Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.1.x

PDF

Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.1.x

Ethernet bridging

Updated: April 10, 2026

Want to summarize with AI?

Log in

Explains Ethernet bridging across a mesh network, covering configuration tasks for bridging, multicast forwarding, and workgroup-bridge support to extend network connectivity.

An Ethernet bridge is a network device that

  • enables you to secure activation of Ethernet ports on MAPs

  • supports both tagged and untagged packets for flexible deployment, and

  • allows segmenting application traffic with VLAN tagging between wireless and wired LANs.

For security, the Ethernet port on all MAPs is disabled by default. They can be enabled only through Ethernet bridging configuration on both the root and respective MAP.

Secondary Ethernet interfaces support both tagged and untagged packets.

In a point-to-point bridging, a Cisco Aironet 1500 Series MAP can extend remote networks by using the backhaul radio to bridge multiple segments of a switched network. This is fundamentally a wireless mesh network with one MAP and no WLAN clients.

In point-to-multipoint networks, client access can still be provided with Ethernet bridging enabled, although if bridging between buildings, MAP coverage from a high rooftop might not be suitable for client access. To use an Ethernet-bridged application, enable the bridging feature on the RAP and on all the MAPs in that sector.

In a mesh environment, with VLAN support for Ethernet bridging, the secondary Ethernet interfaces on MAPs are assigned a VLAN individually from the controller. Wired and wireless backhaul links operate as trunks with all VLANs allowed. Non-Ethernet bridged traffic, as well as untagged Ethernet bridged traffic travels along the mesh using the native VLAN of the APs in the mesh. It is similar for all the traffic to and from the wireless clients that the APs are servicing. The VLAN-tagged packets are tunneled through AWPP over wireless backhaul links.

Note

Ensure Ethernet bridging is enabled for every parent mesh AP along the data path to the controller.

Ethernet bridging should be enabled for these scenarios:

  • Use mesh nodes as bridges.

  • Connect Ethernet devices, such as a video camera on a MAP using its Ethernet port.

VLAN tagging for MAP Ethernet clients

Primary interfaces refer to mesh AP backhauls, and secondary interfaces refer to other AP interfaces.

Ethernet VLAN tagging segments application traffic within a mesh and forwards it to a wired LAN (access mode) or another wireless mesh network (trunk mode).

Configure Ethernet bridging (GUI)

Enable Ethernet bridging on a mesh profile so that network traffic can be transparently passed between Ethernet segments.

Procedure

1.

Choose Configuration > Wireless > Mesh > Profiles.

2.

Click Add.

3.

In General tab, enter the Name of the mesh profile.

4.

In the Advanced tab, check the VLAN Transparent check box to enable VLAN transparency.

5.

In Advanced tab, check the Ethernet Bridging check box.

6.

Click Apply to Device.

Ethernet bridging is now enabled for the selected mesh profile.

Configure Ethernet bridging (CLI)

Configure Ethernet bridging on mesh access points (APs) to allow Ethernet devices to connect through AP ports.

The Ethernet ports on MAPs are disabled by default. To enable them, configure Ethernet bridging on the Root AP and the relevant MAPs.

You can enable Ethernet bridging to:

  • Use the mesh nodes as bridges.

  • Connect Ethernet devices, such as a video camera, on a MAP using the MAP's Ethernet port.

Before you begin

  • Ensure that you configure these commands under the mesh profile configuration for Ethernet bridging to be enabled:

    • ethernet-bridging: Enables the Ethernet Bridging feature on an AP.

    • no ethernet-vlan-transparent: Makes the wireless mesh bridge VLAN aware. VLAN filtering is allowed with this AP command: [no] mesh ethernet { 0 | 1 | 2 | 3 } mode trunk vlan allowed .

      Note

      If you want all VLANs bridged (the bridge acts like a piece of wire), enable VLAN transparency to allow all VLANs to pass. To avoid unnecessary traffic flooding the network, filter VLANs on the wired side when using VLAN transparent mode.

  • Configure the switch port that connects to the root AP as a trunk port so Ethernet bridging works.

  • For Bridge mode APs, use the ap name name-of-rap mesh vlan-trunking native vlan-id command to configure a trunk VLAN on the corresponding RAP. You must configure this command to enable the Ethernet Bridging feature on the AP.

  • For FlexConnect+Bridge APs, configure the native VLAN ID under the corresponding flex profile.

e
Note

To ensure that the MAPs apply the Ethernet VLAN configuration on the controller, configure the native VLAN on the RAP by running this command:

Device# ap name ap-name no mesh vlan-trunking
Device# ap name ap-name mesh vlan-trunking native 247
Alternatively, you can configure native VLAN on the RAP and then the MAP in this order: 
Device# ap name ap-name no mesh vlan-trunking
Device# ap name ap-name mesh vlan-trunking native vlan_id
Device# ap name ap-name mesh ethernet 1 mode trunk vlan native native
Device# ap name ap-name mesh ethernet 0 mode trunk vlan allowed allowed

To verify the status of RAP and MAP, run this command:

Device# show mesh forwarding all

Procedure

1.

