5

My first post in this forum! At my work place, we use VLANs to break out our network, and to keep network traffic segregated. I'm a little confused with our VLAN structure because I've had comments from contractors saying that we aren't using VLANs, and when I've asked other contractors on their thoughts, they have said its all fine and dandy! So my question to you guys, is this, considering the below example, are these VLANs?

192.168.1.0/24
192.168.2.0/24
192.168.3.0/24
192.168.89.0/24

The way I understand it, because the 3rd octet is different, these are VLANs, even though the subnet is the same at 255.255.255.0. Our switches are routing the traffic fine, and our router is routing traffic fine as well, which makes me believe we are right and these are indeed VLANs.

EDIT:

It looks like we have subnetted our network out rather than use VLANs.

To answer Ron's question, we have a Meraki firewall, which then feeds into a mixture of Dell and Cisco switches. On the Meraki firewall there is a page called 'Addressing and VLANs'. This is where we have our "VLANs" configured.

I know I used a class C network in my original post, but we use a class A network using a class B subnet. Our native VLAN is then 10.0.0.0/16.

On our Meraki firewall the VLANs are filled out as follows:

VLAN 2 - 10.2.0.0/16
VLAN 3 - 10.3.0.0/16
VLAN 4 - 10.4.0.0/16
VLAN 5 - 10.5.0.0/16

So what I understand from responses is that what I thought was VLANs are in fact subnets.

By default, the Meraki unit routes traffic between VLANs but rules have been created to stop this. Coming out of the Meraki unit, the port heading into our core switches (3 x stacked Dell PowerConnect switches) is set to a trunk port. The power connect then pipes the VLANs, via trunks, to other switches at our distribution layer, and then the distribution layer pipes the VLANs to the access layer, which then has ports in access mode. It might be worth noting at this point that we have a DHCP server on our main office LAN on our DC, and the other VLANs are served a DHCP address from the Meraki unit.

So devices which we have on VLAN 2, e.g. IP cameras, can't be accessed from VLAN 3. So I imagine we are using subnets in place of VLANs. How would a VLAN look in this example? Would I use the subnet of 10.0.0.0/16 and that breaks out to VLANs? Would these VLANs then use the same IP address range of 10.0.0.0? I apologise if this is frustrating to answer. I've watched a fair few YouTube videos, but I'm not blessed with the best of brains and I end up more confused!

Our VLANs on the Meraki unit look like this: Screen Shot from our Meraki config page

Improve this question
6
  • 1
    Hi Sark, welcome to NESE. Given what you provided, there is no way to determine whether you are indeed using VLANs or not. All you listed was four different IP Subnets. We would need to know (at least) how many Switches you are using to make an educated guess, and even then it won't be conclusive until we can see device configurations or a topology map.
    – Eddie
    Commented Mar 13, 2016 at 16:03
  • With the lack of information you have provided, all we can say for sure is that those are different networks. Whether or not those networks are applied to VLANs would merely be a guess without router and switch configurations. If you don't have that information (e.g., the network is under your direct control), we can't help you, and your question is off-topic here. If you do have this information, edit your question to include the device models, configurations, and how they are connected (a diagram would be very good).
    – Ron Maupin ♦
    Commented Mar 13, 2016 at 19:13
  • Thanks for correcting my spelling Ron but I'm English, we spell apologise with a S not a Z.
    – user23673
    Commented Mar 13, 2016 at 22:55
  • When I was fixing other stuff, my spell checker highlighted words, and I just right-clicked and told it to fix them. That wasn't the particular reason I edited. I was mostly trying to get proper paragraphing to make it easier to read.
    – Ron Maupin ♦
    Commented Mar 13, 2016 at 23:14
  • No problem. I suffer with Dyslexia so I'm afraid I'm not very good with writing things down.
    – user23673
    Commented Mar 13, 2016 at 23:20

6 Answers 6

Reset to default
4

You are right, but for the wrong reasons. I think you have some confusion about VLANs and subnets.

First, VLANs are layer 2 constructs and subnets are layer 3 constructs. That means they can be completely independent of each other. VLANS are configured on switches, which use MAC addresses for forwarding and do not understand IP addressing.

Subnets are configured on routers, which use IP addressing for forwarding and do not understand MAC addresses.

While it is very common to have one VLAN per subnet and vice versa, it is not necessary. You can have multiple subnets on a VLAN and have the same subnet on multiple VLANs. but I will admit, these are unusual cases.

Finally, the practice of using the third octet to determine the subnet/VLAN is also common, but again not necessary. As you learn IP addressing better, you will see why that is not always the case.

EDIT:

Based on your additional information, you are in fact using VLANs. As you show on the Meraki firewall, each VLAN has a subnet associated with it. This is the normal way to do things. So VLAN 2 has the subnet 10.2.0.0/16, and so on.

