I want to separate some LAN hosts for security reasons.

But most hosts need to talk to one ore more common servers: - Internet Gateway - DHCP+DNS server - file server - ...

I might define VLANs and let each server join one (or more?) VLAN.

Q: Do I need a Layer 3 switch (e.g. Cisco SG250) or is there an option to make a Layer 2 switch (Cisco SG200) work.

At least Internet Gateway has no VLAN option, so making gateway port TRUNK is no option. Same is true for most other machines like DHCP server.

I guess Layer-2 is not enough. Perhaps I could make one switch port member of multiple VLANs (?) but even if this works at least message from DHCP server (or gateway) won't get back to the hosts if they are on different VLANs.

If Layer-3 is my solution: Does this mean I have to setup a different subnet for every VLAN and build some routing rule?

  • In general, once the VLANs are setup and configured and devices are on each one as necessary, you would configure firewall rules to allow specific cross-talk between the VLANs. So if you need DNS, then all VLANs need to communicate on port 53 to the VLAN that has the DNS server.
    – Andrew
    Commented Mar 12, 2018 at 23:21

2 Answers 2


In simple words - If you would like to have multiple VLANs and talk between them - you need a layer 3 device. If that would be a switch, you would create a Switch Virtual Interface (SVI) for each VLAN, assign it an IP address and enable routing. This would be a gateway for your end devices. Each VLAN would be a different subnet.

If you'd like to go with a router, you should check Router on a Stick design. You can try to install some routing appliance or something like that if you'd like to go away from hardware solutions.

Hope that helps.

Regards, Rey


A layer 2 switch can't connect across VLANs. It can only connect edge devices to one VLAN (or to multiple VLANs with a trunk port).

You need a layer 3 switch or a router to enable inter-VLAN communication. Make sure it supports proper ACLs or firewall rules if you need to control the communication.

The Internet gateway and the clients can be on a different VLANs: the clients use the intermediate router as default gateway and that in turn uses the Internet gateway as default.

For DHCP, you can set up helper addresses on the switches (some L2 also support this) so they route DHCP requests to the DHCP server on another VLAN.

If Layer-3 is my solution: Does this mean I have to setup a different subnet for every VLAN and build some routing rule?

Exactly. Each subnet lives in its own VLAN and a router or L3 switch routes between the subnets. Rules on the router permit or deny the communication you want or don't want.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .