What is the difference between a VLAN and a subnet?
At first glance, they can feel very similar. This is especially true when the two terms are used somewhat interchangeably. When we connect a new device to the network and want to know how to address it, we might say any of the following:
- Put it on VLAN 10.
- Put it in subnet 10.0.10.0/24.
- Give it an IP address from VLAN 10.
- Put it in the 10.0.10.0/24 VLAN.
Each of these is trying to say the same thing. The last two are technically wrong, blurring the distinction between what VLANs and Subnets are. This happens because there is generally a one-to-one mapping of subnets to VLANs, and we can work out what the person means by context.
To explain the difference, we need to define some terms.
What Is A VLAN
It is a layer 2 concept, a VLAN is a Virtual LAN. It represents a single broadcast domain, where all of the devices in that VLAN can talk to each other at layer 2.
The reason they are called virtual is because a single switch can be divided up into many VLANs. A single VLAN can also span across many switches. This gives us flexibility in how we connect end devices and what logical part of our network we connect them to.
VLANs are used to segment a network into multiple broadcast domains. We do this for both scalability and security.
At layer 2, devices in one VLAN cannot communicate with devices in another VLAN.
What Is A Subnet
Subnets are synonymous with IP (both IPv4 and IPv6) which are layer 3 protocols in the OSI model.
A subnet is simply a smaller piece of a larger network. We might use 10.0.0.0/8 as the internal address space for our entire organization. We could break that into 10.1.0.0/16, 10.2.0.0/16, and so on for use in different sites. We could further break those down to 10.1.0.0/22 for one particular building and 10.1.1.0/24 for a floor or department in that building.
We use subnets to segment the network and tend to group similar devices or similar roles into a particular subnet. We do this for scalability and security reasons as well.
One subnet still can’t talk directly to another, so 10.1.1.0/24 can’t communicate directly with 10.1.2.0/24. They can, however, communicate via an intermediary device called a router that will forward traffic between the two subnets.
This Still Sounds The Same, Where Is The Difference?
At this stage VLANs, and subnets may still sound somewhat similar. They’re both used to segment the network into smaller networks for efficiency and security.
You may like to think of it as VLANS providing physical separation and subnets providing logical separation.
The key is understanding that layer 3 protocols like IP (IPv4 and IPv6) travel on top of a layer 2 network.
A single layer 2 VLAN can have multiple IPv4 subnets on top of it, or even multiple layer 3 protocols, such as IPv4 and IPv6 at the same time. In practice, we tend to have one IPv4 subnet per VLAN or one IPv4 and potentially several IPv6 subnets per VLAN.
What About Inter-VLAN Routing?
Inter-VLAN routing is another one of those technical inaccuracies that we all ignore. Routing is a layer 3 concept, we route between subnets, not VLANs.
So inter-VLAN isn’t routing between VLANs, it’s routing between the subnet associated with one VLAN and the subnet associated with another VLAN.
Subnets Vs VLANs – An Example
The best way to understand the differences is with an example.
Lab Setup
For this lab, we have the following:
- One switch, split into two VLANs – VLAN 10 and VLAN 20
- Hosts 1 through 4 are in VLAN 10 but in two different subnets
- Hosts 1 and 2 belong to 10.0.15.0/24
- Hosts 3 and 4 belong to 10.0.10.0/24
- Host 5 is in VLAN 20, but the same subnet as hosts 3 and 4.
- All hosts are configured with the IP address in the diagram, and no default gateway.
Note that in this test we have two different IP Subnets being used in VLAN 10. This is specifically to help demonstrate the difference and is not how you would normally configure a production network.
Testing Logical Separation
To test the logical separation we will ping from Host-3 to Host-4 and Host-2.
eve@Host-3:~$ ping -c 2 10.0.10.4
PING 10.0.10.4 (10.0.10.4) 56(84) bytes of data.
64 bytes from 10.0.10.4: icmp_seq=1 ttl=64 time=310 ms
64 bytes from 10.0.10.4: icmp_seq=2 ttl=64 time=104 ms
--- 10.0.10.4 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1002ms
rtt min/avg/max/mdev = 104.422/207.349/310.277/102.927 ms
eve@Host-3:~$ ping -c 2 10.0.15.12
ping: connect: Network is unreachable
eve@Host-3:~$The output above shows that Host-3 can ping Host-4 (10.0.10.4) because it is in the same subnet and VLAN.
It can’t ping Host-2 (10.0.15.12). Since it is on another subnet and Host-3 has no default gateway set, it doesn’t have a route for the 10.0.15.0/24 subnet, so it believes it can’t talk to Host-2 directly, even though they are on the same VLAN.
There are two further things we can do to prove this is only logical separation.
The first is to prove that Host-3 sees all broadcast traffic in VLAN 10. This is shown by running a tcpdump on Host-3 while we try to ping from Host-2 to Host-1.
eve@Host-3:~$ sudo tcpdump -i ens4 -s 1500
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on ens4, link-type EN10MB (Ethernet), snapshot length 1500 bytes
06:28:22.039197 ARP, Request who-has 10.0.15.11 tell 10.0.15.12, length 28
^C
1 packet captured
1 packet received by filter
0 packets dropped by kernel
eve@Host-3:~$When we start the capture on Host-3 we will see all broadcast traffic and traffic destined to Host-3 itself.
