1

I read a couple of Q&A's here on vlans, but mostly they seem to assume having VLANs as a given.

My situation is that I have inherited a network of about 6 different subnets [some for different companies], and all the end devices are simply plugged into a total of around 20 HP Procurve switches and they all come together into a (Routerboard) router.

At the moment switches are used as dumb switches -- no VLANs configured, no nothing, and all the net division is regulated by router firewall/nat rules.

On one hand this is very easy to administer -- I don't have to do anything with switches and can make all the changes in the router.

However, having everybody assume VLANs as a given, what would be the disadvantages of the current setup and should I consider enabling VLANs in switches? Why?

Improve this question

3 Answers 3

Reset to default
1

VLANs allow you to have different networks on a single switch. Rather than getting two switches, one for each of two VLANs, you could run both networks on a single switch (assuming you have enough switch ports on one switch). If every switch connects directly to a router, and you only need one network per switch, then there really is no need for VLANs. It also obviates the need for STP and the problems inherent in that.

Improve this answer
6
  • Well, I do not know the setup yet, but really I am sure that there must be several subnets running on the same switches at least in several locations. For example, out of the total switches, there are at least 1 in each floor communication room, which may be linked to another floor switch or directly to router. However there is definitely a situation that several ports in one switch are connected to end devices on one 192.168.xxx.0/24 subnet, and other ports on another 192.168.yyy.0/24.
    – Gnudiff
    Feb 23, 2017 at 13:22
  • 1
    Then you have VLANs. Mixing networks on the same VLAN (there is always one VLAN) can cause some problems.
    – Ron Maupin ♦
    Feb 23, 2017 at 14:51
  • I am reasonably sure I don't (have VLANs set on switches), but I'll need to check this further.
    – Gnudiff
    Feb 23, 2017 at 16:37
  • 1
    You really need to edit your question to include the router ans switch configuration. Then, we can tell you more.
    – Ron Maupin ♦
    Feb 23, 2017 at 16:39
  • I can do the networks list from router and many other things, but it has around 90 fw rules, many uncommented; hard to discern, which are relevant. But thanks, I will try to get the info and amend the question.
    – Gnudiff
    Feb 23, 2017 at 19:57
2

The key issue to consider with your current setup is that the devices on different subnets are not really isolated from each other.

Sure IPv4 unicast traffic will by default go by the router but IPv4 unicast traffic is far from the only type of traffic that can flow over an ethernet network and even the IPv4 unicast traffic can be made to flow directly with some minor tweaks to the routing table on the hosts.

VLANs OTOH isolate the hosts on different VLANS from each other so that the only way they can communicate is via the router/firewall.

Improve this answer
1

VLANs are mostly used to separate broadcast domains.

It's a smart decision to use different VLANs on different Companies Subnets, that way you segregate the traffic from different companies adding more security to your network.

VLANs are also good on reducing signalling on the network, therefore improving the network efficiency.

I would recommend you go to this website: http://www.firewall.cx/networking-topics/vlan-networks.html

They have an awesome material on VLANs.

Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.