Can two Vlans on the same subnet

[dtom]

I thought I saw this somewhere but can't seem to find it again...

If two switches are configured with different vlans but on the same subnet:

1) Traffic will pass between the switches untagged

2) Layer 3 communication will work because the two vlans share the same subnet

Am I correct here?

Also, what would happen if two switches on diffrent vlans but on the same subnet are connected to each other?

[Joseph W. Doherty]

"And frankly it is not important whether an individual frame is tagged or is untagged. What is important is that on the trunk connection the switch is tag aware and that the switch does know what vlan the frame is associated with on the neighbor and therefore knows to what vlan it can forward the frame."

Rick, I would suggest whether a trunk frame is tagged or not is crucially important, because if the trunk frame is untagged than the switch can only presume (based on port config) the VLAN the frame should be part of (basically the same situation as for an access port).

For tagged frames, we're in 100% agreement.

[Richard Burts]

Joseph

The question we are dealing with in this discussion is whether 2 PCs can communicate with each other if connected on 2 switches and assigned to different vlans on those switches. My point was that it depends on whether the switches are vlan aware. If switch A and switch B are connected using access ports then they are not aware of what vlan a frame came from and switch B will forward any frame that it receives from switch A. If the switches are connected using a trunk then switch B is aware of what vlan a frame was associated with on the other switch. So when switch B receives a frame from switch A it knows what vlan it originated from (and knows that whether the frame is tagged or is untagged).and therefore will only forward the frame to the PC is the vlans match.

If the switch will make the correct decision whether the frame is tagged or is untagged then I believe that it is appropriate for me to have said  "And frankly it is not important whether an individual frame is tagged or is untagged".

HTH

Rick

[Joseph W. Doherty]

Rick, yes, we disagree on the situation for untagged frames on trunks.

You believe the receiving switch will be aware of the sending switch's VLAN usage, regardless of whether a frame is tagged or not. I believe that's not true.

However, if CDP is active, I recall it may complain if the two switches' native VLAN differ, but I don't recall that will impact how the port will operate.

Again, I believe an untagged frame on a trunk port means the (receiving) switch cannot identify what VLAN is being used on the other switch for that frame, also again, same as with an access port. So, if I'm correct, then it is important whether the frame is tagged or not on a trunk.

This should be easy to test on two VLAN capable switches, but at the moment, I'm not in a position to try it.

[Richard Burts]

Joseph

You are changing the focus of the discussion. The original question was whether 2 PCs connected to 2 switches and assigned to different vlans on those switches could communicate. The answer to that is that it depends on whether the switches are vlan aware. And the switches are vlan aware if they are connected by a trunk. As long as the switches are vlan aware then the receiving switch will only forward the frame if it believes that the receiving host is in the same vlan as the sending host. And that remains true whether the frame is tagged or is untagged.

You want to conduct the discussion more about the behavior of switches and trunking. In that focus I agree with you that the possibility exists for a mismatch of native vlan. If a switch has its native vlan as 2 and it receives an untagged frame it believes that the originating vlan was 2. There is certainly the possibility that on the sending switch the native vlan was 3 and a mismatch exists. On that you and I agree.  

HTH

Rick

[Joseph W. Doherty]

Rick, again I disagree, regarding changing the discussion. I believe I'm on-point, which is the two PCs can intercommunicate on two different switches, on different VLANs on those two switches, if either you connect the two switches using access ports, even though their assigned VLANs differ (here we both agree), or if you interconnect them via trunks, as long as you use the native (untagged) VLAN, even when it differs. The latter only works using the native (untagged frame) VLANs, but effectively you should obtain the same results.

i.e.

SW1:

interface faste0
desc to sw2's port fe0
switchport
switchport mode access
switchport access vlan 10

SW2:

interface faste0
desc to sw1's port fe0
switchport
switchport mode access
switchport access vlan 20

*** or ***

SW1:

interface faste0
desc to sw2's port fe0
switchport
switchport trunk encapsulation dot1q
switchport mode trunk
switchport trunk native vlan 10

SW2:

interface faste0
desc to sw1's port fe0
switchport
switchport trunk encapsulation dot1q
switchport mode trunk
switchport trunk native vlan 20

The above also assumes the PC on SW1 is on VLAN 10 and the PC on SW2 is on VLAN 20.

Or, in other words a mismatch of access port VLANs or native VLANs will obtain result.

Again, I believe I'm on-point for the OP's question. It could be I'm mistaken about how the trunks will behave, but I believe the above trunk approach, again, will work the same as the mis-matched access-port VLANs (on which we both agree).

[Joseph W. Doherty]

A follow-up, as noted earlier, I don't, at the moment, have two switches to test with, but I do have one (an old 3750G).  I setup one of the VLAN SVIs in a different VRF.  This allowed me to assign two VLAN SVIs with IPs in the same network.

Using the access port or trunk port approach, I was able to ping between SVIs in the same subnet.

As expected, CDP complained.

Using the trunk approach, STP blocked the trunk ports (configured like my prior post).  To continue testing, I enabled BPU filter on both trunk ports, and then I was able to ping between the SVIs.

[Poorya Naji]

Hi,
Now i confused, in switch port configuration, if you make a port as access port shouldn't you config what vlan it belongs? and if you didn't config it, do switch put that port on diffault vlan (vlan 1)?

[Joseph W. Doherty]

Yes and yes.

[Richard Burts]

I am sorry if someone got confused. Yes when you are configuring a switch access port you should specify the vlan, unless the port is intended to be in vlan 1. What we were discussing is the difference in behavior when switches are connected using access ports (the switch has no information about what vlan a frame was associated with on the other switch) and when they are connected using trunk ports (the switch does have knowledge of what vlan the frame was associated with on the other switch).

HTH

Rick

[Naren0007]

Yes i have done it on packet tracer

[mehdi.sadighian]

hi

the solution is "private vlan".

but some Cisco switches supports PVLAN feature, check the matrix:

https://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/10584-63.html

[mehdi.sadighian]

hi

the solution is "private vlan".

but some Cisco switches supports Private VLAN feature, check the matrix:

https://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/10584-63.html