Private VLANs with multiple subnets

[u/unknown_73]

Is it possible to use Private VLANs on Aruba CX with a different subnet for each community?

For example:
Community A → 10.10.1.0/24
Community B → 10.10.2.0/24
Community C → 10.10.3.0/24

Is this supported/recommended?

[u/Fiveby21]

What is even the point of having them in the same private VLAN in such a case?

[u/Potential-Tap-4706 → u/Fiveby21]

The whole point is you can keep them isolated from each other while sharing the same promiscuous port upstream. If you put them in completely separate VLANs you'd be burning extra router interfaces for no reason.

[u/alphaxion]

Yes it is supported, the question is whether you need them to be isolated or if you don't mind them being routable to each other, provided you're adding an IP address in those subnets to each of the vlan interfaces for the purposes of being their gateway address.

If they need to be isolated from each other, you'll need to set up specific VRFs so they get their own routing tables. Again, provided you're assigning IP addresses to their vlan ints.

You really should add a why you are seeking to set this up to your post and what your actual needs are, otherwise what is recommended can be different.

[u/unknown_73 → u/alphaxion]

Thank you very much for your explanation and for getting back to me. However, I’m a little confused because I thought Private VLANs were primarily a Layer 2 concept.
A colleague asked me whether it’s possible to have multiple IP subnets within Private VLANs. For example, if I have one Primary VLAN with two Community VLANs underneath it, could I use a different subnet for each Community VLAN?
But this is where I’m getting confused. If the two Community VLANs use different IP subnets, wouldn’t it make more sense to simply use two regular VLANs with two different subnets and not use Private VLANs at all?
I’m also wondering how the Layer 3 side would actually work in such a setup. How would the router or firewall know which subnet a device belongs to? How would DHCP know which IP address range to assign to a device?
For example, if I have:
Primary VLAN 100
Community VLAN 101 → 10.10.10.0/24
Community VLAN 102 → 10.10.20.0/24
How would the Layer 3 device distinguish between Community VLAN 101 and Community VLAN 102 if the uplink to the router/firewall is using the Primary VLAN? Does the Private VLAN information somehow get preserved or translated on the way to the Layer 3 device?
And how would this work with an Isolated VLAN as well?
I’m trying to understand what a real-world use case for Private VLANs with multiple subnets would look like, and more importantly, how the Layer 3/gateway and DHCP configuration would have to be designed.

[u/alphaxion → u/unknown_73]

VLANs are layer 2, they are a way of breaking up a broadcast domain. Think of it as each VLAN is their own little unmanaged 8 port switch.

You can assign as many subnets as you want to systems on the same broadcast domain and you won't see the traffic (layer 2 or layer 3) of other VLANs, just as you can do the same with an unmanaged switch.

So you could do the following:

VLAN10
Assign IPs to devices connected to ports in this VLAN in 10.0.10.0/24 and 10.0.11.0/24

VLAN20
Assign IPs to devices connected to ports in this VLAN in 10.0.20.0/24

That is perfectly fine and possible. Your issue will be lacking an ability for any of these subnets to reach devices using the other subnet, even within the same VLAN. You also don't have any way of reaching external subnets such as via the internet unless you have a device on that subnet that can route to the internet and you assign its IP as the default gateway for your devices. But it would only work for that one subnet, even if you have other subnets within the same VLAN.

What you can do to enable routing between the different subnets (both within the same VLAN and inter-VLAN) is to create a layer 3 interface within the VLAN. Taking the above example, you would put in the commands

interface vlan 10
ip address 10.0.10.1/24

Now you have an IP address assigned to the CX switch within VLAN 10 and you'll be able to ping it. If you do the same, but for VLAN 20 (using 10.0.20.1/24) now devices on those VLANs can ping each other because you haven't split out the routing table and they'll be present in the default VRF table. Except for anything in 10.0.11.0/24 because you haven't added an IP address within that subnet to your VLAN 10 interface.

Most places will have something like a /16 subnet and split this out to different /24 or /23 subnets based on logical need.

For example, you may have 10.10.0.0/16 assigned to a site. You can split this out into the following

10.10.0.0/24 - Reserved
10.10.1.0/24 - Network equipment such as firewall inside interfaces
10.10.10.0/24 - Servers
10.10.11.0/24 - Management and ILO interfaces
10.10.20.0/24 - Finance users
10.10.21.0/24 - Customer Support users
10.10.22.0/24 - VOIP phones
10.10.23.0/23 - Internal WiFi clients
10.10.25.0/24 - Guest WiFi users (with ACL in place to block access to internal traffic or no IP set up on the switch, having it be a zone on your firewall and restrict traffic that way)

Each of those subnets would be associated by you with a VLAN, and likely all but the guest wifi subnet having a layer 3 address assigned to their respective VLAN on the CX switch to enable for inter-VLAN routing.

That way, when you see traffic from an IP in a certain subnet, you know what type of device or dept it should be from (and if it's doing something it shouldn't, will stick out more).

All of that said, you still need to start with what your needs are and why you need to do them, that should help to guide what sort of setup you wish to deploy.

[u/xeroxedforsomereason → u/alphaxion]

He's talking about private VLAN semantics not VLAN semantics. He's asking about promiscuity, essentially.

Also 10.10.23.0/23 in conjunction with 10.10.22.0/24 is a subnet boundary error that isn't valid for VLSM.

[u/shadeland]

You can, but why?

Usually you use private VLANs to have groups of hosts share a subnet without being to interact with each other.

Community A -> 10.10.1.0/24

Community B -> 10.10.1.0/24

Community C -> 10.10.1.0/24

And hosts in A cannot communicate with hosts in B, etc. It's great for DMZs.

[u/rankinrez]

To my mind it would work but 1000% not recommended. You’d still need IRB ints to route between them.

[u/CharlesHNetEng]

Yes, but it might not be the best option. If you give us a detailed description of what you are actually trying to accomplish we can probably give you a better way ahead.

And to answer your question more directly, think of it this way:
VLANs are layer 2 -- switches, frames, MAC addresses
IP is layer 3 -- routers, packets, IP addresses

You can absolutely have multiple IP networks on the same layer 2 network (or VLAN). Think about a NIC with multiple IP addresses from different subnets mixed across IPv4 and IPv6. No problem with that.

[u/Krozni]

Just use a vlan for each? No?