flatten to one bridge, assign both the internal address and OSPF address to the bridge and assign the external addresses to VLANs that are associated with the ISPs?
Hope this makes sense without dumping a LOT of configuration.
You did not mention device model you have in mind.
Anyway:
CRS3xx are switches. These work best if using single bridge because only one bridge per device can be HW offloaded. The same is true for all other MT devices with switch chips built in, even though some devices have relatively fast CPUs there are bottlenecks (e.g. due to relatively slow interconnect between CPU and switch chip).
But you’re talking about OSPF which is routing protocol. So if you think of a proper router (e.g. CCR device), then the “use single bridge per device” does not apply as all (but some older CCRs and low end RBs) routers come without switch chip and all traffic is handled by CPU this way or another. In this case number of bridges doesn’t matter (much).
So when thinking about single vs. multiple bridges, one has to know HW limitations of the device. MT published block diagram for most devices (in the official product page) for users to consult and make educated decisions.
I think it’s one bridge per switch chip, not per device (unless you meant switch chip by ‘device’). My RB3011 has a bridge on the first switch chip and another bridge on the second, and ports in both bridges show hardware offloading.
You’re right. I just didn’t want to go too much in details as only a few models feature two switch chips (RB2011, RB3011 and RB4011) and with those one has to be extremely careful to create bridges not spanning ports from different switch chips (which makes knowing block diagram of device even more important).
The additional bridge used to hold an IP address for OSPF doesn’t actually do any bridging - it is just the only way to create a virtual interface, which remains up no matter what, on Mikrotik. So its presence doesn’t affect performance.
This confirms that I can continue with two bridges (LAN and OSPF) on non-complex configurations (one ISP), and that one bridge per ISP should not add any significant overhead since this is all routing through the CPU regardless. Very informative!