What's the advantage of having VLANs if you enable inter-vlan routing?

Question

If you configure VLANs with each having their own subnets, is there a point to have them if inter-vlan routing is enabled? Since VLANs will have access to other VLANs, the security argument is not applicable. I guess broadcast traffic isn't routed between the VLANs?

What are other reasons why VLANs are still interesting in this case?

Answer 1

• If you've got inter-VLAN routing, there's a single point - the router - where you can control the traffic. Of course, you could have two or even more routers for redundancy (a low number) but you could have dozens of switches.
• Splitting your network in e.g. client and server subnets allows you to very conveniently apply different security policies to each subnet (zone), e.g. on the firewall.
• A client can rather easily fake its IP address within the same subnet (unless you've implemented rigid measures like DHCP snooping and MAC binding), but it can't fake its VLAN/subnet membership.
• Even medium-sized networks pretty much require multiple subnets/VLANs for scalability.
• There may be many other reasons why you'd want to separate VLANs (geography, limit broadcast domain, separate management, ...) while still allowing them to communicate with each other.

I guess broadcast traffic isn't routed between the VLANs?

Limited broadcasts (to 255.255.255.255) are generally limited to the VLAN = broadcast domain. Directed subnet broadcasts (to e.g. 192.168.0.255/24) may be routed if your routers are configured that way.

Answer 2

VLANs provide a convenient handle to apply security or QoS policies to a group of devices.

VLANs and subnets also break up large broadcast and failure domains into manageable groups.

Answer 3

Since VLANs will have access to other VLANs, the security argument is not applicable.

You can place security (ACLs, firewalls, etc.) between VLANs, but that is much more difficult or impossible on a layer-2 broadcast domain. In the layer-2 LAN, every host has direct access to every other host on the same LAN, but not across a layer-3 boundary.

Also, layer-2 protocols (STP, CDP, LLDP, etc.) are considered security problems, and should be eliminated, isolated, or minimized as much as possible. Layer-2 protocol attacks are stopped at a layer-3 boundary. (See LAN Switch Security: What Hackers Know About Your Switches.)

Spanning tree loops and broadcast storms affect the entire layer-2 broadcast domain, but are stopped at a layer-3 boundary.

The modern best practice is to push the layer-3 boundary as close to the hosts as possible. You isolate a VLAN to a single access switch (you can have multiple VLANs on the access switch, but those VLANs do not extend to any other access switches). One way to do that is to connect the access switches to the distribution switches via layer-3. Any layer-2 problems on an access switch are isolated to that access switch. Today, there is almost nothing that requires hosts to be on the same layer-2 network, and layer-3 separation solves several problems.

Answer 4

Vlans and inter-Vlan concepts are directly proportional to each other

VLAN is defined as logical segmentation of network .. VLANs can segregate traffic according to our requirement ..

By default different Vlàns traffic won't talk to each other . To ensure communication between different VLANs inter-Vlan routing need to be enabled at layer3 devices ..