Switch VLAN – Reasons to Avoid Multiple Subnets on the Same VLAN

broadcastlanswitchvlan

I would like to know why we do not (and should not I guess) use 2 different networks on the same LAN/vLAN. From what I tried and understood :

  • Host in network A (ex: 10.1.1.0/24) can talk to each other
  • And host in network B (ex: 10.2.2.0/24) cant talk to each other
  • Host and network A cannot talk to host in network B which is normal since inter-LAN communications need a L3 device with routing function.

The idea/principle of a LAN/vLAN is, in the course I've followed, described as a broadcast domain. But I am confused since I can configure 2 working networks within the same LAN.

I also tried the same configuration but with a second switch and a different vlan number (SW1 with vlan 10 and SW2 with vlan 20). All ports of each switch are in access mode with vlan 10 and 20 respectively. I had the same result.

Note : each side of the topology has a host from network A and B
enter image description here

Now, nobody does that and I supposed it is for some goods reasons, but I did not find what are those reasons and that is what I am asking you ?

I found this topic which seems similar, but the purpose is not the same.

Best Answer

There's really no reason not to put multiple subnets on the same VLAN, but there's also probably no reason to do it.

Pro:

  • Allows the subnets to talk directly without a router or firewall
  • Save's VLANs

Con:

  • Allows the subnets to talk directly without a router or firewall
  • It's messy from a documentation and troubleshooting perspective
  • More broadcast traffic

We generally don't do it because of the messiness and lack of security. One VLAN = one subnet is easier to document and easier to troubleshoot and there's usually not a good reason to complicate things.

The only reason I can think of to do it is company mergers or network upgrades and for both of those I'd prefer it to be temporary.

Edit to clarify, for the hosts on different subnets but the same VLAN to talk directly you'd need to either make them their own default gateway or add a route to the "other" subnet that connects it to the interface.

In the gateway case if the host IP was 10.1.1.2 then the gateway would also be 10.1.1.2. This will cause the host to ARP for everything on or off it's subnet. This would allow it to talk to the second subnet on that VLAN but the only way it'll be able to talk to anything else is if there's a router/firewall running proxy arp that can help it out.

In the route out the interface case you'd add something like "route add -net 192.56.76.0 netmask 255.255.255.0 eth0" to the device and then 10.1.1.2 will ARP directly on eth0 when it wants to reach 192.56.76.*.