[USG Flex 500H] - Group Port P1-P2 with P3 --> P12

Maverick87

Hi @Zyxel_Judy,
I've asked to my friend that have the same USG Flex 500H to do a try with bridge the two interfaces and seems to work.

The step for reproduce is:

• Create an internal ethernet interface (BR_P2) with only P2 as member, without IP (Unassigned)
• Create an internal ethernet interface (BR_P3_P12) with P3 → P12 as members, without IP (Unassigned)
• Create an internal bridge interface with BR_P2 and BR_P3_P12 as members, with fixed IP address and DHCP pool configured.

In this situation, can be possible to configure a bridge.

Two question:

• So… seems to be possible create a bridge between an individual port and the rest of "standard" ports; can you confirm this?
• When you create the single interface you need to specify the zone, and also, you need to specify the zone into the bridge (and seems that is possible to specify the zone when you select the members); in this case what are the real zone that I need to use (the zone of every single interface, the zone declared into the members of the bridge, or the zone of the bridge)?

Then… if is possible to create a bridge in this way, return also my questions:

• What are the performances/advantages to use the first approach (single interface with different subnet) instead the second (create the bridge with single subnet)?
• What are the pros and cons between those two approach?
• There are real differences between those two approach?

Thank you

Zyxel_Judy

Hi @Maverick87 ,

We confirm that you also can use Bridge method (P2 → lan1, P6-12 → ge3, then bridge the two interfaces into the same subnet). In your case, the zone of Interface, Bridge member and Bridge are LAN.

Option 1: Bridge (P2 → lan1, P6-12 → ge3, then bridge the two interfaces into the same subnet)

Pros

• No routing overhead, lowest latency when your end devices communicate with each other.
• Devices can communicate directly using L2 protocols (if you need broadcast-based discovery, WOL, etc., no extra helper config needed)

Cons

• All ports share the same broadcast domain: ARP/broadcast floods or a broadcast storm affect all these ports.
• If you later want to split/add segmentation, you'd have to redo everything

Option 2: P2 as one subnet, P6-12 as another, with inter routing

Pros

• Two separate broadcast domains — faults/storms don't spill over into each other
• You can apply firewall policies if needed (control who can talk to whom, which protocols are allowed)
• More flexibility for future expansion

Cons

• If you have protocols that rely on broadcast across subnets, you'll need extra config (e.g., DHCP relay, WOL broadcast relay)

Maverick87

Hi @Zyxel_Judy,
Thank you :) and for the part regarding latency/transmission/bandwidth/port speed/resource sharing?

If I understand correctly, a bridge involves sharing a high-speed port with a dedicated chip with something that is instead low-speed.
Reading a bit online, but I may be wrong, it seems there is a dedicated SoC/ASIC (Application-Specific Integrated Circuit) for the two ports P1-P2 to ensure robustness, high reliability, and high performance compared to the other ports (P1-P2 use an ASIC, P3-P12 use another ASIC, so at hardware level, the management chip is different and not shared).
In the case of a bridge or transmission between two different subnets, would I lose latency or transmission speed? Given that the other ports P5-P12 are 1G, while P2 is 2.5G, can the 500H hardware handle this combination of different chips while maintaining high performance?

Thank you

Zyxel_Judy

Hi @Maverick87 ,

When P2 (2.5G) is bridged together with P6–P12 (1G) into one Layer 2 bridge interface, traffic crossing between these two ports will increase latency because it requires CPU resources for processing. Theoretically, latency is lowest when traffic stays within the same chipset group.

Under high-traffic transmission scenarios, this type of bridge configuration will significantly reduce throughput. When you have data traffic greater than 1G flowing into ports p6–12, physical limitations will constrain throughput and consume CPU resources, potentially slowing down the firewall's overall performance. If you expect heavy same-subnet traffic exceeding 1 Gbps between the 2.5G and 1G ports, or have strict latency and performance requirements, then direct software bridging is not the best solution.
We recommend that you use an external 2.5G switch to handle all internal Layer 2 switching traffic. This not only reduces the firewall's CPU load but also ensures that the firewall maintains its intended security and routing performance.

Maverick87

Hi @Zyxel_Judy,

Another question about this topic:
Could you confirm whether NAT/routed traffic between PPPoE over VLAN on P1 and a LAN bridge containing P2 and ge3 remains eligible for hardware/fast-path acceleration? Is the CPU penalty limited to Layer 2 member-to-member traffic, or does it also affect WAN-to-bridge traffic? If possible, please provide measured throughput and CPU utilization for P1↔P2 and P1↔ge3 with and without the LAN bridge.

Thank you

Zyxel_Judy

Hi @Maverick87 ,

As mentioned above, traffic crossing the bridge interface's member ports requires CPU processing, so it doesn't qualify for high-throughput forwarding. Since this adds CPU load, the resulting performance impact affects all services handled by the device — not just Layer 2 traffic between bridge members, but also WAN-to-bridge traffic.
Compared to Routing mode, Bridge mode experiences a performance degradation of approximately 30% to 40% in UDP throughput.