What are the reasons for not putting multiple subnets on the same VLAN?

Question

I would like to know why we do not (and should not I guess) use 2 different networks on the same LAN/vLAN. From what I tried and understood :

• Host in network A (ex: 10.1.1.0/24) can talk to each other
• And host in network B (ex: 10.2.2.0/24) cant talk to each other
• Host and network A cannot talk to host in network B which is normal since inter-LAN communications need a L3 device with routing function.

The idea/principle of a LAN/vLAN is, in the course I've followed, described as a broadcast domain. But I am confused since I can configure 2 working networks within the same LAN.

I also tried the same configuration but with a second switch and a different vlan number (SW1 with vlan 10 and SW2 with vlan 20). All ports of each switch are in access mode with vlan 10 and 20 respectively. I had the same result.

Note : each side of the topology has a host from network A and B

Now, nobody does that and I supposed it is for some goods reasons, but I did not find what are those reasons and that is what I am asking you ?

I found this topic which seems similar, but the purpose is not the same.

Answer 1

There's really no reason not to put multiple subnets on the same VLAN, but there's also probably no reason to do it.

Pro:

• Allows the subnets to talk directly without a router or firewall
• Save's VLANs

Con:

• Allows the subnets to talk directly without a router or firewall
• It's messy from a documentation and troubleshooting perspective
• More broadcast traffic

We generally don't do it because of the messiness and lack of security. One VLAN = one subnet is easier to document and easier to troubleshoot and there's usually not a good reason to complicate things.

The only reason I can think of to do it is company mergers or network upgrades and for both of those I'd prefer it to be temporary.

Edit to clarify, for the hosts on different subnets but the same VLAN to talk directly you'd need to either make them their own default gateway or add a route to the "other" subnet that connects it to the interface.

In the gateway case if the host IP was 10.1.1.2 then the gateway would also be 10.1.1.2. This will cause the host to ARP for everything on or off it's subnet. This would allow it to talk to the second subnet on that VLAN but the only way it'll be able to talk to anything else is if there's a router/firewall running proxy arp that can help it out.

In the route out the interface case you'd add something like "route add -net 192.56.76.0 netmask 255.255.255.0 eth0" to the device and then 10.1.1.2 will ARP directly on eth0 when it wants to reach 192.56.76.*.

Answer 2

I just wanted to give a real world example of why you might want 2 subnets on one VLAN/LAN:

We have some offices that want non-NAT public addresses and some that want private IP addresses (10.x). By running 2 subnets on 1 VLAN, the users can plug a switch into the office's single ethernet port and have some devices privately IP'd and some publicly IP'd. This saves the admins time and wiring costs of having to run multiple connections to each office or switch links between VLANs anytime there is a change wanted by the end user.

Peter Green gave a good summary of some other pros and cons that I agree with.

Answer 3

Now, nobody does that

That statement is not true. Some admins do it, some don't. There are pros and cons to such a setup.

Pros:

• You can move stuff arround without reconfiguring the switchports.
• If you use ICMP redirects you can arrange for the bulk of data traffic to pass directly between hosts without hitting a router.
• One machine can have IPs on multiple subnets without requiring multiple NICs on the same machine or VLAN support on the end machine (afaict the latter is no problem on Linux but more of an issue on Windows).
• You save VLAN IDs.

Cons.

• More broadcast traffic.
• If there is a firewall in the L3 routing then people may think the hosts are isolated when they are not really.