Hi Sundar. We answered simultaneously, and gave the same answer :)

Thanks for the reply.

All braches are configured the same.

When I do a "sh vlan" I see the different ports showing up in the differnet VLANs, but the IP Addresses are all in the same subnet for that branch.

If a host connected to vlan 3 is using an address from vlan 1's IP scope then that user on vlan 3 wouldn't be able to talk to hosts outside of vlan 3. Are those hosts able to talk to hosts on other VLANs?

Let's say you have the following setup then the host connected to vlan 1 would use an address starting with 192.168.1.x and the vlan 3 host would use an address from 192.168.3.x subnet for inter-vlan routing to work. The default gateway for those hosts would be the router/L3 switch's respective interface address.

int f0/1

vlan 1

int f0/3

vlan 3

int vlan 1

ip add 192.168.1.1 255.255.255.0

int vlan 3

ip add 192.168.3.1 255.255.255.0

HTH

Sundar

Sorry, but I am a doofus,

The router is configured with subinterfaes and the switch is trunking VLANs 1,2 and 3.

I didn't see that before, you are completely correct as always.

But this brings up a questions about VLANs in general:

Is is considered an ok practice to have one switch located in the DMZ say, and on the switchbe running only layer 2 VLANs.

Would it be considered ok from a security perspective to have DMZ, outside and inside networks on the same switch as long as they are seperated by VLANs?

No physical isolation but layer 2 VLAN and no inter VLAN routing.

Is that acceptable, or better to isolate the DMZ from outside and inside with seperate switches?

Thanks.

Wilson,

Good questions.

See the responses inline.

""Is is considered an ok practice to have one switch located in the DMZ say, and on the switchbe running only layer 2 VLANs.""

That's perfectly OK.

""Would it be considered ok from a security perspective to have DMZ, outside and inside networks on the same switch as long as they are seperated by VLANs?""

Actually this isn't a recommended security design as it can potentially expose the more trusted side to attacks from the less trusted side. A good security design should have physical separation of networks according to the trust level.

""No physical isolation but layer 2 VLAN and no inter VLAN routing.""

If there's no physical isolation then this setup is at the least recommended.

""Is that acceptable, or better to isolate the DMZ from outside and inside with seperate switches? ""

As stated above if possible then physical separation is a better security design.

HTH

Sundar