0

This is what we know about subnetting.

By dividing a network into subnets, you can separate different departments, locations, or security zones, creating distinct broadcast domains. This segmentation enhances network performance, security, and manageability.

But, if all the subnets are part of the same Vlan, does the above advantage still make sense?

So, does Vlan and Subnetting go hand in hand? What I meant is, if we need to use subnetting, the do we need to also make sure each subnet is part of a different vlan?

3 Answers 3

2

if all the subnets are part of the same Vlan, does the above advantage still make sense?

Not really. If there's no L2 segregation by VLANs (or separate switches) then any host can join any subnet just by changing its IP address(es).

Moreover, DHCP is commonly used to dynamically configure end hosts - it works best by far with separate VLANs. Bunching all subnets together requires explicit configuration for each single host.

Given that managed switches - L2 or L3 - aren't really a cost factor there should be no sane reason to go without VLANs.

5

So, does Vlan and Subnetting go hand in hand? What I meant is, if we need to use subnetting, the do we need to also make sure each subnet is part of a different vlan?

In 98% of the cases, YES. You almost always have one VLAN for every subnet and vice versa.

1

Agreed with what was stated above, using different subnet ranges in the same VLAN is unconventional - typically you'll want a subnet per VLAN. If you think about it VLAN is a 'virtual LAN' - at the core of it it's best to think about the original network design where routers and switches were separate roles. In that design you would always have one router - or later on - a router's sub-interface on a VLAN.

It's also a security risk, any host can drop into any VLAN by just choosing an IP address. Furthermore each subnet is exposed to every other subnet, and you could easily DDOS the network - for example by flooding traffic to any given broadcast address from another subnet.

2
  • any host can drop into any VLAN by just choosing an IP address. ... into any VLAN is only possible if the switchport is not configured properly (as in: allowing all or too many VLAN Tags). "drop into any IP subnet" is probably what you meant to say. May 19, 2023 at 9:58
  • Indeed, I stand corrected. All depends on the end port config as well.
    – prusieck
    May 19, 2023 at 17:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.