VLANS vs. subnets for network security and segmentation

Question

What are the security implications when using subnets as opposed to VLANs for segmenting an enterprise network? We have strict security requirements surrounding the data we handle and need to ensure that machines allowed to access these data are locked down and isolated from the rest of the network.

I understand that conceptually, VLANs allow for OSI level 2 isolation whereas subnets allow for level 3 isolation by firewalling traffic based on port and source and destination IP. However, I'm unsure of what the practical implications of this is from a security standpoint. I have a few specific follow-up questions:

1. Are there attacks (like ARP poisoning or MAC flooding) that can cause traffic to be diverted to or read by a malicious entity within a different subnet (even if the firewall would block that traffic normally) that wouldn't affect a system segmented by VLANs?
2. Would traffic typical of data analysis tasks, such as between a machine and a cloud database, be readable by a malicious entity within an unauthorized subnet due to the entire networking being in the same broadcast domain?
3. Are there any complications or security callouts with using a VPN to access a cloud environment in either setup?

Answer 1

Subnets are the IP stacks way of determining what hosts are "assumed to be on link". If an address is in the same subnet traffic will be sent directly, otherwise it will be sent to a router (by default).

VLANs are a method for splitting a physical Ethernet network into multiple virtual Ethernet networks.

If you put hosts with different subnets on the same unpartitioned Ethernet network then IPv4 unicast traffic (and possibly IPv6 global unicast traffic depending on how you set up IPv6 routing on the clients) will by default flow via the router where it can be firewalled. However.

1. A malicious user of a host on one subnet can easilly add himself a secondary IP on the other subnet and use it to talk to the machines on that subnet directly bypassing your router/firewall.
2. Broadcast traffic, multicast traffic, IPv6 link-local traffic, non-ip traffic and so-on can flow directly between the systems bypassing your router/firewall.
3. Low level attacks like ARP poisioning, MAC flooding etc won't care what subnets the machines are supposed to be on.

If you want your L3 firewall to provide more than the illusion of seggregation then you need to split up the L2 network, either physically or virtually.

Answer 2

Under normal circumstances, you would use a separate layer-3 network for each layer-2 VLAN. You could then use layer-3 security policies (ACLs, firewall, etc.) between the layer-3 networks, and get the full layer-2 separation, also. Using multiple layer-3 networks on the same layer-2 LAN for IPv4 is rare, and you should really know what you are doing, and are doing it for a specific reason.

You do not provide enough information to properly answer your last two questions.

Answer 3

If you run separate IP subnets within a single layer-2 network, any client can switch the subnet or connect to multiple subnets simultaneously. Additionally, dynamically assigning IP addresses from multiple subnets can be challenging in a single L2 segment = broadcast domain.

For any security based on subnets (zones) you need layer-2 separation = separate VLANs and control over the communication in between.

L2 separation implies L3 separation. L3 separation doesn't necessarily imply L2 separation but to implement security zones you need VLAN separation.

Answer 4

I didn't see anyone else mention it but, not only are you separating the broadcast domains in utilizing VLANs, but you also add another layer of security/granularity as the VLANs are defined on the access layer port interfaces.