What is IRB?

Integrated Routing and Bridging (IRB) is an interface type that associates a Layer 3 interface with a Layer 2 bridge domain, letting one device both switch traffic inside the domain and route it in and out. Other vendors call the same concept a switched virtual interface (SVI); the interface acts as the domain’s gateway.

Key takeaways

• IRB binds a Layer 3 interface to a Layer 2 bridge domain as its gateway.
• Other vendors call the same construct a switched virtual interface (SVI).
• A switch bridges or routes a frame based on its destination MAC address.
• Distributed IRB routes at every edge node; centralized IRB routes at one.
• On VOS, IRB interfaces support DHCP, VRRP, and other Layer 3 settings.

On this page: Why it matters · How it works · Types · IRB & Versa · FAQ

Why is IRB important?

Without IRB, switching and routing are separate jobs on separate boxes: a Layer 2 switch forwards frames inside a VLAN, and a router – often reached over a trunk in a “router-on-a-stick” design – handles anything that needs to leave it. That extra hop adds latency and one more device to manage per VLAN.

IRB collapses both jobs into one interface on one device: an appliance can switch traffic within a bridge domain and route it to another domain, a WAN link, or the internet, without backhauling packets to a dedicated router. That matters most in modern fabrics: EVPN-VXLAN deployments use IRB so any edge device can locally route between VXLAN segments instead of hairpinning to a central gateway, keeping latency low at scale.

What is IRB?

An IRB interface associates a Layer 3, IP-addressed interface with a Layer 2 bridge domain. A virtual switch decides whether to route or bridge each incoming frame by matching its destination MAC address against the MAC addresses of its IRB interfaces: a match routes the frame as Layer 3 traffic through that IRB; no match bridges it by destination MAC alone. Other switches learn an IRB’s MAC address the normal way, via an ARP request for its IP address.

An IRB interface’s operational state follows its bridge domain: up whenever at least one Layer 2 interface in that domain is up, down only when all of them are. It still behaves like any Layer 3 interface otherwise, supporting an IP address, DHCP, VRRP, and static or dynamic routing.

Types of IRB deployment

How IRB routing is distributed across a fabric varies by design. Distributed (local) IRB puts an IRB interface on every edge device that needs one, so each node routes its own attached bridge domains – the model most EVPN-VXLAN fabrics use, since it avoids hairpinning traffic to a central gateway. Centralized IRB configures the IRB on a single node – often a provider-edge or hub device – and every other node only bridges, carrying routed traffic to that one node for a smaller configuration footprint.

EVPN refines the distributed model into two forwarding patterns, defined in RFC 9135: asymmetric IRB, where the ingress node performs both the route and bridge lookup, and symmetric IRB, where ingress and egress nodes each do half the work through a shared Layer 3 domain.

IRB & Versa

On a Versa Operating System (VOS) device, you add an IRB interface directly in the Interfaces table – numbered 1 through 255, with a subinterface configured like an Ethernet subinterface except that VLAN ID, inner VLAN ID, bridge mode, and standby cannot be set – per Configure Layer 2 Forwarding. Each bridge domain in a virtual switch names one IRB as its routing interface, and VOS supports both centralized and distributed IRB, with local and VRRP MAC addresses advertised over BGP EVPN.

For SD-LAN and Titan sites, Configure LAN Connections manages IRB through a LAN profile instead – an IRB unit numbered 0 through 127 with its own IP address and DHCP relay – and Configure Basic Features shows the same configuration inside Director’s guided workflow templates, where an IRB is added to a WAN or LAN virtual port.

Frequently asked questions

What is the difference between IRB and a switched virtual interface (SVI)?

They’re the same concept under different vendor names. Versa and Juniper-derived platforms call it IRB; Cisco calls the equivalent construct an SVI. Both associate a Layer 3, IP-addressed interface with a bridge domain or VLAN so the device can route traffic in and out of it.

How does a device decide whether to route or bridge an incoming frame?

It compares the frame’s destination MAC address against the MAC addresses of its configured IRB interfaces. A match routes the frame as Layer 3 traffic using that IRB as the ingress interface; no match bridges it by destination MAC address alone.

What is the difference between distributed IRB and centralized IRB?

Distributed IRB configures an IRB interface on every edge node, so each node routes its own attached bridge domains locally. Centralized IRB configures the IRB on one node only, and every other node bridges traffic there for routing – simpler but a bottleneck at scale.

When is an IRB interface operationally up?

An IRB interface is up as long as at least one Layer 2 interface in its bridge domain is up. It goes down only when every Layer 2 interface tied to that bridge domain is down, since the IRB then has nothing left to route or bridge.

Can I configure DHCP and VRRP on an IRB interface?

Yes. An IRB interface is still a Layer 3 interface, so it supports the same settings as any routed interface – a DHCP server or relay, VRRP for gateway redundancy, static or dynamic routing – in addition to its bridge-domain association.

More on IRB

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about IRB, these are worth looking at next.