In this case, Host-2 did not have an ARP entry for Host-1 so the first thing it did was to broadcast an ARP request to find the MAC address of Host-1 (10.0.15.11).
We don’t see any further traffic on Host-3 because the ARP reply and the ping traffic between Host-1 and Host-2 will be unicast, not broadcast. In addition, the switch will only send the unicast traffic to the relevant ports, and not all ports.
To further prove that the only reason Host-3 can’t ping Host-2 and Host-1 is logical configuration, we can change its IP address.
eve@Host-3:~$ sudo ip address del 10.0.10.3/24 dev ens4
eve@Host-3:~$ sudo ip address add 10.0.15.3/24 dev ens4
eve@Host-3:~$ ping -c2 10.0.15.12
PING 10.0.15.12 (10.0.15.12) 56(84) bytes of data.
64 bytes from 10.0.15.12: icmp_seq=1 ttl=64 time=309 ms
64 bytes from 10.0.15.12: icmp_seq=2 ttl=64 time=106 ms
--- 10.0.15.12 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1002ms
rtt min/avg/max/mdev = 106.424/207.928/309.433/101.504 ms
eve@Host-3:~$ ping -c2 10.0.10.4
ping: connect: Network is unreachable
eve@Host-3:~$Changing Host-3’s IP address to 10.0.15.3 puts it into the same subnet as Host-1 and Host-2.
With just this configuration change, Host-3 can now ping Host-2 (10.0.15.12) but it can’t ping Host-4 (10.0.10.4) anymore.
Testing Physical Separation
In this test, we have hosts 3, 4, and 5 all in the same subnet of 10.0.10.0/24. The difference this time is that Host-5 is in VLAN 20 rather than VLAN 10 like hosts 3 and 4.
eve@Host-3:~$ ping -c2 10.0.10.4
PING 10.0.10.4 (10.0.10.4) 56(84) bytes of data.
64 bytes from 10.0.10.4: icmp_seq=1 ttl=64 time=313 ms
64 bytes from 10.0.10.4: icmp_seq=2 ttl=64 time=105 ms
--- 10.0.10.4 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 104.561/208.557/312.553/103.996 ms
eve@Host-3:~$ ping -c2 10.0.10.5
PING 10.0.10.5 (10.0.10.5) 56(84) bytes of data.
From 10.0.10.3 icmp_seq=1 Destination Host Unreachable
From 10.0.10.3 icmp_seq=2 Destination Host Unreachable
--- 10.0.10.5 ping statistics ---
2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1012ms
pipe 2
eve@Host-3:~$Host-3 can ping Host-4 (10.0.10.4) but can’t ping Host-5 (10.0.10.5). Even though they are all in the same subnet, Host-5 is in a different VLAN. When Host-3 sends an ARP request it will be contained within VLAN 10, and the ARP request will not be seen by Host-5. This shows the separation of broadcast domains between VLANs.
Common Points Of Confusion
Let’s discuss a few common points of confusion when it comes to VLANs and subnets
If I Have A Subnet Per Floor, Do I Have A Router Per Floor?
Earlier I said that in a production deployment, we might break our subnets down to sites, buildings, and floors. This would result in us having one subnet per floor. Does this mean that each floor has its own router?
In short, no. In most small to medium networks the routing functionality will be provided by a core router or layer 3 switch.
In practice, this might look similar to the following.
Should I Segment My Network By VLAN Or By Subnet?
Hopefully, you can now see these complement and build upon each other.
Think more about segmenting the network at layer 2 for efficiency and security, then layering the IP subnets on top of the VLANs.
Can I Have More Than One Subnet Per VLAN?
As shown in the example above, you definitely can, but it is not recommended. In almost all cases it should be either one IP subnet per VLAN, or it should be one IPv4 and one or more IPv6 subnets per VLAN. IPv6 can have more than one subnet as a host can have several IPv6 addresses on a single interface at a time. It will have a link-local address and may have GUA (Global Unicast Addressing) and ULA (Unique Local Addressing) as well.
Can I Have More Than One VLAN Per Subnet?
In short, no. If you think about this, what you really have is two different VLANs that are re-using the same subnet. The devices in the two VLANs won’t be able to properly communicate with each other.
Is there a way to make this work – possibly. Is it a good idea? Probably not. Stick to only mapping one VLAN to one subnet unless you understand why you’re trying to do something different.
If I Only Have One Switch, Do I Need VLANs and Subnets?
It depends on the environment. The important question is whether you need to separate some devices on your network from other devices.
In a home network, you may want to keep all those cheap and nasty IOT devices away from your main network.
In an office, you may want to keep guest wifi away from your corporate traffic. In a retail location, you may want your staff computers on a separate VLAN from the public kiosks you provide for customers. It all depends.