5

I would like to know why we do not (and should not I guess) use 2 different networks on the same LAN/vLAN. From what I tried and understood :

  • Host in network A (ex: 10.1.1.0/24) can talk to each other
  • And host in network B (ex: 10.2.2.0/24) cant talk to each other
  • Host and network A cannot talk to host in network B which is normal since inter-LAN communications need a L3 device with routing function.

The idea/principle of a LAN/vLAN is, in the course I've followed, described as a broadcast domain. But I am confused since I can configure 2 working networks within the same LAN.

I also tried the same configuration but with a second switch and a different vlan number (SW1 with vlan 10 and SW2 with vlan 20). All ports of each switch are in access mode with vlan 10 and 20 respectively. I had the same result.

Note : each side of the topology has a host from network A and B enter image description here

Now, nobody does that and I supposed it is for some goods reasons, but I did not find what are those reasons and that is what I am asking you ?

I found this topic which seems similar, but the purpose is not the same.

Improve this question
1
  • It would help if the question was stated more clearly. I would suggest doing that in the title (with a ?) and at the end of the description, again, with a question mark. I think what you're asking is: What are the reasons for not putting multiple subnets on the same VLAN?
    – Dave Noonan
    Jun 17, 2016 at 11:44

5 Answers 5

Reset to default
7

There's really no reason not to put multiple subnets on the same VLAN, but there's also probably no reason to do it.

Pro:

  • Allows the subnets to talk directly without a router or firewall
  • Save's VLANs

Con:

  • Allows the subnets to talk directly without a router or firewall
  • It's messy from a documentation and troubleshooting perspective
  • More broadcast traffic

We generally don't do it because of the messiness and lack of security. One VLAN = one subnet is easier to document and easier to troubleshoot and there's usually not a good reason to complicate things.

The only reason I can think of to do it is company mergers or network upgrades and for both of those I'd prefer it to be temporary.

Edit to clarify, for the hosts on different subnets but the same VLAN to talk directly you'd need to either make them their own default gateway or add a route to the "other" subnet that connects it to the interface.

In the gateway case if the host IP was 10.1.1.2 then the gateway would also be 10.1.1.2. This will cause the host to ARP for everything on or off it's subnet. This would allow it to talk to the second subnet on that VLAN but the only way it'll be able to talk to anything else is if there's a router/firewall running proxy arp that can help it out.

In the route out the interface case you'd add something like "route add -net 192.56.76.0 netmask 255.255.255.0 eth0" to the device and then 10.1.1.2 will ARP directly on eth0 when it wants to reach 192.56.76.*.

Improve this answer
2
  • 3
    Your first "pro" is incorrect. If a node wants to send a packet to another node that is not on its subnet, it will send the packet to its default gateway instead (if the node has a routing table of its own, it will look in that table first). If there is no router available to the node, then it won't be able to send the packet. What you could do is have a router on a stick wtihout the router being VLAN capable/supporting tagging or using multiple physical interfaces.
    – Todd Wilcox
    Jun 17, 2016 at 14:22
  • 2
    Nope, it's correct, I just didn't mention that you'll need a change on the hosts to either route that subnet out that interface or make the host it's own default gateway. In either case the two hosts will talk directly without going through an L3 device.
    – Dave Noonan
    Jun 18, 2016 at 15:26
2

There are issues, when multiple IP subnets are used on a single layer-2 segment (i.e. VLAN).

Issues

Lack of support

Some devices, notably the Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) firewalls, do not support configuring multiple IP addresses on an interface. You wouldn't be able to use these devices as a router/default gateway for all subnets.

DHCP

Assigning IP addresses to hosts via DHCP becomes challenging as the DHCP server can only infer the layer-2 segment on which a client performed request:

  • When the DHCP server is directly attached to the VLAN, it will determine the subnet/IP address pool from the interface on which the DHCP request was received.
  • When a DHCP relay is used to forward DHCP requests to a central DHCP server, the DHCP relay (typically, but not necessarily, the router) will put its primary IP address on the layer-2 segment, where the DHCP request broadcast was received, in giaddr field of the DHCP packet (and usually but not necessarily also as IP source address) and forward it to the DHCP server. The DHCP server will then use the giaddr to pick the subnet/IP address pool.

