Why do Vlans need routers to communicate?

Question

Why do devices on two separate VLANs (Virtual LANs) implemented on the same switch require a router to communicate?

Answer 1

Why Vlans need routers to communicate?

Brief answer, they don't. A VLAN is a virtual LAN. It is a means of logically dividing one physical switch into multiple virtual switches.

If you have two different physical switches (no VLANs configured) can the devices connected to each switch communicate? No, not unless there is something that facilitates or allows the communication between the separate switches.

Simplest solution is then providing a physical connection between the two switches (i.e. connect a network cable between the two). This now allows devices on one switch to communicate devices on the second switch...at least at L2. This also works with VLANs. If you simply want L2 communication between two different VLANs, all you need to do is provide a connection between the two.

A router is necessary for L3 communication to take place. Say you have multiple devices all connected to one switch with no VLANs (or all to a single VLAN) with half of the devices using a 192.168.10.0/24 subnet and the other half using 10.168.10.0/24. Can any two devices on different subnets communicate with each other? The answer is yes and no.

Yes, they can when you are talking about L2 communications. But if you want to connect to them using L3 (i.e. IP), then no. To allow devices on two different L3 subnets to communicate, the traffic must be routed across the L3 boundary. This is where the router comes into the picture.

The likely source of your question is the common perception that a single VLAN is associated to a single IP subnet. While this is often the case, it is not always so. You can use multiple different IP subnets on a single VLAN, and you can use a single subnet on multiple VLANs. Both are possible, although you really should understand how this works and more importantly why you would want to do so before you do.

Answer 2

VLANs don't need routers to communicate.

Well, they usually do, but not necessarily. They just need some "external help". Which sometimes comes internally.

Confusing? Yes. Read on.

Configuring VLANs on a switch effectively makes the switch (internally) split itself into multiple switches. Imagine having multiple logical backplanes, one for each VLAN you define.

The you go ahead an define each switchport's behaviour w/regards to the VLANs available on the switch.

• some switchports will be mapped to a single VLAN, and will not have VLAN tags on the ethernet frames they send or receive (switchport mode access and switchport access vlan XXX in Cisco speak).
• some switchports will send and receive ethernet frames for all VLANs available on the switch (switchport mode trunk)
• some switchports will send and receive ethernet frames for a (sub)set of VLANs available on that switch (switchport mode trunk & switchport trunk allowed vlan [add|remove] XX1,XX2,XX5)
• and then there's some advanced settings and modes for untagged vlans on tagged trunk ports etc.

VLANs are (bar the shared hardware ressources) completely isolated from each other, as if they were each a seperate switch, for most aspects of "switching". There's even each a MAC address table for each VLAN, and sometimes even a separate instance of spanning-tree for each VLAN (at least on Cisco switches with (Rapid-)PVST+).

There is no way to get data to flow from one (layer-2) VLAN to another without some external help.

This external help may come in different forms (be aware that some of these are pretty "stupid ideas" for a novice and cause great havoc unless you know exactly what you are doing and take some countermeasures; they're just shown here for illustration):

• a cable connecting one switchport access vlan XX1 port to one switchport access vlan XX2, sometimes called "loop" or "ear cable" [yes, thats a bad idea]
• another switch or bridge (single VLAN or not VLAN aware) connecting one switchport access vlan XX1 and one switchport access vlan XX2 [yes, another bad idea]
• an external router or firewall with multiple ports (standard routed interfaces, not ports of an integrated switch), each connected to one switchport access vlan XXn on the given switch [good setup]
• an external router or firewall with a single interface, configured with a set of VLAN-tagged subinterfaces, connected to a switchport mode trunk, with a matching set of switchport trunk allowed vlan XX1,XX3,XX7. That is sometimes called the router on a stick scenario. [good setup]

And then, this external help might also come internally and now we're entering the domain of layer-3 switching, and the lines between layer-2 VLANs and layer-3 things get blurred a bit.

