If all subnets are a part of same vlan, then the network segregation using subnets does not make sense

Question

This is what we know about subnetting.

By dividing a network into subnets, you can separate different departments, locations, or security zones, creating distinct broadcast domains. This segmentation enhances network performance, security, and manageability.

But, if all the subnets are part of the same Vlan, does the above advantage still make sense?

So, does Vlan and Subnetting go hand in hand? What I meant is, if we need to use subnetting, the do we need to also make sure each subnet is part of a different vlan?

Answer 1

if all the subnets are part of the same Vlan, does the above advantage still make sense?

Not really. If there's no L2 segregation by VLANs (or separate switches) then any host can join any subnet just by changing its IP address(es).

Moreover, DHCP is commonly used to dynamically configure end hosts - it works best by far with separate VLANs. Bunching all subnets together requires explicit configuration for each single host.

Given that managed switches - L2 or L3 - aren't really a cost factor there should be no sane reason to go without VLANs.

Answer 2

So, does Vlan and Subnetting go hand in hand? What I meant is, if we need to use subnetting, the do we need to also make sure each subnet is part of a different vlan?

In 98% of the cases, YES. You almost always have one VLAN for every subnet and vice versa.

Answer 3

Agreed with what was stated above, using different subnet ranges in the same VLAN is unconventional - typically you'll want a subnet per VLAN. If you think about it VLAN is a 'virtual LAN' - at the core of it it's best to think about the original network design where routers and switches were separate roles. In that design you would always have one router - or later on - a router's sub-interface on a VLAN.

It's also a security risk, any host can drop into any VLAN by just choosing an IP address. Furthermore each subnet is exposed to every other subnet, and you could easily DDOS the network - for example by flooding traffic to any given broadcast address from another subnet.