How to Bridge two VLANs on a Cisco 6509 and eliminate STP issues

I have a pair of application firewalls that are logically inline to two VLANs on a pair of Cisco 6509 switches. The application FW's are doing transparent bridging between the two VLANs, and I need to remove them from the equation to upgrade them (and then post upgrade completion place them back inline). The application firewalls are in active passive mode and each one is connected to a different 6509 also in an active/passive configuration. The app firewalls have three ports involved. A management port that you connect to the appliance through and two bridge ports where each bridge port is configured to a different VLAN placing the appliance logically inline. I proposed the following config to make the two VLANs bridge themselves while minimizing STP bridge loop issues:

interface Vlan50
bridge-group 1
!
interface Vlan821
bridge-group 1
!
bridge 1 protocol vlan-bridge
bridge 1 priority 8192

The last line is what is supposed to minimize possible STP bridge loops according to Cisco online documentation I found. The onsite CCIE says he's not sure this will work, hence my question. I'm asking you all to vette out this problem and either verify my code will work or propose code that will.

Please help.
LVL 4
Nathan HawkinsTechnical Lead - Network SecurityAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Nayyar HH (CCIE RS)Network ArchitectCommented:
I dont think you should have to bridge these vlans on the switch, the firewall should be bridging the traffic as it is in transparent mode.

What type of firewall is it?

Can you provide a logical diagram?
Nathan HawkinsTechnical Lead - Network SecurityAuthor Commented:
Please re-read everything I explained as your questions are already answered by the givens I have already laid out, but in the interests of resolution I will re-answer your questions

The very first sentence explained that this is an application FW (The manufacturer is irrelevant since the question I'm asking is how do you bridge two VLANs on a Cisco 6509 together)... Further...the application FW is bridging the two VLANs, but since as I explained the issue is that I have to upgrade the application FW it cannot bridge while its being upgraded because that would cause an outage...

I dont need to attach a logical diagram since I already explained that the application firewall bridges two VLANs:

(VLAN 50) <-> Bridged App FW <-> (VLAN 821)
Nayyar HH (CCIE RS)Network ArchitectCommented:
I'm afraid I cannot help you - I'm sure other Experts will be answering your question


Thank you

CCIE/RS/#3476_
Determine the Perfect Price for Your IT Services

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden with our free interactive tool and use it to determine the right price for your IT services. Download your free eBook now!

mat1458Commented:
Your configuration looks pretty reasonable to me. Have you set any root bridges other than the default in your VLAN? For testing purposes I'd use two unused VLAN to see if everthing works the way you like. You don't have to use a looped topology with these, then you can test the forwarding only.
Nathan HawkinsTechnical Lead - Network SecurityAuthor Commented:
Therein is one of my issues which is that I have no test environment. I was hoping either someone has already done this and had some "gotchas" or a "try this" to avoid...etc. Whats the commands again to determine whats the root bridge? I'm not at work to look into that yet, but I will when I get there. What are we trying to determine with what's the root bridge?
mat1458Commented:
To find the root bridge you can issue a show spanning-tree vlan nnnn. If the root bridge is somewhere around 32000 you probably have all left to default. If it is lower then somebody has set a root bridge on purpose. By identifying the root port you can find out the next upstream switch.

I'd test on the 6500 by just adding two vlan that are not yet in use. then i'd confiugure vlan interfaces and implement the bridging. Finally i'd connect two PCs each in one of the new vlan, assign them an IP address of the same subnet. I'd make sure that no firewall prevents a ping test and with that it should be possible to test the forwarding part with the bridge statements.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Nathan HawkinsTechnical Lead - Network SecurityAuthor Commented:
We didnt go forward with bridging the two VLANs together so I have accepted your answer as partial, but I'm fairly certain my code would have worked.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Routers

From novice to tech pro — start learning today.