5

For a moment, forget about whether the following is typical or easy to explain, is it safe and sound?

 Internet
    |
ISP supplied router x.x.x.1 (public subnet)
    |
  switch-------------------------------------+
  | (public subnet)                          | (public subnet)
BVI router (switch with an access list)      NAT router
  | (public subnet)                          | (private subnet 192.168.50.1)
  +--------------------------------switch----+ (both subnets)
                                    |  |
computer with IP 192.168.50.2 ------+  +----computer with IP x.x.x.2

I don't plan to implement this setup, but I am curious about it.

  • The 50.2 computer may send a packet to the x.2 computer, but it will use 50.1 as the router, since 50.2 knows that the subnet is different. Would this result in the packet being received twice by the x.2 machine, first directly through the switch, second by way of the two routers?
  • Do you see any problems with this aside from how confusing it is, and that it would put one switch doing the work of two subnets?

Additional details:

  • There will not be DHCP involved. (that would be truly confusing)
  • I am aware that I have totally eliminated whatever security/separation I would normally have between x.x.x.* and 192.168.50.*.
  • I am not interested in accomplishing a direct link between x.x.x.* and 192.168.50.*. I am just interested in preventing endless loops, or double-delivery of all the packets.
  • My switches are unmanaged/dumb switches - except for the BVI router. The "router" is set up with BVI (similar to bridge-route). It works just like a switch, except for its dropping of packets based on source and destination IP address and port.

5 Answers 5

4

Would this result in the packet being received twice by the x.2 machine, first directly through the switch, second by way of the two routers?

No, because a switch is not a hub. A switch sends unicast packets only to those ports that have the receiving MAC address registered.

•Do you see any problems with this aside from how confusing it is, and that it would put one switch doing the work of two subnets?

No, but remember your security is as thin as it gets. Access the ports - no security. Hack a machine - no security. It works better if your switch is no totally stupid (unmanaged) and you can at least set multicast groups or VLAN settings.

4
  • If the switches were replaced with hubs, I am see what you mean that the packet would arrive at x.2 twice. But would it actually be received into the operating the first time? Or, since it is actually addressed to the NAT router, would the ethernet card skip the first time and only transfer it to the OS the second time? Jun 12, 2012 at 1:42
  • Yes, but it would still eat bandwidth and create Ethernet collision. Unless the Ethernet card runs in promiscuous mode to capture all traffic it would ignore packets it is not responsible for (by ip address and still mac address).
    – TomTom
    Jun 12, 2012 at 3:24
  • Am I correct that Ethernet collision is not an unusual phenomenon, but is just a variation of a bandwidth usage problem. Jun 12, 2012 at 14:12
  • Depends. On a switch it is totally unusualk as they are point to point full duplex with buffers in the switch for every port ;)
    – TomTom
    Jun 12, 2012 at 14:21
4

From a technical standpoint there isn't much to stop a network administrator from having two IP networks on a single L2 broadcast domain -- some administrators do it unknowingly and aren't even aware of how proxy-arp is saving them.

With your x.x.x.2 node and the 192.168.50.2 node on the same L2 broadcast domain, they will attempt local (direct) delivery for IP's within their IP network and use a configured gateway for IP addresses outside of their IP network.

While the two devices in different IP networks, but on the same broadcast domain would normally not attempt local (direct) delivery to eachother (they would instead use their respective gateways as a next hop), local (direct) delivery can be achieved with static routes on each of the nodes -- enabling them to communicate at L3 without the use of an intermediate gateway.

An obstacle that arises when running multiple IP networks on a single L2 broadcast domain exists around dynamic addressing (DHCP/BOOTP) -- as those services rely on L2 broadcasts for addressing.

Another major obstacle, as noted in other replies, is security. Man-in-the-middle (MITM) attacks, ARP Poison Routing (APR), and a slew of others are possible.

3

You're looking for what is called a "VLAN". The exact implementation depends on the switch. What a VLAN-based setup does is create separate "virtual" broadcast domains within your switch. You can separate these out however you want on the switch, or even create what is called a "trunk" that can handle multiple VLANs simultaneously on one port.

2
  • Actually, I am not really looking for anything in particular. However, maybe you can copy my diagram, and adjust it to explain how the VLAN would work? Jun 11, 2012 at 23:32
  • 1
    @GeorgeBailey It's the same diagram. Just assign ports in the private subnet to, say, VLAN 5, and the public subnet to VLAN 6. (VLAN 1 is "default", and for various reasons it's a good idea to avoid using it).
    – Hyppy
    Jun 12, 2012 at 13:12
0

Nothing wrong there as far as I can see, as long as your switch allows you to set up vlans. I've not played with unmanaged switches much and suspect this kind of set up wont work on them but I know this will work on managed switches such as a cisco 2960.

This wiki article explains VLANS in detail but this may make more sense, basically VLANs split the switch ports into seperate networks so one switch can handle different IP ranges, for example vlan 1 has the range 192.168.1.0/24 if every port on the switch is on vlan 1 then all devices connected on the vlan would need IPs on that range to work but if you introduce another vlan with the range 192.168.2.0/24 and assign it to half the ports then that half would not get traffic for the .1 range only the .2, I'm still trying to get my head round them completely but this should sum it up

3
  • How is it that VLANs would be necessary? (what are they?) Jun 11, 2012 at 23:41
  • en.wikipedia.org/wiki/Virtual_LAN explains it in detail, basically VLANs split the switch ports into seperate networks so one switch can handle different IP ranges, for example vlan 1 has the range 192.168.1.0/24 if every port on the switch is on vlan 1 then all devices connected on the vlan would need IPs on that range to work but if you introduce another vlan with the range 192.168.2.0/24 and assign it to half the ports then that half would not get traffic for the .1 range only the .2, I'm still trying to get my head round them completely but this should sum it up.
    – Chris
    Jun 12, 2012 at 17:27
  • Thank you for the brief summary. Please edit this into the answer. I think that VLANs are not necessary, but only now am I able to know what they are in the first place. Oh, and maybe someone should improve the summary on the Wikipedia page. That was actually the first place I looked when trying to get a quick overview. :) Jun 13, 2012 at 13:26
0

You could use one subnet per VLAN to create multiple broadcast domain for multiple ip ranges. And if you want to communication between those virtually separated vlans (ip address ranges) within a switch, use Router on stick and configue trunck to interface which is connected between Router n switch.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .