Is there a benefit of setting up VLANs if my subnets are wired separately?

Question

I have 2 subnets within my office: 172.16.1.0/24 and 172.16.2.0/24. All devices on each subnet are wired independently from each other into the server closet. Previously each subnet had it's own switch in the closet to connect to that subnets servers. We are replacing the 2 switches with a single Dell 2816 managed switch.

Is there a benefit to setting up the switch with 2 VLANs over just letting everything pass through the switch in unmanaged mode?

My only security concern is this: 1 subnet has access to the internet while the other does not. Does setting up 2 VLANs provide additional security by helping prevent 1 subnet from accessing the other? In other words, if a computer with internet access gets hacked will it being on one side of a VLAN help prevent the hacker from accessing the other subnet?

Answer 1

If you do not configure separate VLANs the computers from one network will be able to a) communicate with, attack or b) intercept communication of computers from the other network (including access through routers to other networks like Internet).

The basics of the attacks are easy:

a) Can be simply done by setting the IP address from the other network or just adding an IP alias.

b) Can be for example done by ARP poisoning or filling the forwarding table of the switch and setting the interface to the promiscuous mode.

To be secure from this point of view you have to configure separate VLANs and have a good access-list on the router or better firewall between them.

Answer 2

Do your subnets use DHCP? One benefit to using VLANs would be to be able to provide DHCP to each subnet independently, instead of having only one DHCP server distributing both subnets. If I thought a bit more, I'm sure I could come up with other benefits to using VLANs that would make your life easier in this scenario...

In theory, keeping your two subnets completely physically isolated (air gap) by using two separate switches is going to absolutely be better for security than any other combination. However, operationally, in reality two VLANs configured on the same switch can offer the same level of pratical security.