Enable privileged EXEC mode.

Example:

Device> enable

Enter your password, if prompted.
2.

Configure the Ethernet port of the AP and set the mode.

Example:

Device# ap name ap-name mesh ethernet {0 | 1 | 2 | 3} mode access vlan-id
3.

Set the native VLAN for the trunk port.

Example:

Device# ap name ap-name mesh ethernet {0 | 1 | 2 | 3} mode trunk vlan native 21
4.

Configure the allowed VLANs for the trunk port.

Example:

Device# ap name ap1 mesh ethernet  { 0 | 1 | 2 | 3 } mode trunk vlan allowed vlan-id

This command permits VLAN filtering on an Ethernet port of any Mesh or Root Access Point. It is active only when VLAN transparency is disabled in the mesh profile.

Ethernet bridging is enabled on the AP, allowing devices to communicate through configured VLANs.

Device> enable
Device# ap name ap1 mesh ethernet 1 mode access 21
Device# ap name ap1 mesh ethernet 1 mode trunk vlan native 21
Device# ap name ap1 mesh ethernet 1 mode trunk vlan allowed 21

Multicast over mesh Ethernet bridging network

A mesh multicast mode is a traffic management setting for bridging-enabled APs that

  • determine how multicast and broadcast packets are forwarded across the mesh Ethernet network

  • manage only non-CAPWAP multicast traffic, and

  • help optimize bandwidth by reducing unnecessary multicast transmissions.

Mesh multicast modes

Mesh multicast modes determine how bridging-enabled APs such as MAP and RAP send multicast packets among Ethernet LANs within a mesh network. Mesh multicast modes manage only non-CAPWAP multicast traffic. CAPWAP multicast traffic is governed by a different mechanism.

Three different mesh multicast modes are available to manage multicast and broadcast packets on all MAPs. Enabling these modes ensures that unnecessary multicast transmissions within the mesh network are reduced and backhaul bandwidth is conserved.

The three mesh multicast modes are:

  • Regular mode: In regular mode, bridging-enabled RAP and MAP multicast data across the entire mesh network and all its segments.

  • In-only mode: When a MAP receives multicast packets from the Ethernet, it forwards them to the corresponding RAP’s Ethernet network. No additional forwarding occurs. This setting ensures that the RAP does not send non-CAPWAP multicasts back to the MAP Ethernet networks within the mesh network (their point of origin). The system filters out MAP to MAP multicasts so these do not occur.

  • In-out mode: The RAP and MAP multicast in different ways.

    • If a MAP receives multicast packets over Ethernet, it sends them to the RAP. The MAP does not send these packets to other MAPs over Ethernet; the system filters MAP-to-MAP packets from the multicast stream.

    • If a RAP receives multicast packets over Ethernet, it sends them to all the MAPs and their respective Ethernet networks. When in-out mode operates, partition your network to ensure a multicast sent by one RAP is not received by another RAP on the same Ethernet segment and then sent back into the network.

Configure multicast modes over mesh

Enable multicast forwarding behavior so that your wireless mesh network operates efficiently.

  • If multicast packets are received at a MAP over Ethernet, the MAP sends them to the RAP. The MAP does not send them to other MAPs; it filters out MAP-to-MAP packets from the multicast.

  • If multicast packets are received at a RAP over Ethernet, they are sent to all the MAPs and their respective Ethernet networks.

  • The in-out mode is the default mode. To prevent a multicast sent by one RAP from being received by another RAP on the same Ethernet segment and then sent back into the network, properly partition your network when the in-out mode is in operation.

Procedure

1.

Enter global configuration mode.

Example:

Device# configure terminal
2.

Configure a mesh profile and enter mesh profile configuration mode.

Example:

Device(config)# wireless profile mesh profile-name
3.

Configure mesh multicast mode.

Example:

Device(config-wireless-mesh-profile)# multicast {in-only | in-out | regular}

You have set the mesh profile to the multicast mode you want. This setting controls how multicast packets are routed in the network. 

Device# configure terminal
Device(config)# wireless profile mesh mesh-multicast
Device(config-wireless-mesh-profile)# multicast regular

Workgroup bridge

A workgroup bridge (WGB) is a wireless networking device that

  • connects wired networks over a single wireless segment

  • informs the corresponding mesh access point (MAP) of all wired clients on its segment through IAPP messages, and

  • uses an additional MAC address header to route packets to and from wired clients.

Data packets for WGB clients contain an extra MAC address in the 802.11 header (four MACs, instead of the usual three), with the extra address being that of the WGB itself. The extra MAC in the header is the address of the workgroup bridge itself. This extra MAC address is used to route a packet to and from the corresponding clients.

You can configure APs as workgroup bridges. You need only one radio interface for controller connectivity. Use the Ethernet interface for wired client connectivity and another radio interface for wireless clients.

In Cisco Catalyst 9800 Series Wireless Controllers, WGB acts as a client association that allows wired clients behind the WGB to pass data over the mesh network. Wired clients with different VLANs behind a WGB are also supported.