10

I have been learning about VLANs and I am wondering if switch can be used for communication between two VLANs.

Since switches support trunk links and already know the destination/source (VID) of the frame could they be used to send the frame from one VLAN to the other?

vlan network example

For example in this image above I was wondering why the router is needed if this switch already receives the VID of each VLAN. Why can't switch forward the frame to the targeted VLAN but needs the router to do it thus prolonging the transfer time of the frame to the router and back?

closed as unclear what you're asking by yoonix, mdpc, womble Mar 17 '17 at 0:51

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 4
    NB a tagged frame doesn't have destination/source VIDs - just one VID typically - so there's no way a switch operating purely at L2 can know if a frame is intended for a different VLAN on that basis. – psmears Mar 8 '17 at 15:14
  • 2
    If you were to "join" two VLANs together like that they'd effectively be the same VLAN. Then there's no point to using two separate VLAN IDs. – immibis Mar 8 '17 at 20:58
  • Even if they could, that would not be useful in any way I can imagine. For example, IP wouldn't work because ARP wouldn't work. There might be some protocols that would work under such conditions, but do you know of any that are widely used? – David Schwartz Mar 8 '17 at 21:05
  • @DavidSchwartz Every ethernet-based protocol would work on this. Why would ARP not work if a switch effectively joins to VLANs together? – Andreas Krey Mar 9 '17 at 18:02
  • 1
    @KostaS. Also as I said before - if you could do that with a switch then it would just be one VLAN with two IDs, so what would be the point? – immibis Mar 9 '17 at 23:28
18

L2 switches cannot do Inter-VLAN routing, since they only take care of L2 network stuff, that is, forward frames between links. If it is a L3 switch, then it can do IP protocol routing between VLANs.

  • 5
    A " L3 switch" is not a switch! It is a router. – Ian Ringrose Mar 8 '17 at 18:55
  • 4
    @Ian Whilst you are technically correct, most products listed as being a router have a limited number of ports and often act as modems too. If you search for L3 Switch, you will find the device you're looking for. – Roshan Bhumbra Mar 8 '17 at 19:10
  • 2
    @IanRingrose Technically, an "L3 switch" is a combined bridge and gateway. – chrylis Mar 9 '17 at 5:35
  • 2
    VLAN is layer 2. – Lightness Races in Orbit Mar 9 '17 at 16:59
10

VLANs are used to create different subnets which means different broadcast domains. You need to have either a router or a Layer-3 switch in order to forward traffic between different VLANs (different subnets).

  • 2
    VLAN and subnet are two different things – Lightness Races in Orbit Mar 9 '17 at 16:58
  • @LightnessRacesinOrbit Technically, you are correct. Many people do not treat them that way though. I have seen many people (including online VLAN articles) treat the topic as though the mapping of subnet-toVLAN is 1-to-1, and I think many people probably configure them that way. You are correct though; they are separate and need not line up. – Aaron Mar 9 '17 at 17:20
  • @Aaron: As such, I do not understand the at least 10 upvotes on this answer. (FWIW, in the specific telecom networks for which I develop equipment, there is no practical or assumed mapping of subnet to VLAN whatsoever.) – Lightness Races in Orbit Mar 9 '17 at 17:32
  • These 'subnets' are usually called 'virtual networks'...VLANs. But a single VLAN does not necessarily need to have the same ID on every link it is using. – Andreas Krey Mar 9 '17 at 17:44
10

Routing is a layer 3 function, while VLAN only concern Layer 2.

When a computer A want to send data to another host B, using the IP protocol it will first check if B is in the same network as himself (comparing the network portion of its own address and the destination IP address).

  • If B IP address is in the same network, A will then perform an ARP request to find the MAC address of B.
    If B is not alive or not in the same VLAN, the ARP request will not have an answer and A will not send anything else (the communication fail).

  • If B IP address belong to another IP network, then A will lookup in its routing table, found the IP address of the router C (usually its default gateway) and will send the packet to C (once again performing an ARP request to find C MAC address).

So if you don't have a router with an interface in both network you cannot have communication between two hosts in two separates IP networks.

Even if there's some kind of bridges between two VLAN (unusual but possible), or the two hosts are in the same VLAN but have IP address in different IP networks, the communication is not possible without a router, since A will not try to send a frame to B (because it's IP configuration tell it it needs a router).

Now, as other answers pointed out, if your switch is a Layer 3 switch, that means you have in one box both a switch and a router. If configured correctly, the router function of you switch will route between the different VLANs.
The main advantage of Layer 3 switches (opposed to a separate router) is that you can route between different VLANs at full wire speed (I.E. as fast as the switching process).

