Dynamic bridged subinterfaces

Dynamic bridged subinterfaces separate VLAN detection which is handled by the platform, from service creation which is handled by an event handler script.

The following figure illustrates an example in which the hypervisor is configured with 1..500 VLANs, but only VLAN 1 has transmitted traffic. Instead of requiring 1..500 static subinterfaces on router interface ethernet-1/1, SR Linux creates the subinterface and associated configuration only for VLAN 1, when VLAN 1 becomes active.

The following sequence describes the process.

1. First packet arrival: A data frame for VLAN 1 arrives on interface ethernet-1/1. The interface is configured for VLAN tagging and dynamic subinterfaces with a VLAN range that includes VLAN 1 (VLANs 1 through 1500 in the figure). Because no subinterface exists for VLAN 1, the platform punts a copy of the frame to the CPM for VLAN learning.

2. Active VLAN detection: The vlan_detection_mgr application processes the extracted traffic and, in EVPN multi-homing deployments, other triggers such as Ethernet Segment destination state. It adds VLAN 1 to the active-vlans leaf-list for ethernet-1/1. In the figure, active-vlans contains [1], while the other pre-provisioned VLANs on the host remain inactive.

3. Event handler execution: The management server publishes the change to ethernet-1/1’s dynamic-subinterfaces active-vlans path. An event handler subscribed to this path invokes a MicroPython script through event_mgr. The script returns configuration actions to create a bridged subinterface and bind it to a MAC-VRF. For example, ethernet-1/1.1 is created in network instance mac-vrf1, with type bridged and vlan encap single-tagged and vlan-id 1.. See the SR Linux Event Handler Guide for more information about event handler framework.

4. Steady-state forwarding: After the subinterface and MAC-VRF binding are programmed, subsequent frames for VLAN 1 are forwarded through the new subinterface in the dataplane, like traffic on any other bridged subinterface.

The lower portion of Dynamic bridged subinterfaces - example packet flow shows the interface detection configuration, including the VLAN range and retention timer, and the resulting configuration created by the event handler, including the bridged subinterface and its network instance interface binding. Detection parameters are configured under interface <name> dynamic-subinterfaces, while the script creates subinterfaces and MAC-VRF bindings as standard configuration objects.

The retention-timer parameter determines how long a VLAN remains in active-vlans after traffic stops. In the figure, the timer is set to 5 minutes for illustration; the default is 240 minutes. When a VLAN ages out, the script can remove its dynamic subinterface and, if no other interfaces use the VLAN, tear down the associated MAC-VRF.

The following table describes the components and roles.

The following example illustrates the resulting configuration for VLAN 1.

Bridged subinterface configuration

--{ + candidate shared default }--[  ]--
# info from state interface ethernet-1/1 dynamic-subinterfaces
    interface ethernet-1/1 {
        dynamic-subinterfaces {
            vlan-range 1..1500 {
            }
            retention-timer 5
            active-vlans [
                1
            ]
        }
    }

MAC-VRF and bridged subinterface binding

-{ + running }--[  ]--
# info with-context interface ethernet-1/1 subinterface 1
    interface ethernet-1/1 {
        subinterface 1 {
            type bridged
            vlan {
                encap {
                    single-tagged {
                        vlan-id 1
                    }
                }
            }
        }
    }
 
--{ + running }--[  ]--
# info with-context network-instance mac-vrf1 interface ethernet-1/1.1
    network-instance mac-vrf1 {
        interface ethernet-1/1.1 {
            interface-ref {
                interface ethernet-1/1
                subinterface 1
            }
        }
    }

The VLAN detection configuration is operator-configured. The bridged subinterface and MAC-VRF binding are standard configuration objects created by the event handler script.

Before enabling dynamic bridged subinterfaces, ensure that the following requirements are met.

