Does the USG FLEX H50 support a transparent Layer 2 bridge between a VLAN interface and an untagged

Fod

I am configuring a Nebula-managed USG FLEX H50 with the following topology:

• P3 / ge3 is the internal connection.
• Untagged traffic on P3 is handled by ge3 and works correctly.
• VLAN 11 is configured on P3 as a routed internal network with its own IP address and DHCP server. This also works correctly.
• VLAN 12 is configured on P3 with no IP address.
• P2 / ge2 is connected to an external telephony network that provides DHCP and uses untagged Ethernet traffic.
• ge2 has no IP address when used as a bridge member.
• I created a bridge with VLAN12 and ge2 as members, with Address Assignment set to Unassigned.

The expected behavior is:

P3 tagged VLAN 12 → VLAN12 interface → bridge → ge2/P2 untagged

and in the opposite direction:

P2 untagged → ge2 → bridge → P3 tagged VLAN 12.

However, a MikroTik DHCP client connected to P3 on VLAN 12 continuously sends DHCP Discover packets but never receives a DHCP Offer.

I verified the following:

1. The MikroTik DHCP client works when connected directly to the external telephony network and immediately receives an address in the 10.132.8.0/28 subnet.
2. ge2 also receives an IP address correctly when temporarily configured as an External interface with DHCP client enabled.
3. VLAN 11 on the same P3 connection works correctly.
4. MikroTik packet capture confirms that DHCP Discover packets are transmitted on VLAN 12.
5. The bridge was tested as General, Internal and External, but the result did not change.
6. VLAN12, ge2 and the bridge were configured without IP addresses.
7. The bridge members were configured with Zone set to None.

The bridge configuration is accepted by Nebula, but traffic does not appear to pass between VLAN12 and ge2.

Is this VLAN-to-Ethernet bridge scenario officially supported on the USG FLEX H50? Is a specific zone, security policy or additional setting required, or is this a known limitation or firmware issue when the device is managed through Nebula?

PeterUK

Not tested that but can you do firewall rules that are:

from zone VLAN12 to ge2/P2

from zone ge2/P2 to VLAN12

for testing

The likely reason might be DHCP offer gets blocked so you need:

from zone VLAN12 to ge2/P2 service DHCP-SERVER

from zone ge2/P2 to VLAN12 service DHCP-CLIENT

Zyxel_Judy

Hi @Fod ,

Based on your description, we tested this in our local lab and added ge2 to the WAN zone and VLAN12 to the LAN zone, and the end device was able to obtain an IP address. So we recommend adding the bridge member to the appropriate zone and checking again.
If the issue still occurs, please provide your Nebula organization and site name, and enable Zyxel support access so we can investigate further.