Understanding vlan

Keep in mind that, fundamentally, if two hosts are configured with IP addresses in different subnets those hosts will need to communicate through one or more routers with interfaces in their respective subnets in order to communicate. A "layer 3 switch" isn't anything more than a router with the ability to create virtual interfaces that are exposed to the broadcast medium of a VLAN.

re: #1 - To conceptualize VLANs, just imagine that the ports in each VLAN are a physically disperate switch. In a flaw-free VLAN implementation (where traffic can't "leak" between VLANs) that's the effective behavior-- each VLAN acts as a separate switch. ACLs applied at layer 2 will name only MACs (and, if the switch supports quasi-layer 1 ACLs, ports). Any ACLs naming IP addresses, TCP ports, etc, aren't layer 2 ACLs. (There may be switches that have "layer 2.5" functionality whereby they examine the payloads of IP packets without actually being able to route packets, but I'd be wary of such things.)

re: #2 - VLAN tags allow the traffic of multiple VLANs to be carried on a single port, typically called a "trunk". You can conceptualize them as virtually subdividing a connection between two devices into smaller "ports" that each carry the traffic for a single VLAN. There's nothing you can do with "trunking" that you couldn't do by using multiple non-trunked ports, but using trunk ports and tagging packets allows you to carry the traffic of multiple VLANs between physically disperate switches w/o using a large number of physical ports for inter-switch links.

re: #3 - Routing IP between different subnets (irrespective of VLANs-- it's typically convenient to have a 1:1 relationship between VLANs and subnets, but it's not required) requires a routing capability. If you need to route IP between different subnets then you need a router. It could be an embedded layer 3 entity in a switch, or it could be a "router on a stick". Anything that can route IP between different subnets is a router. re: ACLs - Like I said in #1-- I'd be wary of a device that did "quasi layer 3" functions. Either it's a router or it isn't.

A couple decent background questions:

• What are the implications of having two subnets on the same switch?

• Best way to segment traffic, Vlan or subnet

No. What you propose defeats the purpose of VLANing. Assuming there was a way to get this working you would lose segregation as soon as it hit the physical switch.

You can do a couple of things, all of which would require various levels of reworking your network and/or ugliness.

Access Ports

First, and probably the most simple, would be to create the VLAN and then add a second Ethernet drop from the switch to the Hyper-V box as a normal access port (untagged) and then setup a separate virtual network for this traffic. You would also have to add another interface to your firewall to connect to another normal access port on the switch and route/firewall from there.

Hybrid Trunking/Access port

You would setup a Trunk to the firewall and use a sub-interface or Virtual interface on the firewall to act on the packets tagged with the VLANs. You would then have two access ports going to the Hyper-V box one for each VLAN.

You can swap this so the Trunk is going to the Hyper-V machine and the access ports to the firewall.

Trunking all around

You can setup trunks to both the firewall and the Hyper-V box and setup the Sub-interfaces on the firewall, seperate networks on the Hyper-V box based on these VLANs.