By design or sheer dumb luck? Is configuration necessary in this case?

Question

Hey all, I saw something that stumped me for a moment today and then got me thinking.
A colleague of mine had set up a test lab at work. This was to evaluate a PIX environment, but was nothing too fancy: a couple of host pc's emulating internet-based servers, a pc emulating an internal lan machine, a machine pretending to be a host in a dmz, the pix itself, and a router pointing where necessary between them all.
Now normally, to keep this all segregated for testing purposes, I would vlan everything up, with a separate vlan for all the networks involved. Or use separate, dumb switches.
But my partner here takes an unconfigured switch with all ports up and...just plugs everything in. I am aghast, but his reasoning is that, when devices arp for the mac of the device they want to speak to, the switch will know whats on each port anyway and will forward it via the appropriate port. Which sort of makes sense... but I cant help but feel that this is too straightforward, and that the law of unintended consequences will take over.
(Oddly enough, I've discovered that this has happened in production, and I'm currently trying to debug some odd traffic thats appearing in a dmz interface on a PIX. I'm starting to wonder...)
Anyone have any thoughts? Timesaving good idea or lazy shortcut?
Cheers all,
Gar

Answer 1

Gar
I think that it is a lazy shortcut. When your colleague connected the devices this way things did work as expected. And you probably did not check to see if unexpected things would work - and they would have. If you configure a PC in a certain subnet with a default gateway and you configure other devices in other networks you expect that the PC will forward to its default gateway to get to the other devices. But the way the switch was installed the PC COULD communicate directly with any other device without needing the gateway. Since all devices were effectively in the same VLAN on the switch they were all in the same broadcast domain. In this situation every device would hear the ARP request from every other device. So the PC could have done an ARP directly for some other device, received an ARP response and begun to communicate directly.
There are reasons why we generally put things into VLANs in our network: reducing the broadcast domain being one of them, increasing security is another, and there are a number of other reasons. When you install a switch in the way that you describe you undo those things.
It was a test environment and it worked. But I certainly would not want to see you do it that way in a production environment.
HTH
Rick