Bottom line: Your network seems to be configured consistent with good practice. Your confusion seems to be your misunderstanding of what the difference between subnets and VLANs are.

Improve this answer
2
  • Thanks for your input on this Ron. I agree, I think I'm getting confused between subnets and VLANs. Thanks!
    – user23673
    Commented Mar 13, 2016 at 23:07
  • As I added in my post, your network is divided up into VLANs -- as it should be.
    – Ron Trunk
    Commented Mar 14, 2016 at 1:00
1

The example you provided list 3 different IP (layer 3 endpoint addresses) subnets. VLAN technology usually refers to a 802.1Q protocol with inserts a special tag in a layer 2 frame header. So "subnet" and "VLAN" are usually independent terms. You may have a number of disparate subnets in a VLAN. You may have endpoints in the same subnet to be in different VLANs. This confusing situation is conventionally solved in a way that LANs are designed as every VLAN represents (combine, equal or whatever verd fits here) a separate subnet.

Improve this answer
1

You are confusing two different things. VLANs and subnets (networks) are not mutually exclusive, and are almost always used together, one-to-one.

Based on your edit, it seems that you are, indeed, using VLANs, and you have a different network assigned to each VLAN. Trunks carry VLANs.

As several others have explained here, VLANs are a layer-2 construct. The ethernet frames, which encapsulate your IP packets, have the option of having a VLAN tag in the frame header to separate which frames are in which VLAN on a trunk. The IP addresses are in the layer-3 packet header which is encapsulated in the layer-2 frame. The two concepts have nothing to do with each other, except that it is an almost universal practice to have each layer-3 network use a different layer-2 VLAN.

You should learn about the OSI model. Understand that it is just a model, and the real world doesn't always match, but it is useful to understand it since the first four layers match networking pretty well.

Also classful networking is dead, and it has been since 1995, killed by CIDR and VLSM. You can forget the Class A/B/C stuff in your network since you are using CIDR and VLSM.

Improve this answer
0

Though i am also new here, i recently got the chance to learn about VLANs. And by that i can say, when you have more than one subnet configured in a single switch then it should be VLAN. To confirm about it why don't you telnet or ssh and do the show vlan command to make sure about the naming and the vlan number.Hope this helps.

Improve this answer
3
  • Thanks for you message. When I remote to a switch and pass the command 'show vlan' it shows the above example as separate VLANs. When the switches were setup, individual VLANs were added to the switches and our firewall which acts as a UTM manages the VLANs and VLAN IDs. Traffic on say 192.168.1.0 Can't talk to traffic on 192.168.2.0. I think by the looks of things we are using different subnets as VLANs and our network devices are seeing them as VLANs as well.
    – user23673
    Commented Mar 13, 2016 at 14:46
  • @sark, this answer is not necessarily true. You can have a router with multiple switches connected, and each router port has a different network. In this situation, you likely have on the default VLAN (VLAN 1) on each switch, yet the network on each switch has a different network. You can also, have multiple networks on the same VLAN with the sort of results you see. You need to provide more information if you want to know the real answer. See Alexey's and Ron's answers below, then provide the details for determination if you want the answer.
    – Ron Maupin ♦
    Commented Mar 13, 2016 at 19:38
  • @Ron i have deleted my answer as he has edited the post again and i had not seen the edited portion. Hope that is alright. Thanks.
    – de.walkar
    Commented Mar 14, 2016 at 4:25
0

Technically, those are separate subnets.

A VLAN is configured on your network hardware like a cisco switch. VLANs almost always contain separate subnets. You can configure your L3 switch to route between them for instance.

What you describe are probably subents in different VLANs.

Improve this answer
2
  • Thanks for your answer Mike! So a VLAN could have multiple subnets? e.g. sticking with my previous example, those subnets can all be in the same VLAN?
    – user23673
    Commented Mar 13, 2016 at 14:25
  • @sark Yes, it is possible to have multiple subnets in one VLAN, it is not recommended though. A subnet is usually divided by a Layer 3 device (Router or Layer 3 switch). Read about this here. Your Network seems to be segmented in different VLANs with no interVLAN routing configured (as you wrote in an other comment).
    – mike.b93
    Commented Mar 13, 2016 at 20:35
0

The two concepts are similar in many ways however they differ in a few important details. Vlans will have an IP address associated with them and will also be part of a subnet/IP addressing scheme. IP Subnets communicate at layer 3 through IP datagrams or packets whereas Vlans communicate through trunk links and frames and make use of tagging.

It is not necessary for members of a VLAN to all share the same IP subnet address and in many cases multiple IP subnets will be part of one Vlan.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.