Bridge groups in routed firewall mode

Bridge group traffic can be routed to other bridge groups or routed interfaces. You can choose to isolate bridge group traffic by not assigning a name to the BVI interface for the bridge group. If you name the BVI, then the BVI participates in routing like any other regular interface.

Bridge group usage and configuration

One use for a bridge group in routed mode is to use extra interfaces on the Firewall Threat Defense instead of an external switch. For example, the default configuration for some devices include an outside interface as a regular interface, and then all other interfaces assigned to the inside bridge group. Because the purpose of this bridge group is to replace an external switch, you need to configure an access policy so all bridge group interfaces can freely communicate.

Routed firewall network with an inside bridge group and an outside routed interface
Bridge groups in routed firewall mode illustrate the configuration of multiple interfaces grouped together to manage traffic efficiently. The diagram highlights the relationships and data flow between the interfaces and the firewall.