Subnetting vs Firewalling

Question

What is the point of subnetting from a security perspective, if all this seems to do is create additional processing in the router, hence latency?

It’s the firewall that allows or blocks traffic.

But then I know that you can’t ping a different host on another subnet. So subnetting creates a block all traffic condition. So it’s like a perfect firewall.

But then you see the internet work, so communication between subnets is very possible.

So it seems we have all these pieces which work a certain way that would suggest, that nothing should work.

Very confused.

I’ve read a computer networking book, so it’s not my first day of studying networking, but I’m obviously not there yet.

Anyone care to chime in to clear things up a bit?

Answer 1

Subnetting allows you to zone your network. If you put all your nodes in a single subnet you can't tell them apart, ie. have to rely on the IP address they claim to have.

Subnets can be grouped to security zones. Since a node cannot leave its subnet (if done correctly), it cannot leave its zone. Communication between subnets requires a gateway/router and that is exactly where you control the traffic.

If you route on intermediate L3 switches there's zero additional latency.

I know that you can’t ping a different host on another subnet.

Of course you can, if there's a route between the source and the destination, and there's no ICMP echo filtering.

You can ping across the Internet, can't you?

subnetting creates a block all traffic condition. So it’s like a perfect firewall.

Not at all.