Aironet APs: Bridge Groups and BVI

The command line configuration of Cisco Aironet access points can be confusing to someone who doesn't understand what's going on behind the scenes. "What's a bridge group? How is it different from a VLAN? Why do I have subinterfaces and a BVI?" In this article, we'll walk through a basic multiple SSID configuration on an Aironet one section at a time and shed some light on how bridge groups are used to tie everything together.

Our example will make use of two SSIDs:

• VLAN 10: Corporate
• VLAN 20: Guest

Configuration

Global Configuration

dot11 ssid Corporate
   vlan 10
!
dot11 ssid Guest
   vlan 20
!
bridge irb

Two relevant functions are performed in the snippet above. First, our two SSIDs (Corporate and Guest) are defined and associated with VLANs. Second, integrated routing and bridging (IRB) is enabled with the command bridge irb. This allows to define bridge groups and a BVI.

Radio Interface Configuration

Our access point has two physical radio (wireless) interfaces: Dot11Radio0 (2.4 GHz) and Dot11Radio1 (5 GHz). Since we want to enable both SSIDs on both radios, the interfaces are configured identically.

interface Dot11Radio0
 no ip address
 !
 ssid Corporate
 !
 ssid Guest
 !
 mbssid
!
interface Dot11Radio0.10
 encapsulation dot1Q 10
 bridge-group 1
!
interface Dot11Radio0.20
 encapsulation dot1Q 20
 bridge-group 2

interface Dot11Radio1
 no ip address
 !
 ssid Corporate
 !
 ssid Guest
 !
 mbssid
!
interface Dot11Radio1.10
 encapsulation dot1Q 10
 bridge-group 1
!
interface Dot11Radio1.20
 encapsulation dot1Q 20
 bridge-group 2

First, we assign both SSIDs to the physical radio interfaces. We also include the command mbssid to ensure that each SSID receives a unique BSSID (which is analogous to a MAC address).

Next, we create a subinterface for each SSID, .10 and .20. Each subinterface is mapped to both a VLAN and a bridge group. We'll talk more about bridge groups shortly.

Ethernet Interface Configuration

interface FastEthernet0
 no ip address
!
interface FastEthernet0.10
 encapsulation dot1Q 10
 bridge-group 1
!
interface FastEthernet0.20
 encapsulation dot1Q 20
 bridge-group 2

The configuration of our FastEthernet interface should look similar to that of our radio interfaces. Two subinterfaces are attached to the physical interface, with each tied to its respective VLAN and bridge group.

BVI Configuration

interface BVI1
 ip address 192.168.10.123 255.255.255.0
 no ip route-cache

Finally, we configure the bridge virtual interface (BVI) for management. A BVI interface is mapped to a bridge group by its numeric identifier (in this case, 1), similar to how a VLAN interface is mapped to a VLAN. It may help to refer to VLAN interfaces as switch virtual interfaces (SVIs); BVIs are the same concept but applied to bridge groups instead of VLANs.

BVI1 is the default BVI on Aironet access points and cannot be deleted:

ap(config)# no interface bvi1
%command not allowed, cannot remove BVI 1

While you can create BVIs for other bridge groups, only one of them can be assigned an IP address for management (similar to how a layer two-only Catalyst switch can only have one active VLAN interface). And since BVI1 is going to be there anyway, we might as well use it.

Note that the IP address assigned to BVI1 must be in the same subnet as any SSID assigned to the bridge group (in this case, the Corporate SSID).

Putting it all Together

Working from top to bottom, we can see that:

• SSIDs are mapped to VLANs.
• VLANs are mapped to radio subinterfaces.
• Radio subinterfaces are mapped to bridge groups.
• Ethernet subinterfaces are also mapped to bridge groups.
• BVI1 is assigned an IP address tied to bridge group 1.

This configuration keeps wireless traffic belonging to one SSID isolated from traffic belonging to the other as it transits the access point from the wired interface to the wireless interface and vice versa. Note that because there is no BVI2 interface, the access point has no IP address reachable directly from the Guest SSID.

What About Those Other Bridge Group Commands?

You may have noticed that, when assigning a radio interface to a bridge group with the bridge-group command, four or five additional commands also appear out of nowhere. For example, here's the full configuration of interface Dot11Radio0.10 from our lab as it appears in the running configuration:

interface Dot11Radio0.10
 encapsulation dot1Q 10
 no ip route-cache
 bridge-group 1
 bridge-group 1 subscriber-loop-control
 bridge-group 1 block-unknown-source
 no bridge-group 1 source-learning
 no bridge-group 1 unicast-flooding
 bridge-group 1 spanning-disabled

These are default commands which tweak the behavior of bridge groups on the access point, primarily by disabling spanning tree and compensating for its absence. Unless you have a specific reason to modify them, just let these commands be.