• internal routing engine of the same switch. The switch may not only have a set of VLANs (as simple layer-2 VLANs, see above) , but also a set of SVIs (SwitchVirtualInterfaces, interface vlanXXxin cisco speak). Not all layer-2 VLANs need an SVI, but all SVIs must have an underlying layer-2 VLAN.
• The SVI can be configured with IPv4/IPv6 address&mask and some further layer-3 properties usually found on routers. These SVIs then appear as hosts in the given VLAN.
• Enabling ip[v6] forwarding or ip[v6] routing (sometimes on by default, consult your documentation) then enables the switch - more precisely: its internal routing engine - to forward or "route" packets from one VLAN to another. That of course is only possible if IP(v6) addressing for each participating VLAN-with-SVI is non-overlapping, else "routing is not possible" [1].
• At first, ip forwarding from one SVI to the other is only possible between directly attached networks of that routing engine, but there's possibilities for adding static routes, and a default route (to some firewall, possibly) or integrating the switch's routing engine into some dynamic routing setup possibly already in place. Essentially, for the relevant VLANs-with-SVIs, the switch is now a router and should be treated as such.

---

[1] not so for pure isolated Layer2-VLANs which have no SVIs; they're unaware of each other, and therefore they do not actually require non-overlapping IP addressing. It's entirely up to the network and systems admins how to define overlapping or unique IP subnets for Layer2-VLANs. It all depends on the given addressing plan.

Answer 3

I think You have good Understanding about Subnet Masking. Subnet is a separate network. Generally No network talk to any other network without having routing configurations. Device is Same but Vlans define separate networks inside same switch.

Separate Network means, each network has own broadcast domain. Therefore devices which in same broadcast domain can communicate in their broadcast domain.

you don't need router when switch is not able to provide routing function. If you have L3 Switch, you can configure routing in same device. you don't need separate router.

Note

As per my knowledge, 2 VLANs cannot have same IP address range. It is possible in VRF.

Answer 4

By using VLANs you can split a switch into independent networks. This separation is achieved by limiting what goes into the MAC-address-table of each VLAN.

MAC-addresses are used to identify a host at the Layer2 (Data Link) at which the switch operates. When sending a frame, a source host will put its own MAC address in the source field and the destination MAC address in the destination field (Not to be confused with the IP address which operate at Layer3 and are added as source/destination of the Layer3 packets that are encapsulated in Layer2 frames).

A MAC-address-table in a switch shows for each port the associated VLAN and the list of MAC addresses (hosts) that can be reached on that port.

When a frame enters the switch on a port assigned to a VLAN, the switch will lookup the MAC-destination-address of the frame in the MAC-address-table for th VLAN of the incoming port. One of the two will happen:

• If there is a match, the frame will be sent out on that port and it is expected that the destination will be reached because we had it in the table.
• If there is no match, the frame will be sent out on ALL ports that are assigned to the VLAN of the incoming port (and nowhere else!) hoping that the frame will reach it's destination. This is also why the VLAN is known as a broadcast domain.

In this process the switch also looks at the source MAC address and adds it to the MAC-address table associated with the incoming port and its VLAN. This is how the MAC-address-table gets populated.

Now if you want to communcate between hosts that are on different VLANs, this can't be done with a Layer2 switch only because, per the above explanation, even though the MAC destination (aka MAC address of the host in the other VLAN) will be unknown, the frame will not be sent out ports in other VLANs.

What you need here is a Layer3 device (like a Router or a Layer3 switch - could be the same switch we're already connected to if it has the capability) that will provide its own MAC address when asked what's the Layer2 (MAC) Address of a particular Layer3 (IP) address. This mechanism is called Proxy ARP and will help frames destined to hosts outside source's VLAN to reach a gateway that knows how to forward the packet further. Notice the use of packet here which implies the Layer 2 headers will be rebuilt once the gateway sends the packet further on the next network segment.

PS - In this explanation I assumed the destination MAC address is known just to prove how the system works.In reality without a gateway to answer on behalf of the destination outside the VLAN, the source won't even be able to craft and send a data frame. The standard ARP mechanism used to find the Layer2 (MAC) address associated with Layer3 (IP) address of a field only works within a VLAN (braodcast domain)

Answer 5

General different VLANs won't communicate to each other. To ensure communication between different Vlans routing is required . .

By configuring Inter-vlan routing among different VLANs in layer3 device . Different Vlans can communicate among them .

When there is traffic between same Vlan host traffic will be forwarded on basis of destination mac address for this it will refer mac -address table in layer2 switch packet won't reach to layer3 device ..

When there is tràffic between. Different Vlan . Traffic is destined to gateway of source host which is configured on layer3 device . From layer3 devices packet will destined to destination with reference route entry if it network is connected on different devices or checks ARP table if destination network is directly connected network .