2

I have a quick question that's bugging me the more I read about VLANs.

So far I understand that they are useful for dividing the network into sub-sections, but if you route them together does that not remove any security benefit?

As an example, if I created a VLAN on my home network which was simply one computer, one server and one router.if I wanted to divide the network between computers and servers I could put the computer on VLAN 10 and the server on VLAN 20. Then the computer would no longer be able to communicate with the server - unless I added a static route to the router that connected the two together, basically telling VLAN 10 that VLAN 20 exists and how to communicate with it.

The VLANs would then be connected in a similar way to a 'flat' network that has no VLANs. Therefore, surely, all security benefits are lost.

Am I missing something?

1 Answer 1

5

Replace the word router with firewall and you'll see the security benefits because you have created a single point where all inter-VLAN traffic must transift without requiring physically discrete infrastructure. You can then filter, log, permit and deny to your heart's content.

Compare this to a situation where you have one switch with your router, computer and server all connected to. Let's assume that your server and home computer are on separate IP subnets. Nothing would stop me from reassigning the address of your home computer to be on the same subnet as your server (or vice versa) and then sending malicous traffic to it. If we had VLANs configured as per your question I could still do this (presuming I already new the IP subnetting information) but I couldn't directly reach your server without transiting the router first (and its likely the router would not route for that traffic anyway).

Herein lies the primary benefit of VLANs: The ability to treat one physical infrastructure like multiple "discrete" physical infrastructures. Instead of requiring physical separation you can achieve something similar by using seperate VLANs. Another way to put this is, you can take a single Layer-2 broadcast domain and treat it like multiple broadcast domains (which each VLAN "mapped" to a corresponding IP subnet).

2
  • Thanks, I think it makes more sense now. I didn't consider using a Firewall of control access etc. I think I was stuck on that fact that a router does the routing. Thanks!
    – dannymcc
    Nov 25, 2011 at 22:35
  • Even if you just have a router you can still enforce access control by not routing between certain VLANs (e.g., no routes between VLAN10 and VLAN20 using your example). We do this with our "public wireless" VLANs as a means to keep the traffic separate without having to have a completely separate physical infrastructure.
    – user62491
    Nov 26, 2011 at 0:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .