3

I would like to know why we do not (and should not I guess) use 2 different networks on the same LAN/vLAN. From what I tried and understood :

  • Host in network A (ex: 10.1.1.0/24) can talk to each other
  • And host in network B (ex: 10.2.2.0/24) cant talk to each other
  • Host and network A cannot talk to host in network B which is normal since inter-LAN communications need a L3 device with routing function.

The idea/principle of a LAN/vLAN is, in the course I've followed, described as a broadcast domain. But I am confused since I can configure 2 working networks within the same LAN.

I also tried the same configuration but with a second switch and a different vlan number (SW1 with vlan 10 and SW2 with vlan 20). All ports of each switch are in access mode with vlan 10 and 20 respectively. I had the same result.

Note : each side of the topology has a host from network A and B enter image description here

Now, nobody does that and I supposed it is for some goods reasons, but I did not find what are those reasons and that is what I am asking you ?

I found this topic which seems similar, but the purpose is not the same.

  • It would help if the question was stated more clearly. I would suggest doing that in the title (with a ?) and at the end of the description, again, with a question mark. I think what you're asking is: What are the reasons for not putting multiple subnets on the same VLAN? – Dave Noonan Jun 17 '16 at 11:44
4

There's really no reason not to put multiple subnets on the same VLAN, but there's also probably no reason to do it.

Pro:

  • Allows the subnets to talk directly without a router or firewall
  • Save's VLANs

Con:

  • Allows the subnets to talk directly without a router or firewall
  • It's messy from a documentation and troubleshooting perspective
  • More broadcast traffic

We generally don't do it because of the messiness and lack of security. One VLAN = one subnet is easier to document and easier to troubleshoot and there's usually not a good reason to complicate things.

The only reason I can think of to do it is company mergers or network upgrades and for both of those I'd prefer it to be temporary.

Edit to clarify, for the hosts on different subnets but the same VLAN to talk directly you'd need to either make them their own default gateway or add a route to the "other" subnet that connects it to the interface.

In the gateway case if the host IP was 10.1.1.2 then the gateway would also be 10.1.1.2. This will cause the host to ARP for everything on or off it's subnet. This would allow it to talk to the second subnet on that VLAN but the only way it'll be able to talk to anything else is if there's a router/firewall running proxy arp that can help it out.

In the route out the interface case you'd add something like "route add -net 192.56.76.0 netmask 255.255.255.0 eth0" to the device and then 10.1.1.2 will ARP directly on eth0 when it wants to reach 192.56.76.*.

  • 3
    Your first "pro" is incorrect. If a node wants to send a packet to another node that is not on its subnet, it will send the packet to its default gateway instead (if the node has a routing table of its own, it will look in that table first). If there is no router available to the node, then it won't be able to send the packet. What you could do is have a router on a stick wtihout the router being VLAN capable/supporting tagging or using multiple physical interfaces. – Todd Wilcox Jun 17 '16 at 14:22
  • 1
    Nope, it's correct, I just didn't mention that you'll need a change on the hosts to either route that subnet out that interface or make the host it's own default gateway. In either case the two hosts will talk directly without going through an L3 device. – Dave Noonan Jun 18 '16 at 15:26
1

I just wanted to give a real world example of why you might want 2 subnets on one VLAN/LAN:

We have some offices that want non-NAT public addresses and some that want private IP addresses (10.x). By running 2 subnets on 1 VLAN, the users can plug a switch into the office's single ethernet port and have some devices privately IP'd and some publicly IP'd. This saves the admins time and wiring costs of having to run multiple connections to each office or switch links between VLANs anytime there is a change wanted by the end user.

Peter Green gave a good summary of some other pros and cons that I agree with.

0

Now, nobody does that

That statement is not true. Some admins do it, some don't. There are pros and cons to such a setup.

Pros:

  • You can move stuff arround without reconfiguring the switchports.
  • If you use ICMP redirects you can arrange for the bulk of data traffic to pass directly between hosts without hitting a router.
  • One machine can have IPs on multiple subnets without requiring multiple NICs on the same machine or VLAN support on the end machine (afaict the latter is no problem on Linux but more of an issue on Windows).
  • You save VLAN IDs.

Cons.

  • More broadcast traffic.
  • If there is a firewall in the L3 routing then people may think the hosts are isolated when they are not really.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.