9.5 Microsegmentation of a Network
9.5.4 LAN segmentation using routers
Remember that the LAN interfaces on routers, such as an Ethernet interface, perform both the layer 2 function of a switch and the layer 3 function of a router. Like switches, routers segment each LAN interface into a separate collision domain as shown in Figure . However, routers separate LAN and WAN segments into different networks or subnetworks (layer 3). This means that routers not only separate interfaces into their own segments, they also do not propagate (forward) layer 2 broadcast requests, such as ARP Requests, out other interfaces.

Routers interconnect different networks or subnetworks. In Figure , the router is connecting two different subnetworks, 172.30.1.0/24 and 172.30.2.0/24. The router has an Ethernet interface on each subnetwork, Ethernet 0 with the IP address 172.30.1.1/24 and Ethernet 1 with the IP address 172.30.2.1/24. The router will only forward packets from one subnetwork to the other if the destination IP address is on the other subnetwork. Because, the destination IP address is a layer 3 address, as opposed to the layer 2 addresses, the router will not forward layer 2 broadcast addresses like ARP Requests. Therefore, the router separates or segments, the network into separate broadcast domains.