• Configure vlan-tagging true on the parent Ethernet or LAG interface.
• Configure dynamic-subinterfaces only on Ethernet or LAG interfaces that do not use optional VLAN subinterfaces.
• Ensure that CPM filters allow the extracted trigger packets. CPM filtering uses separate MAC, IPv4, and IPv6 filter groups. Factory-default CPM filters allow common IPv4 and IPv6 traffic but may not allow all MAC-based triggers. For non-IP triggers, add an explicit rule to the MAC CPM filter group.

On 7250 IXR systems, the first dynamic-subinterfaces configuration on any interface requires an explicit system resource setting. Configure the platform resource-management dynamic-subinterfaces max-vlans command to 4095 to enable the full VLAN range, including untagged traffic. The only supported values are 0 (disabled) and 4095. Changing max-vlans sets the chassis-reboot-required true parameter value. Reboot the chassis before the new value takes effect.

The following example configures the maximum VLAN resource allocation on a 7250 IXR system.

--{ * candidate shared default }--[  ]--
# info with-context platform resource-management dynamic-subinterfaces
    platform {
        resource-management {
            dynamic-subinterfaces {
                max-vlans 4095
            }
        }
    }

Changing max-vlans sets chassis-reboot-required to true. Reboot the chassis for the new resource setting to take effect.

Enabling dynamic subinterfaces on 7250 IXR nodes reduces the hardware forwarding resources available for operator MAC-VRFs and routed subinterfaces. See Limitations and interactions.

Single-homed server ports

Perform the following to enable dynamic bridged subinterfaces on single-homed server ports.

• Configure dynamic-subinterfaces and vlan-range on the server-facing interface.
• Configure CPM filters to allow the required trigger packet types.
• Enable an event handler instance that runs dynamic-subinterfaces.py or a custom script.
• Optionally, enable automatic system configuration saving in the script if dynamically created configuration must persist across reboots.

EVPN multi-homing

For EVPN Ethernet Segment (ES) multi-homing, use dynamic-subinterfaces-multi-homing.py when MAC-VRFs, VLANs, and EVPN are pre-provisioned according to the script’s expected naming conventions, such as VLAN-<vlan-id>.

The vlan_detection_mgr can add VLAN IDs to active-vlans based on ES destination state in the fabric. This allows sibling leaf nodes to create matching subinterfaces even when the customer edge device hashes traffic to only one leaf.

For single-active multi-homing, retain an anchor static subinterface on a VLAN outside the dynamic vlan-range. This prevents standby signaling from being aged out.

See "EVPN multi-homing" chapter in the ​SR Linux VPN Services Guide for more information about EVPN multi-homing.

Typical trigger traffic includes:

• Address Resolution Protocol (ARP)
• IPv6 Neighbor Discovery
• Dynamic Host Configuration Protocol (DHCP)

The platform uses qualifying traffic to identify VLANs that are active within the configured range.

On 7220 IXR-Dx platforms, Spanning Tree Protocol (STP) and Layer 2 control protocol (L2CP) frames do not trigger VLAN detection. After a subinterface exists, STP and L2CP frames are handled normally on that subinterface.

Ensure that the required trigger traffic is permitted by the relevant CPM filters, especially when using MAC-based, non-IP triggers.

After configuring dynamic bridged subinterfaces, verify the following:

1. The parent interface has VLAN tagging enabled and the expected vlan-range configured.
2. The active-vlans state reflects VLANs that have generated qualifying trigger traffic or other supported detection events.
3. The event handler instance is enabled and subscribed to the correct state path.
4. The event handler script creates the expected bridged subinterfaces and MAC-VRF bindings.
5. The resulting configuration uses the expected VLAN IDs, subinterface indexes, network-instance names, and encapsulation settings.
6. Traffic is forwarded successfully after the subinterface and service configuration are programmed.
7. On 7250 IXR systems, verify resource availability and check chassis-reboot-required after changing max-vlans.

This separation between VLAN detection and service creation allows SR Linux to support large pre-provisioned VLAN ranges without requiring a static subinterface for every VLAN on every server-facing interface.