I have a basic understanding of VRFs, VLANs and subnets. I understand that VLANs operate on L2, and subnets and VRFs (lite) on L3. What I don't understand, is why you would choose one over the other when you mostly care about segmentation.
Imagine I have only 2 devices, and I don't want them to be able to talk to each other, but I do want them to be able to access the internet.
Imagine I have only one switch and one router in my network. I could do as follows:
- device 1 => VLAN 1
- device 2 => VLAN 2
- Internet => VLAN 3
Then, to prevent them from talking, I could allow traffic between vlan 1 and vlan 3, as well as traffic between vlan 2 and vlan 3. I would, however, drop all traffic flowing between vlan 1 and vlan 2. => Segmentation OK.
Imagine I have two switches and one router in my network. I could do as follows:
- subnet 1 => switch 1 => device 1
- subnet 2 => switch 2 => device 2
Then, like I did with the VLANs, I could drop all packets flowing between subnet 1 and subnet 2. => Segmentation OK.
Imagine I have multiple switches and one router. I could do as follows:
- VRF 1 => Device 1
- VRF 2 => Device 2
I do not explicitly have to prevent anything. By default, the two VRF's won't be able to talk to each other. => Segmentation OK.
Is there any other advantage to any of the three? What is the preferred method? Why would I combine the three? What else did I miss?
edit I'm really looking for an answer which compares the three options, especially VLAN (which might be using separate subnets) vs VRF segmentation.