2

Other answers here deal with network theory, so I will not comment on that. As for actual network hardware in the real world, which is related to but different from network theory, the answer is yes. You can buy a network switch which can handle VLAN traffic.

A network switch used to be viewed as a layer 2 device, but many switches do more than that these days. Sometimes routers are labeled as a "layer 3 switch." Switches with more than just layer 2 functionality are also sometimes referred to as a "layer 2.5 switch"

  • 1
    VLAN is a layer 2 functionality. – Lightness Races in Orbit Mar 9 '17 at 16:59
  • @LightnessRacesinOrbit I could not remember for sure, as it's been years since I did any VLAN configuring. If that is the case, perhaps you should leave that comment on the other answers here since the top rated answers all contradict your comment here. Actually, hold on a moment... the entire point of a VLAN is that it is a separate network hence layer 3. Are you sure it's a layer 2 thing? Still, either way, your comment is better left on the higher rated answers. – Aaron Mar 9 '17 at 17:17
  • @Aa​​​​​​​​​​​​ron: I did leave that comment on the other answers; you even replied to one of them! And, yes, I am sure. VLAN tags are inserted into Ethernet frames. – Lightness Races in Orbit Mar 9 '17 at 17:33
  • @LightnessRacesinOrbit I see a comment by you only on one of the other answers, the one I responded to, and that was a different comment. "VLAN = L2" and "VLAN != subnet" are different comments. I agree with you that "VLAN != subnet." I'm not so sure about your "VLAN = L2" though. I suppose that depends on what your definition of "is ... functionality" is, though specifically in regards to the original question at hand, the question is talking about layer 3 functionality. At least, that's how I read the question: routing between networks (and a VLAN is, logically anyway, just another LAN). No? – Aaron Mar 9 '17 at 17:46
  • "'VLAN = L2' and 'VLAN != subnet' are different comments" The underlying point I am making is precisely the same - that answers discussing Layer 3 technology entirely miss the mark. Not sure why you're getting so hung up on where and when I'm commenting, tbqh. – Lightness Races in Orbit Mar 9 '17 at 17:47
1

Funnily this isn't supported by VLAN switches - you can't configure them to connect, say, VLAN3 on port A to VLAN5 on port B.

You could hack this by using two ports, configure one to have VLAN3 untagged, and the other VLAN5 untagged, and then connect them with a cable. (Didn't try this, but don't see why it shouldn't work.)

  • @Andreas_Krey Umm... are you sure? You cannot route between two networks? VLANs are just virtual networks (hence the name), and you can route between them same as you can any other two networks. Perhaps we are hung up on semantics, as is evidence by the difference between network theory and real world network hardware, as others are in this thread. – Aaron Mar 9 '17 at 17:29
  • @Aaron Routing is something different, I'm (and proabably the Q as well) talk about having different (and potentially multiple) VLAN ids for the same VLAN on different ports. – Andreas Krey Mar 9 '17 at 17:52
  • @Andreas_Krey Perhaps. I just reread the Q and I can see how you can read it differently than me. What I see is "could they [switches] be used to send the frame from one VLAN to the other". I see this as a question where the asker just isn't viewing VLANs logically as "just another LAN" and is asking if he can route between them with a switch. I could be wrong. – Aaron Mar 9 '17 at 18:05
  • Your hack would work if, and only if, you either disable STP or have a device that does VLAN aware STP. Naive STP type implementations are going to go "omg, network loop, must kill it before it kills me". I discovered this the hardway when doing work involving cisco routers, bridges and vlans. – Kaithar Mar 9 '17 at 20:53
1

If I'm interpreting this correctly, you want a switch that receives a frame with VLAN 5 (for example) to forward it with VLAN 6.

This would be pointless. Instead of doing this you could simply take all your devices that use VLAN 6 and move them to VLAN 5 instead.

Because it's pointless, switch vendors didn't add any way to do it.

-1

Intra-VLAN traffic is forwarded between mac addresses of the VLAN network. For a "frame" to leave that network, it must be forwarded to the mac address of a routing capable device. This can be a switch, firewall, or router. So if a frame from VLAN A wants to reach VLAN B, VLAN A will send the frame to the mac address of the default gateway, VLAN B will do the same. If those gateways are on a switch, then the switch is routing packets between the vlans, same for a router. You may want to use a firewall, however, if you need to control access back and forth between the vlans.

In the modern world: Think of switches as routers with a lot of ports. Think of routers as switches with less ports, but higher availability. Think of firewalls as routers that can support higher layer services, like intrusion detection, antivirus, SSL proxy, application services, NAT, etc.

Not the answer you're looking for? Browse other questions tagged or ask your own question.