Jtdylktuy

I've read the post Multiple Subnets in a VLAN and am wondering about the possible conflicts when using several subnets in a VLAN.

The recommended design is of course put a IP subnet in a VLAN.

If I configure several IP subnets in a VLAN, e.g. some hosts in 10.1.1.0/24, some hosts in 10.2.2.0/24 and both under a VLAN, will these two networks interrupt each other? If there's actually no impact then why is such a design not preferred?

This is possible however:

• you still need a router to have the hosts from one subnet to communicate with the hosts in the other subnet


• in a modern switched environment there's no collision, so this is not a issue, but you still have broadcast. All hosts will see the broadcasts from both domains which take some part of the bandwidth.


• Access Control Lists are bounded to interfaces. So to use ACL to limit traffic between the subnets you are limited to a single interface to place ingress / outgress rules; this is stil doable but more limited


• any host can potentially hear some traffic pertaining to the other subnet. That's a security issue.


• when troubleshooting a network issue, you may have to sniff traffic (with utility like tcpdump or wireshark), having several IP networks mixed render this or other troubleshooting more difficult


• overall, this is more complex to maintain and less scalable than having one subnet per vlan.

Basically there's rarely a benefit in doing so, even if you can encounter some corner case where it is the simplest solution (or a temporary dirty fix, but in IT, a temporary setup often last years....).

In general, yes you can do that.
Basically said one has nothing to do with the other. Vlans are l2 segregation/separation while subnetting achieves the same for l3.

However, it is not recommended for certain reasons.
Most obvious as stated above security.

Unicast traffic will flow without issues, but it can cause other problems.
There are ip addresses for certain traffic which are shared for all ip traffic independent from a specific subnet.(multicast&limited broadcast addresses etc.).
For example when running ha cluster-protocols like hsrp/vrrp, securexl and such or something like PIM/igmp.

So you can use it when needed but in general better try to avoid it. In bigger networks it can cause more headache than it is worth.

I do this on my home network: I have a RFC1918 /24 which is what gets DHCP'd out to my internal network and is used by default for anything on my home LAN - this the entirely normal, common scenario you're used to in home/SMB networks.

I also have a public /29 on that VLAN (PA space from my ISP). I don't DHCP that, because... well, I only have 6 IPs to use. Instead, I statically allocate IP addresses on my servers/workstations/other devices I want accessible from the internet sans NAT.

This means I often end up with two IPs on these devices (for instance, my workstation on my desk is 10.200.8.13 and also has some publicly routable IP). This has the benefit of preventing hairpin routing via my (relatively slow) firewall/router when I am accessing something local because all the devices share the same Layer 2 domain. I also do not need to mess with VLAN config on my desktop and it even works over WiFi for my laptop!

My setup is a significant edge-case, mind, and I have complete control of the environment. Your mileage will vary, especially in enterprise environments.