What are the reasons for not putting multiple subnets on the same VLAN?

Question

I would like to know why we do not (and should not I guess) use 2 different networks on the same LAN/vLAN. From what I tried and understood :

• Host in network A (ex: 10.1.1.0/24) can talk to each other
• And host in network B (ex: 10.2.2.0/24) cant talk to each other
• Host and network A cannot talk to host in network B which is normal since inter-LAN communications need a L3 device with routing function.

The idea/principle of a LAN/vLAN is, in the course I've followed, described as a broadcast domain. But I am confused since I can configure 2 working networks within the same LAN.

I also tried the same configuration but with a second switch and a different vlan number (SW1 with vlan 10 and SW2 with vlan 20). All ports of each switch are in access mode with vlan 10 and 20 respectively. I had the same result.

Note : each side of the topology has a host from network A and B

Now, nobody does that and I supposed it is for some goods reasons, but I did not find what are those reasons and that is what I am asking you ?

I found this topic which seems similar, but the purpose is not the same.

Answer 1

There's really no reason not to put multiple subnets on the same VLAN, but there's also probably no reason to do it.

Pro:

• Allows the subnets to talk directly without a router or firewall
• Save's VLANs

Con:

• Allows the subnets to talk directly without a router or firewall
• It's messy from a documentation and troubleshooting perspective
• More broadcast traffic

We generally don't do it because of the messiness and lack of security. One VLAN = one subnet is easier to document and easier to troubleshoot and there's usually not a good reason to complicate things.

The only reason I can think of to do it is company mergers or network upgrades and for both of those I'd prefer it to be temporary.

Edit to clarify, for the hosts on different subnets but the same VLAN to talk directly you'd need to either make them their own default gateway or add a route to the "other" subnet that connects it to the interface.

In the gateway case if the host IP was 10.1.1.2 then the gateway would also be 10.1.1.2. This will cause the host to ARP for everything on or off it's subnet. This would allow it to talk to the second subnet on that VLAN but the only way it'll be able to talk to anything else is if there's a router/firewall running proxy arp that can help it out.

In the route out the interface case you'd add something like "route add -net 192.56.76.0 netmask 255.255.255.0 eth0" to the device and then 10.1.1.2 will ARP directly on eth0 when it wants to reach 192.56.76.*.

Answer 2

There are issues, when multiple IP subnets are used on a single layer-2 segment (i.e. VLAN).

Issues

Lack of support

Some devices, notably the Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) firewalls, do not support configuring multiple IP addresses on an interface. You wouldn't be able to use these devices as a router/default gateway for all subnets.

DHCP

Assigning IP addresses to hosts via DHCP becomes challenging as the DHCP server can only infer the layer-2 segment on which a client performed request:

• When the DHCP server is directly attached to the VLAN, it will determine the subnet/IP address pool from the interface on which the DHCP request was received.
• When a DHCP relay is used to forward DHCP requests to a central DHCP server, the DHCP relay (typically, but not necessarily, the router) will put its primary IP address on the layer-2 segment, where the DHCP request broadcast was received, in giaddr field of the DHCP packet (and usually but not necessarily also as IP source address) and forward it to the DHCP server. The DHCP server will then use the giaddr to pick the subnet/IP address pool.

If multiple subnets are used per layer-2 segment, the DHCP server must be explicitly told which subnets belong together. This feature is often called shared networks and not all DHCP servers support it. The Kea DHCP server documentation describes this feature quite well.

Cross-subnet communication

Direct communication between IP subnets without a router involved becomes possible when sharing a layer-2 segment. This may be a security risk.

IP broadcasts, irregardless of whether they are sent to 255.255.255.255 or a network broadcast address such as e.g. 192.0.2.255 for 192.0.2.0/24, will be mapped to layer-2 broadcast (with Ethernet a frame with destination MAC address ff:ff:ff:ff:ff:ff), that is flooded to every port attached to the layer-2 segment and will therefore need to be processed by every host irregardless of the subnet.

If a appropriate routes are configured on end hosts and end hosts implement the weak host model, end hosts will even be able to have IP unicast communication with each other, by requesting and answering cross-subnet ARP requests.

See arp_announce, arp_filter and arp_ignore sysctl settings of the Linux kernel or the Microsoft Windows weakhostsend and weakhostreceive interface settings.

Use cases

Due to the above issues, I would advise against using multiple subnets per layer-2 segments. Still there are a few use cases (aside from the deceptive simplicity of only configuring a single VLAN).

Renumbering

When migrating hosts from one subnet to another without disruption, it is necessary to temporarily configure multiple subnets.

Address exhaustion/Address space fragmentation

If all/most IP addresses of a given subnet are used and a simple broadening of the subnet mask is not possible, because the adjacent subnet is already used somewhere else and renumbering is not feasible in the short term, shared networks may serve as temporary kludge.

This is only a real use case for IPv4 networks, as in IPv6 networks, the size of a subnet is (almost) always /64, which is virtually impossible to exhaust.

Access networks

In access networks, such as DOCSIS cable networks, customers may use their own IP router, that is distinct from the provider's modem. The provider may want to manage the modem via IP though, through a different subnet from the customer subnet. Technically this could be accomplished via layer-2 segmentation (e.g. VLANs) on WAN side of the modem too, but I don't known if this supported or done in practice.

Answer 3

I just wanted to give a real world example of why you might want 2 subnets on one VLAN/LAN:

We have some offices that want non-NAT public addresses and some that want private IP addresses (10.x). By running 2 subnets on 1 VLAN, the users can plug a switch into the office's single ethernet port and have some devices privately IP'd and some publicly IP'd. This saves the admins time and wiring costs of having to run multiple connections to each office or switch links between VLANs anytime there is a change wanted by the end user.

Peter Green gave a good summary of some other pros and cons that I agree with.

Answer 4

Now, nobody does that

That statement is not true. Some admins do it, some don't. There are pros and cons to such a setup.

Pros:

• You can move stuff arround without reconfiguring the switchports.
• If you use ICMP redirects you can arrange for the bulk of data traffic to pass directly between hosts without hitting a router.
• One machine can have IPs on multiple subnets without requiring multiple NICs on the same machine or VLAN support on the end machine (afaict the latter is no problem on Linux but more of an issue on Windows).
• You save VLAN IDs.

Cons.

• More broadcast traffic.
• If there is a firewall in the L3 routing then people may think the hosts are isolated when they are not really.

Answer 5

We can add multiple subnets to a single vlan. There is a feasibility in the networking world.. but it adds more complexity to the network, making it more difficult to understand by new admins. But it is possible in real time.

We can add more than one subnet to a single Vlan in a scenario where the existing network gets exhausted if the subnet IP pool gets exhausted. Then we can take this concept of adding a new subnet to the same Vlan without adding additional Vlans

But it should be a static environment. In a DHCP running environment, adding multiple subnets to a single Vlan is not feasible

All the network and security devices won't support adding more than one subnet to an interface. As per my knowledge, cybersecurity products like FortiGate firewall support adding more than one subnet to a single interface