What is a Bridge Domain?

A bridge domain is a set of logical interfaces on a virtual switch that share the same Layer 2 broadcast domain. Each bridge domain is tied to a unique VLAN ID and keeps its own MAC address forwarding table, forming a distinct learning and forwarding scope that traffic stays inside unless a routing interface bridges it elsewhere.

Key takeaways

• A bridge domain groups interfaces into one Layer 2 broadcast domain.
• Each bridge domain has a unique VLAN ID and its own MAC forwarding table.
• Interfaces join a bridge domain by matching its VLAN ID exactly.
• An IRB interface routes traffic into and out of a bridge domain.
• In VXLAN deployments, a bridge domain’s VLAN also maps to a VNI.

On this page: Why it matters · How it works · Types · Bridge Domain & Versa · FAQ

Why are bridge domains important?

Layer 2 switching only works within a well-defined broadcast boundary. Without one, a device’s MAC table would need to track every interface on the box, and BUM (broadcast, unknown-unicast, multicast) traffic would flood across unrelated ports. Bridge domains draw that boundary: each is its own learning and forwarding scope, letting an engineer run multiple, isolated Layer 2 segments on a single appliance.

That isolation lets one device do the work of many physical switches. IRB routes into and out of a bridge domain, EVPN advertises its MAC addresses to remote peers, and VXLAN extends its boundary to another site. Get the design wrong and segmentation, overlays, and spanning tree all break with it.

What is a bridge domain?

A bridge domain is a set of logical interfaces on a virtual switch instance (VSI) that belong to the same broadcast domain. It is defined by a unique VLAN ID and keeps its own MAC table, so learning and forwarding for one bridge domain never affects another on the same switch.

Interfaces join by matching the bridge domain’s VLAN ID: an access interface carries one explicit VLAN ID, while a trunk interface can carry many and so join several bridge domains at once. The switch learns each source MAC address into the domain it arrived on and forwards traffic only within that domain.

By default a bridge domain is a purely Layer 2 construct; an IRB interface routes traffic to and from it.

Types of bridge domains

Bridge domains take different forms depending on how far they reach beyond one device. A local (non-EVPN) bridge domain stays within one virtual switch on one appliance – pure Layer 2 switching among local interfaces.

A VLAN-based EVPN bridge domain maps a single VLAN to a single EVPN instance (EVI) and advertises its MAC/IP routes over BGP EVPN across an SD-WAN fabric.

A VLAN-aware bundle bridge domain maps multiple VLANs to one EVI while keeping a separate bridge table per VLAN, for VLANs that share a route target but need independent MAC learning.

Any of these can also be VXLAN-mapped: its VLAN ID is bound to a VXLAN network identifier so its boundary tunnels over UDP to remote VXLAN tunnel endpoints (VTEPs).

Bridge Domain & Versa

On a Versa Operating System (VOS) device, you enable Layer 2 forwarding by defining a virtual switch instance, then configuring bridge domains within it – each with a name, a unique VLAN ID, and an optional VXLAN VNI, per Configure Layer 2 Forwarding.

MAC settings – learning, aging, limit, move detection – can be set at the switch, domain, or interface level, with the most specific level winning. An IRB interface attaches to a bridge domain for Layer 3 routing, including DHCP and VRRP.

For overlays, Configure EVPN VXLAN for ZT-LAN binds a bridge domain’s VLAN to a VXLAN VNI over BGP EVPN, while Configure SD-LAN Using Workflow Templates does the same mapping via Director’s guided wizard.

Frequently asked questions

What is the difference between a bridge domain and a VLAN?

A VLAN ID is the tag; a bridge domain is the switch-level object it is bound to. The bridge domain owns the MAC forwarding table, the member interfaces, and the forwarding behavior – the VLAN ID is simply the identifier interfaces match to join it.

How many bridge domains can a virtual switch have?

A single VOS instance supports multiple virtual switches, and each can hold multiple bridge domains – every one with its own unique VLAN ID, MAC forwarding table, and a learning and forwarding scope independent of every other domain on that switch.

How does a bridge domain relate to an IRB interface?

An IRB interface associates a Layer 3 interface with a bridge domain so packets can be routed to and from it. The IRB interface is operationally up whenever at least one Layer 2 interface in the bridge domain is up.

Does a bridge domain require VXLAN?

No. A bridge domain is a purely Layer 2 construct on its own. VXLAN is optional: when configured, its VLAN is additionally mapped to a VXLAN network identifier so the domain can extend to remote VTEPs over a Layer 3 network.

What happens to traffic between two bridge domains?

Nothing crosses automatically. Bridge domains are isolated forwarding scopes by design – unicast, broadcast, and multicast traffic stays within the bridge domain it entered. Traffic only moves between bridge domains through a Layer 3 hop, typically an IRB interface routing between them.

More on Bridge Domains

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about bridge domains, these are worth looking at next.