[USG Flex 500H] - Group Port P1-P2 with P3 --> P12

Maverick87

Hi @Zyxel_Judy,
I've asked to my friend that have the same USG Flex 500H to do a try with bridge the two interfaces and seems to work.

The step for reproduce is:

• Create an internal ethernet interface (BR_P2) with only P2 as member, without IP (Unassigned)
• Create an internal ethernet interface (BR_P3_P12) with P3 → P12 as members, without IP (Unassigned)
• Create an internal bridge interface with BR_P2 and BR_P3_P12 as members, with fixed IP address and DHCP pool configured.

In this situation, can be possible to configure a bridge.

Two question:

• So… seems to be possible create a bridge between an individual port and the rest of "standard" ports; can you confirm this?
• When you create the single interface you need to specify the zone, and also, you need to specify the zone into the bridge (and seems that is possible to specify the zone when you select the members); in this case what are the real zone that I need to use (the zone of every single interface, the zone declared into the members of the bridge, or the zone of the bridge)?

Then… if is possible to create a bridge in this way, return also my questions:

• What are the performances/advantages to use the first approach (single interface with different subnet) instead the second (create the bridge with single subnet)?
• What are the pros and cons between those two approach?
• There are real differences between those two approach?

Thank you

Zyxel_Judy

Hi @Maverick87 ,

We confirm that you also can use Bridge method (P2 → lan1, P6-12 → ge3, then bridge the two interfaces into the same subnet). In your case, the zone of Interface, Bridge member and Bridge are LAN.

Option 1: Bridge (P2 → lan1, P6-12 → ge3, then bridge the two interfaces into the same subnet)

Pros

• No routing overhead, lowest latency when your end devices communicate with each other.
• Devices can communicate directly using L2 protocols (if you need broadcast-based discovery, WOL, etc., no extra helper config needed)

Cons

• All ports share the same broadcast domain: ARP/broadcast floods or a broadcast storm affect all these ports.
• If you later want to split/add segmentation, you'd have to redo everything

Option 2: P2 as one subnet, P6-12 as another, with inter routing

Pros

• Two separate broadcast domains — faults/storms don't spill over into each other
• You can apply firewall policies if needed (control who can talk to whom, which protocols are allowed)
• More flexibility for future expansion

Cons

• If you have protocols that rely on broadcast across subnets, you'll need extra config (e.g., DHCP relay, WOL broadcast relay)

Maverick87

Hi @Zyxel_Judy,
Thank you :) and for the part regarding latency/transmission/bandwidth/port speed/resource sharing?

If I understand correctly, a bridge involves sharing a high-speed port with a dedicated chip with something that is instead low-speed.
Reading a bit online, but I may be wrong, it seems there is a dedicated SoC/ASIC (Application-Specific Integrated Circuit) for the two ports P1-P2 to ensure robustness, high reliability, and high performance compared to the other ports (P1-P2 use an ASIC, P3-P12 use another ASIC, so at hardware level, the management chip is different and not shared).
In the case of a bridge or transmission between two different subnets, would I lose latency or transmission speed? Given that the other ports P5-P12 are 1G, while P2 is 2.5G, can the 500H hardware handle this combination of different chips while maintaining high performance?

Thank you

Zyxel_Judy

Hi @Maverick87 ,

When P2 (2.5G) is bridged together with P6–P12 (1G) into one Layer 2 bridge interface, traffic crossing between these two ports will increase latency because it requires CPU resources for processing. Theoretically, latency is lowest when traffic stays within the same chipset group.

Under high-traffic transmission scenarios, this type of bridge configuration will significantly reduce throughput. When you have data traffic greater than 1G flowing into ports p6–12, physical limitations will constrain throughput and consume CPU resources, potentially slowing down the firewall's overall performance. If you expect heavy same-subnet traffic exceeding 1 Gbps between the 2.5G and 1G ports, or have strict latency and performance requirements, then direct software bridging is not the best solution.
We recommend that you use an external 2.5G switch to handle all internal Layer 2 switching traffic. This not only reduces the firewall's CPU load but also ensures that the firewall maintains its intended security and routing performance.