What is the actual purpose for having a 1:1 ratio between VLANs and subnets?

Question

I understand the technical difference between a subnet and a VLAN. After looking through questions related to this topic, including:

VRFs, VLANs and subnets: difference

VLANS vs. subnets for network security and segmentation

there doesn't seem to be an answer that really pinpoints this subtly. The communication issues and security implications of having multiple subnets on a single VLAN and vice versa, are clear.

But, subnets provide l3 separation. Okay. VLANs allow you to segment your l2. If the goal is separation -- why isn't subnetting (l3 separation) enough? I am not able to pull all of this together into a pretty picture that delineates the necessity, other than the router-on-a-stick situation where VLANs would allow subnets to share the physical infrastructure (e.g. a single switch). But in practice, do subnets really share any portion of the l2 infrastructure?

Answer 1

VLANs allow you to segment your l2. If the goal is separation -- why isn't subnetting (l3 separation) enough?

I guess this:

The communication issues and security implications of having multiple subnets on a single VLAN and vice versa, are clear.

isn't as clear as you seem to say.

From the perspective of a VLAN, a VLAN is a broadcast domain. When a host receives a layer-2 broadcast, which will be sent to every host in a broadcast domain, the host hardware must pass the frame to higher layers in the network stack for processing to see if the frame payload is destined for the host. This presents not only security concerns by hosts running capture software, but it can become a problem as more hosts on a VLAN means even more broadcasts on the VLAN than the number of added hosts, interrupting every host on the LAN.

VLANs will basically break a broadcast domain into multiple broadcast domains, just as if you had multiple, separate, unconnected switches. To get traffic from one VLAN to another VLAN requires a router. That is also true for getting traffic from one layer-3 network to another layer-3 network, which is why layer-2 VLANs and layer-3 network mesh so well.

Routers route layer-3 packets, not layer-2 frames, between layer-3 network, so each router interface is in a different layer-3 network. Since it takes a router to move traffic between VLANs, that means that each VLAN would need to use a different layer-3 network if it needs to communicate with a different VLAN.

You can also place router ACLs ,or a software firewall on a router, between the VLANs, but this requires a different layer-3 network on each VLAN because routers route packets between networks. This can be a real security feature or requirement.

But in practice, do subnets really share any portion of the l2 infrastructure?

Since VLANs can partition a single switch, then yes different layer-3 networks on VLANs will share the switch hardware, but will logically be on different switches, even on the same physical switch. The different layer-3 network can also share a physical interface on a switch or router by configuring the interface as a trunk that uses tags to separate the layer-2 frames with different layer-3 networks into separate VLANs.

---

What you are asking about is really for ethernet. There are many layer-2 protocols that do not use VLANs, and some can only use a one layer-3 network on one layer-2 LAN. Even Wi-Fi, which has displaced ethernet as the King of the LAN, does not really have VLANs. It does have separate SSIDs that can map to VLANs on the ethernet side of the WAP, but you are unlikely to be able to configure more than one layer-3 network per SSID.

Answer 2

But, subnets provide l3 separation.

Kinda, sorta, not really.

If you put multiple subnets on the same "link" (for example an Ethernet VLAN, a wifi SSID or something similar for other protocols) then devices on different subnets will not by default send IPv4 unicast packets directly to each other. Instead they will send them via their default gateway where there is potential to filter them.

However:

1. This behavior is only the default, it is perfectly possible to configure a device so that it can communicate directly with devices on both subnets.
2. IPv4 unicast traffic is not the whole world, there is also Broadcast, Multicast and IPv6 traffic to consider, not to mention legacy protocols like IPX and Netbeui. Some of this may/will flow directly between the hosts even if they have different IPv4 subnets configured.

The result is that putting multiple subnets on the same L2 "link" will often result in the illusion of separation.

Putting multiple subnets on the same "link" can make sense in some scenarios, for example if you want some but not all machines to have public IPs or if an existing subnet has run out of addresses, but if you want to enforce separation between machines then you really need them on separate (physical or virtual) links.

---

I see. I guess I was assuming subnets wouldn't typically be set up on the same link (at least for an Ethernet network). If this isn't the case, then VLANs make complete sense.

Right, the goal of VLANs is to allow physical infrastructure to be shared while keeping stuff logically separate.

But if they were on separate links, and you wanted more LAN segmentation, is creating another subnet a viable alternative to using VLANs?

Yeah, keeping your subnets physically separate up to the point they meet your router/firewall is an alternative to using VLANs. Some argue it's more secure, there have certainly been VLAN-hopping exploits in the past but OTOH it's easy for two networks that are supposed to be physically separate to be accidentally interconnected.

---

You should also be aware that the term "VLAN" is a bit overloaded. Depending on the context it can refer to either the number used for tagging packets on the wire or to the virtual Ethernet network created by doing so. In a large network infrastructure the same VLAN number may be used for different virtual Ethernet networks in different places.

Answer 3

Layer-3 provides logical isolation between subnets. If you run them on the same layer-2 [ethernet or VLAN], they aren't actually isolated. They automatically see each others broadcast traffic. With the addition of a single route, they can talk directly to each other, bypassing any routers, firewalls, or acls -- because they're on the same wire. Very few switches can do layer-3 filtering on layer-2 ports.