Author: Ben Piper
IT folks often talk about VLANs in terms of subnets. For example, if a server has an IP address of 192.168.55.12/24, someone might say, “192.168.55.12 is in VLAN 550.” This isn’t technically incorrect. That server might well be a member of VLAN 550. But it’s easy to make the inference that the 192.168.55.0/24 subnet somehow is equivalent to VLAN 550. After all, most of us think in terms of IP addresses, not MAC addresses.
The fact is that a VLAN can be associated with many subnets or no subnet at all. It’s common for some organizations to reserve VLAN 1 for L2-only protocols like Cisco Discovery Protocol (CDP) and Unidirectional Link Detection (UDLD). It’s less common, but still possible, to have multiple subnets in a single VLAN. For instance, on a layer-3 (L3) switch you can create a switched virtual interface (SVI) in VLAN 300 with the IP 10.3.3.1/24 and subsequently give that same SVI a secondary IP of 192.168.3.1/24 using the commands:
ip address 192.168.3.1 255.255.255.0
ip address 10.3.3.1 255.255.255.0 secondary
Both subnets would then reside in VLAN 300. This would be an unusual setup, and secondary IPs are normally used only temporarily for cleanly transitioning from one subnet to another without disruption. But it’s technically valid.
Takeaway: Your switches won’t warn you if you have multiple subnets using a single VLAN. Never assume a VLAN has only one subnet. When in doubt, do a show run interface Vlan300 on your layer-3 switches to view both the primary and secondary IPs.