Bridging · Topic 3 of 4

L2TP and BCP Bridging

Bridge two LANs over an L2TP tunnel with the Bridge Control Protocol: set the bridge in the PPP profile on both ends, add MRRU, and compare BCP with EoIP.

4 min

In a nutshell

BCP carries Ethernet frames inside a PPP session.
The bridge setting in the PPP profile makes the PPP interface a bridge port.
Both ends must set bridge in their profiles.

What it is

BCP is a PPP extension that lets a PPP link carry Ethernet frames, so a tunnel can bridge two LANs without a second tunnel.

The Bridge Control Protocol is negotiated inside the PPP session. Once both ends agree, the PPP interface behaves like a bridge port.

With L2TP, this means one tunnel does the whole job. You do not need EoIP on top.

How it works

You create a bridge on each router, name it in the PPP profile, and let the tunnel interface join it.

Step 1: bridges

/interface bridge add name=bridge-lan
/interface bridge port add bridge=bridge-lan interface=ether2

Both routers need a bridge. The bridge on each side holds the local LAN port.

Step 2: profiles

The bridge setting in the PPP profile names the bridge that the dynamic PPP interface should join.

# Server side
/ppp profile add name=bcp-prof bridge=bridge-lan
/ppp secret add name=site2 password=Str0ng service=l2tp profile=bcp-prof

# Client side
/ppp profile add name=bcp-client bridge=bridge-lan
/interface l2tp-client add name=l2tp-out1 connect-to=203.0.113.1 user=site2 password=Str0ng profile=bcp-client mrru=1600 disabled=no

Both ends must set bridge in their profile. If only one end does, BCP is not negotiated, and no frames are bridged.

Related profile settings

Setting	What it does
`bridge`	Names the bridge the PPP interface joins.
`bridge-port-priority`	Port priority for spanning tree.
`bridge-path-cost`	Path cost for spanning tree.

These settings let the PPP interface take part in spanning tree like any other bridge port.

The role of MRRU

An Ethernet frame is larger than the usual PPP payload. The mrru setting enables the multilink feature that fragments and reassembles larger packets.

Set mrru on both the L2TP client and the L2TP server. A value around 1600 is common, because it leaves room for a full sized Ethernet frame. Without it, large frames cannot cross the tunnel.

/interface l2tp-server server set enabled=yes default-profile=bcp-prof mrru=1600

Addressing

The PPP interface does not need an IP address when it is a bridge port. Any address for management goes on the bridge. The two LANs share one subnet, so hosts at both sites use the same gateway and DHCP server.

Protection

BCP does not encrypt. Use use-ipsec=yes on the L2TP server and client to protect the frames, as in the L2TP page.

BCP compared with EoIP

Feature	BCP	EoIP
Extra tunnel needed	No, uses the PPP session	Yes, runs over a tunnel
Where it is set	PPP profile	Own interface
Works over	PPP based tunnels such as L2TP, PPTP, PPPoE	Any IP path
Needs MRRU	Yes, for large frames	No
Standard	PPP extension	MikroTik only

BCP is simpler because it reuses the session. EoIP is more flexible because it needs only IP connectivity.

Verification

/interface l2tp-client print
/interface bridge port print
/interface bridge host print

The PPP interface should appear as a dynamic port of the bridge. The bridge host table shows MAC addresses from the far site once traffic flows.

Loops

If there is a second path between the sites, enable spanning tree on the bridges. A bridge with two paths and no spanning tree loops.

What to remember for the exam

Seven facts cover most BCP questions.

BCP carries Ethernet frames inside a PPP session.
The bridge setting in the PPP profile makes the PPP interface a bridge port.
Both ends must set bridge in their profiles.
Both ends need a bridge.
mrru must be set on both ends so large frames fit.
BCP does not encrypt, so IPsec is added with use-ipsec.
The PPP interface needs no IP address when it is a bridge port.

Exam tip

When BCP bridging fails, check the profile on both ends first, because one side without a bridge setting breaks it.

Common mistakes

These four errors appear again and again.

Setting the bridge on one end only. BCP needs both ends to ask for it.

Forgetting MRRU. Small packets pass and large ones fail.

Putting an IP address on the bridge port. Put the address on the bridge, not on the PPP interface.

Missing the bridge on one router. The profile names a bridge that does not exist, so the interface cannot join.

Watch out

Two sites bridged over two paths without spanning tree create a loop that can disrupt both LANs.

Check yourself

Work through these three questions.

Which setting makes an L2TP interface join a bridge using BCP?
The bridge setting in the PPP profile, set on both ends of the tunnel.
Why is mrru needed when bridging over L2TP?
It lets the link fragment and reassemble packets so that full sized Ethernet frames fit. It must be set on both ends.
What is the main difference between BCP and EoIP bridging?
BCP reuses the PPP session and is set in the profile. EoIP is a separate tunnel interface that runs over any IP path.

Topic 3 of 4 in Bridging

Test yourself on Bridging

The full MikroTik MTCUME question bank has 482 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.