6

I often hear people saying that each VLAN is a subnet (or is associated with a subnet) but is that really true? Assume I have 10 big offices. I will have a subnet for each office but only 2 VLANs grouping some computers, e.g. finance workers to be separated. Is that correct or I really should have subnets and VLANs in 1:1?

20
  • What actually do you mean by 1:1? – Ron Vince Apr 28 '14 at 15:56
  • Like n:n ratio. 10 VLANS to 10 subnets. – Pietros Apr 28 '14 at 15:57
  • Every subnet should have its own vlan, assuming the subnet is connected to an ethernet switch – Mike Pennington Apr 28 '14 at 16:00
  • Often it is said that VLAN can contain more than one subnet (networkengineering.stackexchange.com/questions/1029/…) or that VLAN can span across multiple subnets (e.g. group by MAC). Which is would I would do in the example I mentioned. – Pietros Apr 28 '14 at 16:03
  • 7
    In most cases, there is no good reason to put multiple subnets in one vlan; just because you can doesn't mean you should – Mike Pennington Apr 28 '14 at 16:14
6

There is generally a 1:1 mapping between subnets and VLANs because there isn't a very good reason not to. You could have a big network with 1 VLAN, but why have a huge broadcast domain where all hosts see every broadcast when you can just separate each subnet with a VLAN? It's a waste of resources.

Subnets/VLANs are, more often than not, focused around similar uses (i.e. printer VLANs, workstation VLANs, etc.) and allowing for a single entry/exit point makes policy much easier to enforce on the VLAN/subnet as a whole. There are also security implications that sprout up in shared layer 2 domains, so you would stand to benefit from segmenting traffic as much as possible.

1
  • 1
    And there are other Layer-3 protocols besides IP. (even v4 vs v6) There are places in the world where IPX still exists. (and appletalk and DECnet for that matter, but I'd say those are very rare, indeed.) – Ricky Apr 28 '14 at 21:59
1

Technically there is not a direct link between VLAN and Subnet.

"Assume I have 10 big offices."

I think this may be the confusion.

When you have offices connected with routers, the traffic flows through a L3 device.

Two network's on different sides of a L3 device is on different VLAN's(Physical) networks.

They may have the same vlan ID but they are not the same vlan.

If this was not the case every vlan in every company in the world would be the same vlan if they had the same vlan ID.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.