Skip to main content
Explained how hosts on the two subnets could talk without L3 intervention
Source Link
Dave Noonan
  • 950
  • 7
  • 16

There's really no reason not to put multiple subnets on the same VLAN, but there's also probably no reason to do it.

Pro:

  • Allows the subnets to talk directly without a router or firewall
  • Save's VLANs

Con:

  • Allows the subnets to talk directly without a router or firewall
  • It's messy from a documentation and troubleshooting perspective
  • More broadcast traffic

We generally don't do it because of the messiness and lack of security. One VLAN = one subnet is easier to document and easier to troubleshoot and there's usually not a good reason to complicate things.

The only reason I can think of to do it is company mergers or network upgrades and for both of those I'd prefer it to be temporary.

Edit to clarify, for the hosts on different subnets but the same VLAN to talk directly you'd need to either make them their own default gateway or add a route to the "other" subnet that connects it to the interface.

In the gateway case if the host IP was 10.1.1.2 then the gateway would also be 10.1.1.2. This will cause the host to ARP for everything on or off it's subnet. This would allow it to talk to the second subnet on that VLAN but the only way it'll be able to talk to anything else is if there's a router/firewall running proxy arp that can help it out.

In the route out the interface case you'd add something like "route add -net 192.56.76.0 netmask 255.255.255.0 eth0" to the device and then 10.1.1.2 will ARP directly on eth0 when it wants to reach 192.56.76.*.

There's really no reason not to put multiple subnets on the same VLAN, but there's also probably no reason to do it.

Pro:

  • Allows the subnets to talk directly without a router or firewall
  • Save's VLANs

Con:

  • Allows the subnets to talk directly without a router or firewall
  • It's messy from a documentation and troubleshooting perspective
  • More broadcast traffic

We generally don't do it because of the messiness and lack of security. One VLAN = one subnet is easier to document and easier to troubleshoot and there's usually not a good reason to complicate things.

The only reason I can think of to do it is company mergers or network upgrades and for both of those I'd prefer it to be temporary.

There's really no reason not to put multiple subnets on the same VLAN, but there's also probably no reason to do it.

Pro:

  • Allows the subnets to talk directly without a router or firewall
  • Save's VLANs

Con:

  • Allows the subnets to talk directly without a router or firewall
  • It's messy from a documentation and troubleshooting perspective
  • More broadcast traffic

We generally don't do it because of the messiness and lack of security. One VLAN = one subnet is easier to document and easier to troubleshoot and there's usually not a good reason to complicate things.

The only reason I can think of to do it is company mergers or network upgrades and for both of those I'd prefer it to be temporary.

Edit to clarify, for the hosts on different subnets but the same VLAN to talk directly you'd need to either make them their own default gateway or add a route to the "other" subnet that connects it to the interface.

In the gateway case if the host IP was 10.1.1.2 then the gateway would also be 10.1.1.2. This will cause the host to ARP for everything on or off it's subnet. This would allow it to talk to the second subnet on that VLAN but the only way it'll be able to talk to anything else is if there's a router/firewall running proxy arp that can help it out.

In the route out the interface case you'd add something like "route add -net 192.56.76.0 netmask 255.255.255.0 eth0" to the device and then 10.1.1.2 will ARP directly on eth0 when it wants to reach 192.56.76.*.

Source Link
Dave Noonan
  • 950
  • 7
  • 16

There's really no reason not to put multiple subnets on the same VLAN, but there's also probably no reason to do it.

Pro:

  • Allows the subnets to talk directly without a router or firewall
  • Save's VLANs

Con:

  • Allows the subnets to talk directly without a router or firewall
  • It's messy from a documentation and troubleshooting perspective
  • More broadcast traffic

We generally don't do it because of the messiness and lack of security. One VLAN = one subnet is easier to document and easier to troubleshoot and there's usually not a good reason to complicate things.

The only reason I can think of to do it is company mergers or network upgrades and for both of those I'd prefer it to be temporary.