VLAN vs subnet: the mix-up a router can't fix

VLANs and subnets get taught together, so it's easy to treat them as one idea. They answer two different questions. A VLAN decides whose frames can reach you (Layer 2). A subnet decides who a PC believes is local (Layer 3). Nothing forces the two to match, so you can get one right and the other wrong. A router can fix one of those mistakes, but not the other.

Take four PCs on one switch. PC-A is 192.168.10.11 in VLAN 10, with gateway 192.168.10.1.

Same VLAN, different subnet. PC-D (192.168.20.14) is also in VLAN 10, so frames could reach it. But PC-A sees an address outside its subnet and ARPs for its gateway, never for PC-D. With no router, that fails. Add a router with one port in each subnet and it works, with both PCs still in VLAN 10. TTL=63 instead of TTL=64 shows the traffic crossed a router to reach a PC on its own VLAN.

Different VLAN, same subnet. PC-C (192.168.10.13) is in VLAN 20. PC-A believes it's local, so it ARPs for PC-C directly and never uses its gateway. The broadcast stops at the VLAN edge and PC-C never hears it. This is the trap, because ipconfig looks perfect on both PCs. A router can't help either: it would need a port in each VLAN, which means two ports in one subnet, and it refuses.

Edge(config-if)# ip address 192.168.10.2 255.255.255.0
% 192.168.10.2/24 overlaps with Gi0/0 (192.168.10.1/24)

The fix is to move the port into the right VLAN, or give VLAN 20 its own subnet.

One more catch. Both failures print Reply from 192.168.10.11: Destination host unreachable. That's PC-A answering itself, and the summary still says 0% loss. Read who replied, not the percentage.

One rule prevents both: one VLAN, one subnet.

Watch the trap happen in the Two departments, one switch guided build: the VLANs go in while every PC is still in one subnet.