Why should I use vlans instead of subnets?

Question

I know that this might be a trivial question for the more experienced. However, I am a student who has just started designing networks.

Assuming you have to design a network of a school divided into four floors. Each laboratory must not be able to communicate with others and needs different rules depending on the type and use of the laboratory.If we assume that the school is small and does not have a very complex structure why should I decide to separate the network via VLAN instead of the classic subdivision into subnets?

Also, if I needed to split the network further, couldn’t I use VLSM subnetting?

Answer 1

Why should I use vlans instead of subnets?

VLANs cannot replace IP subnets. But they can structure your network - for scalability, resilience, security, or some other reason.

Since hosts in different VLANs cannot talk to each other directly, you need to provide inter-VLAN routing. That means your IP subnets need to largely follow your VLAN structure.

Each laboratory must not be able to communicate with others

IP subnets alone cannot ensure that (unless you control them very tightly and filter all other protocols). Instead, you'll need separate switches, or VLANs.

Separate switches mean dedicate cabling for each network.VLANs have the advantage that they can share a common infrastructure - switches and interconnects, using tagged trunking. VLANs also provide the flexibility to move an edge port to another VLAN with a single configuration change, without touching anything else.

and needs different rules depending on the type and use of the laboratory.

An inter-VLAN router or firewall is the perfect point to control the traffic. That is where you put the required rules. Often, a layer-3 switch with an ACL ruleset is used for this purpose because it's rather cheap and provides routing at wirespeed.

If we assume that the school is small and does not have a very complex structure why should I decide to separate the network via VLAN instead of the classic subdivision into subnets?

It's your design. Choose whatever is best in your scenario. However, for an educated choice you have to understand the options and implications.

if I needed to split the network further, couldn’t I use VLSM subnetting?

Absolutely! Any which way, you start with a certain address range (usually private addresses from RFC 1918 for IPv4), and then subnet that so it fits your design.

Note that VLSM is an obsolete term from the classful networking era nearly thirty years ago. It's called classless inter-domain routing CIDR now.

Answer 2

VLANs are not a substitute for subnets, they are a substitute for physical LANs: actual wired connections. You use them in addition to subnetting, router ACLs, etc., not instead of.

So, you could have a network like you are imagining: one main router for the building, a wiring closet on each floor with a non-VLAN switch. Physics, chemistry biology all on separate fibres connecting back to the main router where all the security rules are applied. And maybe 20, 30 years ago that would have been a reasonable design.

What is going to happen though, is that one morning the building supervisor is going to come into your office and tell you that they've just discovered that the chemistry lab is full of asbestos, and is going to be closed for a full term. Chemistry experiments are now going to be in one of the biology labs, the teachers are going to share offices on the top floor with the physics department, and the techs are going in the basement. Could you sort out the network, preferably by Monday?

At this point, if you haven't set up VLANs, you are in for a very long weekend. Using VLANs is a tradeoff between complexity and flexibility. And the real world being a messy place, flexibility usually wins.

Answer 3

Broadcast domain is a layer 2 network, while subnet is a layer 3 network. When you understand the purposes an differences between them, read on.

VLAN is a feature of Ethernet switch which separates traffic into multiple virtual broadcast domains, usually using 802.1q standard. Some switches even let you group ports into a virtual smaller switches (bridges) without the use of VLAN. In this case you run 1 subnet on top of a VLAN.

VLAN is for the convenience of management. You can use separate physical switches on each floor. In this case you run 1 subnet on top of a switch. There is no differrence in logical topology.

Things get complicated when you have a group of computers that needs to be separated from others of the same floor. Adding more and more switches on the same floor is not possible, and that's when you need a single switch with VLAN capability.

Answer 4

VLAN's and subnets are not competing solutions to the same problem. They exist independent of one another. A local area network is one or more switches linked together. VLAN's are enabled by software and virtually carves out a subset of the physical switch ports to behave as if it were a standalone switch, or switches. In other words a 24 port switch can have half of its interfaces in "LAN-ONE" and the other half in "LAN-TWO"? The actual name or number of the VLANs configured is besides the point.

Subnets refers to how you choose to implement your IP addressing scheme. Internet Protocol, or IP, also software, assumes connectivity between the addressed nodes. Variable length subnet masking is the key concept here.

Answer 5

TLDR; VLANs reduce unneeded local broadcast traffic and can also reduce the ACL control points if paired with a logical IP range partitioning, besides reducing the network vulnerabilities exposure. Using one or another could be convenient, but combining them will give more benefits overall.

Giving my two cents about some of the reasoning behind layer 2 VLANs and Layer 4 IP partitioning, IMHO:

As VLANs separate the ethernet broadcast domains, they also reduce the overall traffic of administrative packets, like automatic searches for printers, directory shares or video devices, ARP/DHCP queries, etc. It is more efficient/fast a LAN with 50-250 hosts than one with 1000. If we separate floors one VLAN each or by department, the number of machines contending for local traffic not leaving the VLAN will be smaller. Besides that, we do not need the Human Resources printer showing in the Marketing printer dialog if each have their own!

Use case: In my University we outgrow our first (and not so well done) design of the main campus' LAN, where all buildings of the campus shared a single planar domain, even if was divided with different and separate IP ranges for buildings, laboratories, teacher offices, administrative floors, etc., but growing from 200 to 1600+ hosts talking all the time, the overall performance were definitely not optimal, so we had to design and implement multiple VLANs to reduce the local traffic and to reduce the general attack surface exposed to bad agents.

We found that the easier way to give/control net services to each VLAN were asigning each its own IP range, so it was simpler to debug network issues of any pc only knowing its IP address (i.e. VLAN 84 for the eight Computer Science labs in the Building F used the range 192.168.84.0/24, further subdivided in /27 ranges of 30 hosts each for easy rights/bandwidth control independent for each lab, and detecting any misbehavior of single pcs.)

This also reduced the students capability of testing our security measures trying to impersonate MAC addresses of office pcs or servers from any lab, for example. I remember several ocassions were some bad configuration of a single pc in some networking lab swapping IPs of host/gateway disrupted all campus operation. This was mitigated a lot: Only the specific lab or VLAN is affected now. Same with the DHCP server practice labs of networking courses!

Could be simpler to manage a large IP range instead of a lot of smaller ones, but having as many IP ranges as VLANs, the intercommunication between VLANs have to be done by means of layer 3 routing, reducing the control points for ACL deploying to the routers.

Actually, I can confirm that there is no reason for lab #2 of building C to contact workshop #4's pcs in building E: The only traffic allowed out of the VLAN/Range should be to Internet or to some internal server/application. Of course, the IT group shall have access to all pcs for giving remote support, but that is not a problem to define in the interVLAN core routers.

Each case is different, so we have to analyze more than the number of hosts, departments and building layouts to approximate an escalable and efficient network for our users and services. We need to include network use and type of traffic, current network equipment available, budget projections, job/admin procedure manuals, net services/apps used/proposed, risk measurements/plan, IP addressing availability/restrictions, IPS/malware detecting systems, redundant internet links or high availability needs, even IT people level of expertise, and not less important: trying to anticipate future needs.

In summary, the isolating nature of the VLAN/IP addressing of hosts in very specific groups helps to circunscribe the failure points and the overall control of the network, and is increasingly easier to manage with the modern SDN design/administer/programmability approach. Each mechanism is applied in different scopes of the network, but working with the two together will have the greater impact and contribute to better performance/security.

Also read: VRFs, VLANs and subnets: difference.