If multiple subnets are used per layer-2 segment, the DHCP server must be explicitly told which subnets belong together. This feature is often called shared networks and not all DHCP servers support it. The Kea DHCP server documentation describes this feature quite well.

Cross-subnet communication

Direct communication between IP subnets without a router involved becomes possible when sharing a layer-2 segment. This may be a security risk.

IP broadcasts, irregardless of whether they are sent to 255.255.255.255 or a network broadcast address such as e.g. 192.0.2.255 for 192.0.2.0/24, will be mapped to layer-2 broadcast (with Ethernet a frame with destination MAC address ff:ff:ff:ff:ff:ff), that is flooded to every port attached to the layer-2 segment and will therefore need to be processed by every host irregardless of the subnet.

If a appropriate routes are configured on end hosts and end hosts implement the weak host model, end hosts will even be able to have IP unicast communication with each other, by requesting and answering cross-subnet ARP requests.

See arp_announce, arp_filter and arp_ignore sysctl settings of the Linux kernel or the Microsoft Windows weakhostsend and weakhostreceive interface settings.

Use cases

Due to the above issues, I would advise against using multiple subnets per layer-2 segments. Still there are a few use cases (aside from the deceptive simplicity of only configuring a single VLAN).

Renumbering

When migrating hosts from one subnet to another without disruption, it is necessary to temporarily configure multiple subnets.

Address exhaustion/Address space fragmentation

If all/most IP addresses of a given subnet are used and a simple broadening of the subnet mask is not possible, because the adjacent subnet is already used somewhere else and renumbering is not feasible in the short term, shared networks may serve as temporary kludge.

This is only a real use case for IPv4 networks, as in IPv6 networks, the size of a subnet is (almost) always /64, which is virtually impossible to exhaust.

Access networks

In access networks, such as DOCSIS cable networks, customers may use their own IP router, that is distinct from the provider's modem. The provider may want to manage the modem via IP though, through a different subnet from the customer subnet. Technically this could be accomplished via layer-2 segmentation (e.g. VLANs) on WAN side of the modem too, but I don't known if this supported or done in practice.

Improve this answer
1

I just wanted to give a real world example of why you might want 2 subnets on one VLAN/LAN:

We have some offices that want non-NAT public addresses and some that want private IP addresses (10.x). By running 2 subnets on 1 VLAN, the users can plug a switch into the office's single ethernet port and have some devices privately IP'd and some publicly IP'd. This saves the admins time and wiring costs of having to run multiple connections to each office or switch links between VLANs anytime there is a change wanted by the end user.

Peter Green gave a good summary of some other pros and cons that I agree with.

Improve this answer
0

Now, nobody does that

That statement is not true. Some admins do it, some don't. There are pros and cons to such a setup.

Pros:

  • You can move stuff arround without reconfiguring the switchports.
  • If you use ICMP redirects you can arrange for the bulk of data traffic to pass directly between hosts without hitting a router.
  • One machine can have IPs on multiple subnets without requiring multiple NICs on the same machine or VLAN support on the end machine (afaict the latter is no problem on Linux but more of an issue on Windows).
  • You save VLAN IDs.

Cons.

  • More broadcast traffic.
  • If there is a firewall in the L3 routing then people may think the hosts are isolated when they are not really.
Improve this answer
0

We can add multiple subnets to a single vlan. There is a feasibility in the networking world.. but it adds more complexity to the network, making it more difficult to understand by new admins. But it is possible in real time.

We can add more than one subnet to a single Vlan in a scenario where the existing network gets exhausted if the subnet IP pool gets exhausted. Then we can take this concept of adding a new subnet to the same Vlan without adding additional Vlans

But it should be a static environment. In a DHCP running environment, adding multiple subnets to a single Vlan is not feasible

All the network and security devices won't support adding more than one subnet to an interface. As per my knowledge, cybersecurity products like FortiGate firewall support adding more than one subnet to a single interface

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.