5

I am trying to understand how packets are routed within the same VLAN. I understand that typically there should be a 1:1 mapping between VLANs and Subnets. However if i deploy the following configuration (shown in below figure), would the host 192.168.0.1 be able to access host 10.0.0.1 without a router in the middle?

The figure shows 4 hosts on two different networks 192.168.0.0/24 and 10.0.0.0/24, connected by a layer 2 switch. All ports on the switch are configured to vlan 10

enter image description here

Improve this question
2
  • 1
    The fact is that frames are delivered directly from host-to-host on the VLAN, with no regard for the layer-3 IP packet encapsulated in the frame. What you are referring to is not actually routing, but fooling the layer-2 frame encapsulation. Routing strips off the layer-2 encapsulation to route the layer-3 packet, but that does not happen on the VLAN because switches are transparent devices that do not change the frame or packet.
    – Ron Maupin ♦
    Dec 2, 2019 at 18:03
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Dec 16, 2020 at 23:53

6 Answers 6

Reset to default
6

Generally you need a router to route between the subnets. One common configuration is to have one router interface with two IP addresses on it in two different subnets (Cisco calls the second one a “secondary IP”).

Here are some cases where that is useful:

  1. You originally allocated a /24 to the subnet but now have more than 254 hosts during peak times. Rather than renumbering into a /23, you add a /25 secondary.
  2. You are in the middle of renumbering, and have both subnets available during the transition to minimize impact.
  3. You provide Internet routable subnet for workstations and RFC1918 address space for IP-phones, printers, SAN infrastructure, etc... (this can make your DHCP configuration complicated, but simplifies access port provisioning).

It might be possible to configure the end hosts to talk directly on both vlans, but that can be error prone. Simpler configs are more reliable (one IP per host, one subnet per vlan).

End hosts with multiple IP addresses suffer endless problems because every time they initiate a socket they have to pick a source IP address for that socket: but end hosts don’t have the routing information to make an intelligent decision about which source IP address is optimal.

Note that every dual protocol IPv4/IPv6 network in effect has two different subnets on one vlan. Those subnets cannot talk to each other at all because they are different IP protocols. Modern operating systems incorporate substantial intelligence to decide whether to contact a destination over IPv4 or IPv6 (keyword: “happy eyeballs”).

Improve this answer
2
  • 2
    secondary addresses are generally what creates this mess. A router is not required for the two networks to talk to each other. ('tho not all systems will allow the routes to make it work without a router -- some older Cisco switches that don't support "ip route".)
    – Ricky
    Dec 2, 2019 at 4:47
  • @RickyBeam if not route between the subsets how would they communicate? Secondary IP’s? A switch that does L3 is nothing but a router anyways
    – Matt Douhan
    Dec 3, 2019 at 23:55
5

They can if they know the other subnet is "on the wire" with them. This is where "interface" routes come in. (how to do this is OS specific...)

For example (linux box):

199.XXX.XXX.0/28 dev eth0  proto kernel scope link
10.0.0.0/24 via 199.XXX.XXX.2 dev eth0
192.168.1.0/24 dev eth0 scope link

The first is created by the kernel when an address is assigned to an interface. The second is a static route to the LAN behind a second router. And finally, the third is the secondary subnet on the same LAN.

This sort of overlay is frowned upon in modern networking. This specific network is ~30 years old, so it doesn't do "modern".

Improve this answer
0
1

No, you need to have a router. So another question may arise - What is the need for a VLAN in the first place? A VLAN also limits the flow of broadcast and unknown unicast traffic (which the switch should flood on all VLAN's interfaces) to reduce unnecessary updates to logically separated entities.

Improve this answer
1
  • On OSI Layer2 level - yes
  • On IP level - no (without additional configuration on local machines - static routes, but every computer operates as a router)
  • On multicast level - yes
  • On application level (in theory) - yes
Improve this answer
1

A switch sends a frame within a network only. First the pc within the 10.0.0.0/24 network is going to perform an ANDing operation checking if the network 192.168.0.0/24 belongs to the same subnet. As it determines that it does not belong to the same subnet the pc will search for a default gateway. If it cannot see a default gateway then it will generate the packet waiting for a response from a default gateway and as it cannot find a default gateway, the ping will fail.

Improve this answer
0

You don't necessarily need a router between subnets, but a layer 3 switch capable of routing. A layer 2 switch does not have the capability of layer 3 routing. In your situation, you could use a "Router on a Stick" configuration, but this is generally not best practice in a production network since all traffic between subnets has to pass through the router, creating a performance bottleneck and more overhead on the router. HP Procurve switches can easily accomplish this and are much more reasonable than many other options, and include a lifetime warranty. Netgear also has some reasonable options but beware of the Layer 2+ switches since they "fake" layer 3 routing and require disabling certain security features if you are utilizing a UTM appliance.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.