Re: Different terms for the same or more secure?

["Brian Loe" <knobdy () gmail com>]

On 8/31/06, Isaac Van Name <ivanname () southerlandsleep com> wrote:
> >>If its physically subnetted then there's a router between the subnets.
> >>Logically seperated subnets, I suppose, would be vlaned subnets
> >>(virtual being logical - not real/physical).
>
> Right, router separates subnets because switches send packets out of a
> subnet into a router, and then out from there.  Not really understanding the
> "vlaned subnets" phrase, though, considering the following excerpt...

I guess I meant a subnet created with a VLAN - an attempt to go along
with the word choices of the original poster.


> >>The only thing a VLAN does is break up broadcast domains. Subnets, on
> >>the other hand, are controlled and limited by your IP addressing
> >>scheme - and provide nothing, a router or other such device (firewall
> >>for instance) is divide them up.
>
> If a VLAN breaks up broadcast domains, then what is a vlaned subnet?  Not to
> be picky about phrasing, but "logically separated subnets" in this instance
> would be simply "vlaned LANs".  But, then we get into the whole thing about
> exactly what a VLAN does... and, it seems to me, a VLAN does not break up
> broadcast domains.  A router does that.  A VLAN creates a broadcast domain
> on a switch that contains a collision domain... but the VLAN is not part of
> the collision domain.  What separates a switch's collision domain and a
> VLAN's broadcast domain?  About 3 hops.  :-P  Joking... VLANs are
> fascinating in that they defy normal networking logic to bring you an
> alternative that fits situations that defy (some) networking logic.

VLANs seperate broadcast domains only. A broadcast does not traverse a
router - unless its told to pass them (DHCP over WAN links for
instance). On a switch, each port is its own collision domain, unlike
a hub.

>  It separates IP addresses like a subnet,

No, your subnetting (IP Addressing) scheme does that.

> but isn't a collision domain.

Collision domains are a physical layer issue, I *believe* and has
nothing to do with upper layer protocols (like VLANs).

>  It contains its own broadcast domain, but is
> adjacent to a collision domain and doesn't have to get "routed" from a
> router to a switch to do so... because it's based off of the switch.  A VLAN
> uses a trunk line to have traffic directed to it as if it's a router.

Trunk lines allow the switch to pass multiple VLANs across the same
port. If you define a VLAN to a switch you almost always have to have
a trunk line connecting that switch to a router (unless you're in a
chassis with an MSFC) since, in the Cisco world anyway, you always
have vlan1 and you don't want to use it for your normal traffic.

> I can't think anymore... I need coffee.  If I misrepresented any particular
> piece of information, please feel free to correct me; I learn the same way
> everyone else does.

I hear ya...

---------------------------------------------------------------------------
This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence 
in Information Security. Our program offers unparalleled Infosec management 
education and the case study affords you unmatched consulting experience. 
Using interactive e-Learning technology, you can earn this esteemed degree, 
without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------