1

The main purpose of VLAN is to isolate computers.

Supposing we have two VLANs (VLAN 500 & VLAN 600). The first VLAN has the range 192.168.0.0/24 and the other one has 10.0.0.0/24.

Is there any interest of using VLANs on the switch in this case? As a good configuration of the router will, indeed, perform the isolation.

1

The main purpose of VLAN is to isolate computers.

The point of VLANS is to allow you to seperate your physical and logical network structures.

Is there any interest of using VLANs on the switch in this case? As a good configuration of the router will, indeed, perform the isolation.

There are three scenarios to consider.

  1. The machines are all on the same Ethernet network without VLANs. In this case the machines are not isolated even if they are in different subnets. IPv4 unicast traffic between different subnets will by default pass through the router where it can be filtered but broadcasts to 255.255.255.255 and IPv6 link-local traffic will pass directly between the machines. Furthermore if someone does want to send IPv4 unicast traffic bypassing the router they just need to add a second IP address to their NIC.
  2. The machines are on two physically seperate Ethernet networks connected to different ports on the router. In this case the router can reliablly control communication between the two groups of computers but maintaining two or more physically seperate networks is a PITA (and it's very likely that sooner or later some numpty will interconnect them).
  3. The machines are on seperate VLANs on the same physical Ethernet network. This gives you the best of both worlds. The router keeps control of communication between the two groups of computers but you only have to maintain a single physical infrastructure.
0

The main purpose of VLAN is to isolate computers

That is incorrect. VLANs are to create separate layer-2 broadcast domains on switches, where, by default, the entire switch would be in a single layer-2 broadcast domain.

A layer-3 device (router) is required to move traffic between the layer-2 VLANs, just as if the VLANs were separate LANs connected to different router interfaces.

It is possible to restrict traffic between VLANs on a router using ACLs or firewalls.

We live in a layer-3 world. It used to be, "Switch where you can, route where you must," but that concept is no longer true. Routers, including layer-3 switches, can easily have virtual interfaces for the VLANs, and that is very inexpensive, compared to physical router interfaces to isolate layer-2 broadcast domains, and network security is much, much more important than it used to be.

Layer-2 protocols just haven't kept up with reality. In particular, STP, even RSTP, can be problematic. There are replacements, e.g. TRILL, that strive to eliminate the need for STP, but they are currently limited to data centers, and most are not inter-operable or are proprietary.

Cisco has some best practices around layer-2 designs, including restricting each VLAN to a single access switch and using routing, rather than having VLANs spread across many access switches. The recommended best practices will virtually eliminate STP problems, e.g. broadcast storms, which can cripple a large network.

0

A VLAN limits the scope of BUM traffic and isolates failure domains.

A VLAN defines the scope of an Ethernet which may exist on any number of ports on a single or multiple switches. It is possible for multiple subnets to communicate over a single VLAN but you usually see a single subnet per VLAN.

If on a shared VLAN, secondary IP addresses can be added by end users to switch subnets.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.