What are the pros and cons of designing an entire network using VLANs rather than design the network only using subnets?
1
-
7VLANs are layer-2, subnets layer-3. Any modern network of any size will have both.– RickyJan 14, 2020 at 2:21
Add a comment
|
3 Answers
There's no discrepancy between VLANs and IP subnets - they go hand in hand.
Organizing your network into different IP subnets enables you to provide a (security) structure and to limit the size of each broadcast domain (instead of having a single large one). Without VLANs, proper subnetting requires a separate switch for each subnet and separate cabling for each interconnect between switches and routers.
VLANs enable you to use the same L1/L2 infrastructure - switches and interconnects - for all (some) VLANs. That way, you save on a lot of hardware and cabling and can handle changes very flexibly.
Of course you can run multiple IP subnets on a single switch/VLAN or without VLANs, but there's little sense in that as the subnets aren't really separated, and there's no easy way to run DHCP.
-
Subnets have nothing to do with broadcast domains, at all. VLANs separate broadcast domains, subnets are perfectly fine within one broadcast domain. Also you can have multiple subnets on one switch without any problem.– user89294Apr 12 at 23:38
-
@gr0und Subnets are required to allow communication across multiple broadcast domains/VLANs, connected by router.– Zac67 ♦Apr 13 at 13:50
-
VLANS and subnets normally go hand in hand. That is there is usually a 1:1 mapping between subnets and VLANs.
It's possible to run multiple subnets on the same VLAN and it's possible to split a subnet among multiple VLANs, but possible doesn't mean good idea.
Running multiple subnets on the same VLAN means you will often end up with the illusion of segregation. IPv4 unicast traffic will flow via the router where it can be filtered, but many other types of traffic will not and a system on one subnet can easilly add a secondary IP on the other to bypass the unicast filtering.
Splitting a subnet between multiple VLANs will mean you need to do some funky routing and proxy arp/ndp stuff to pass traffic between systems on the two VLANs.
VLANs are used to use same broadcasting domain over different switches and/or have different broadcast domains on one switch. In normal scenario we can't use nodes from two broadcast domains in an one switch
