How do I prevent communication across subnets?

Question

What prevents two devices in separate subnets to talk to each other?

When a device d1 in subnet S1 wants to talk to device d2 in subnet S2, it sends an ARP request. Given that d1 and d2 are connected to the same switch, the switch will flood the broadcast ARP request all ports out. d2 can recieve the request and reply with its MAC address sent to the MAC address of d1 provided in the ARP request. Nothing prevents further communication of the devices.

Few questions:

• I am thinking that protocol is the only thing that dictates the usage of a gateway to communicate accross subnets?
• Would this be a reason to use VLANs to crop the broadcast domain?
• How do separate VLANs prevent d1 and d2 to communicate if the MAC addresses are previously known?

Thanks!

Answer 1

In your scenario (using TCP/IP), if d1 wants to talk to d2, it first determines that d2 is not in subnet s1. Normally, the device will forward the data to the default gateway. If, as in your case, there is no default gateway, d1 will not ARP, and instead return a 'network unreachable' error to the application.

Answers to your questions:

1. Yes, it's essentially the protocol that in fact defines subnetworks, and therefore the need for routing. there are other protocols, such as Netbios, that do not have the concept of networks and therefore are non-routable.

2. There are many reasons to use VLANs. In most cases, there is one VLAN per subnet, and vice versa.

3. Switches will not forward frames from one VLAN to another. so no traffic goes between them.