0

Consider following situation:

You have 10.3.0.0/16 network without any VLANs. Now You want to divide it...

You want Your IT department be able to reach the entire network, but sales department only Domain Controller, printers etc. You want IP cameras would be reachable only by security and managers.. I think You've got the idea.

Question: Am I getting it right that it is not possible that all hosts stay in same subnet, but each host will now belong to some VLAN, and the "routing" between VLANs will be done via Layer 3 switches. If not how it can be done?

P.S. I know that it can be done if You divide 10.3.0.0/16 to smaller subnets.

Thank You.

Improve this question
7
  • You need a router to route traffic between VLANs, and each router interface must be in a different network. Using the same network on multiple router interfaces means that a router would have to guess how to forward packets, but routers are deterministic and cannot guess. You simply subnet the network and assign one of the subnets to each VLAN, then you can control access with ACLs.
    – Ron Maupin ♦
    Apr 13, 2022 at 16:46
  • @RonMaupin I have only one router and it is default gateway for all hosts on the network.
    – v.doro2
    Apr 13, 2022 at 16:48
  • The router will still be the default, but the router interfaces for each VLAN will have an address in the VLAN, and that will be the gateway for that VLAN. This is routing 101, and it is done all the time.
    – Ron Maupin ♦
    Apr 13, 2022 at 16:50
  • @RonMaupin You mean Router-On-the-Stick?
    – v.doro2
    Apr 13, 2022 at 16:51
  • That is one way, or you connect separate router interfaces to separate switch interfaces that are in different VLANs.
    – Ron Maupin ♦
    Apr 13, 2022 at 16:52

1 Answer 1

Reset to default
1

it is not possible that all hosts stay in same subnet

That is correct. VLANs segregate your network into multiple layer-2 segments and connecting it back together mandates different subnets for proper routing. Likely, you'd want to split your inital 10.3.0.0/16 network into subnets.

but each host will now belong to some VLAN

Yes, each host needs to belong to some VLAN. It's not possible to connect to the switch without using a VLAN. If you don't configure VLANs, there's a single default VLAN that all ports are untagged members of.

and the "routing" between VLANs will be done via Layer 3 switches.

Yes.

On a layer-3 switch, you can bind an IP address to a VLAN (switch virtual interface SVI) or to a layer-3 interface (interface <port> and no switchport), depending on the switch model. The attached hosts can then use that address from their VLAN as gateway. If you use the VLANs as security zones you also need to set up ACLs to control the inter-VLAN traffic as required.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.