Extending our current ip range

[dsk]

Hello all. Ive had a look through similar topics but still hitting a few problems so was wondering if I could pick your lovely brains.

 

We basically have two vlans and are currently running out of IP addresses (well actually we have more machine/devices) on our curriculum network and we're planning to make sure we have enough for around 2000 machines.

 

Our curriculum subnet is 255.255.254.0/23 (class a) - 510 already maxed out.

 

Our admin subnet also 255.255.254.0/23 (class a).

 

Now im not sure if i understand this correctly, but considering we have two vlans to accomodate both networks (admi 10.64.90.xx range - curri 10.64.92.xx range) would there be problems if we just used a subnet of 255.255.248.0?

 

Sorry if this seems very n00bish. Any help appreciated. Ta!

[krb548]

Are you using Server 2003?

I am also looking into this idea. We use a 255.255.252.0 subnet and have approx 1000 IP's to use but we are finding out that we are close to running out.

 

I have been looking into super netting.

From what I can see you can create a supernet and combine ranges together. I use 192.168.0.? - 192.168.3.255. I want to extend the range up to 192.168.9.255.

 

I have also been struggling. Any ideas would be great, other wise I may have to do it the old fashioned way and change my subnet and re-build all my devices. That method seems a bit long winded.

[dsk]

haha, yes sorry, i should have said, we're currently on Sever 2003, non R2.

[Theblacksheep]

Are you doing the routing? or is it done externally?

[dsk]

Routing is all internally as far as i know (but im not too sure). Thanks!

[powdarrmonkey]

You should find out, you're going to need to work with it.

[srochford]

In principle, there's no problem with extending the range. The problem comes with routing - something, somewhere, needs to know how to get back to your IP range.

 

If all your machines connect to the internet via a proxy then I think the only thing you're going to have to change is the DHCP settings (easy) and then any systems with fixed IPs.

 

If you have a default gateway that takes you out to the internet then the router will have to be adjusted so that it knows the new addresses are part of your range.

[matt40k]

2000 machines?!? Nuts... DCSF\Becta reckon 2010 for 1:4 student\computer ratio (i think). 8000 kids? NOOOOOO the nightmare

 

Who said to use admin range 10.64.90.0/23? They would be the first port of call of getting more IPs. Next step, how to do it.

[FN-GM]

If you change your subnet mask 255.255.248.0 you will have 2048 addresses. If you want to allow more you can use 255.255.240.0 that will give you nearly 4100 addresses.

 

This site may be helpful - Online IP Subnet Calculator

[browolf]

is there much of an overhead on using 255.255.0.0? what we use so we can give different rooms different subnets.

[SYNACK]

is there much of an overhead on using 255.255.0.0? what we use so we can give different rooms different subnets.

 

Depends on how many workstations you have using it. The main reason to subnet is to isolate broadcast frames which are sent to get things like DHCP, problem is that these are sent to every single machine on the network and so if you have enough machines the whole system will grind to a slow stop as it is inundated by croadcast frames. IP subnetting means that the broadcasts are isolated into that subnet as the router will not foward them.

 

You can use that subnet easily but if you end up with too many hosts you man need to subnet back down again to keep the network stable and speedy.

[powdarrmonkey]

is there much of an overhead on using 255.255.0.0? what we use so we can give different rooms different subnets.

 

If you mean 192.168.1.x/16, 192.168.2.x/16, etc, these aren't different subnets, just logical (to a human) boundary points within one subnet. If your mask was /24 (255.255.255.0) then they would be.

[browolf]

Depends on how many workstations you have using it. The main reason to subnet is to isolate broadcast frames which are sent to get things like DHCP, problem is that these are sent to every single machine on the network and so if you have enough machines the whole system will grind to a slow stop as it is inundated by croadcast frames. IP subnetting means that the broadcasts are isolated into that subnet as the router will not foward them.

 

You can use that subnet easily but if you end up with too many hosts you man need to subnet back down again to keep the network stable and speedy.

 

we have in the region of 700 machines. all on 255.255.0.0, how many is too many?

[SYNACK]

we have in the region of 700 machines. all on 255.255.0.0, how many is too many?

 

Depends on the systems that you are running and their usage patterns. Chuck wireshark on a pc and see how much of your traffic is broadcasts especially at the start of the day when everything is powered up. The other thing to remember is that a single faulty nic spewing broadcast frames will take down all of those hosts in one hit, if it was subnetted then the others would be isolated. Some switches now do have packet throtoling which alleviates the problem but will not solve it.

 

I would probably be looking at 1000 as a high end margin for a school setup, not a wise one but one that is workable. Personally I prefer to keep my subnets down below 500 devices or even less given the usage pattern and hardware. I am lucky though to have cisco 3750 gear in the core at some schools which has layer 3 switching ability which effectivly removes the latency penalty and bandwidth constraints imposed by lesser routing methods.

[dsk]

Yep, all our machines connect to the net via proxy.

 

Whos idea for the admin range? (the old manager - who didnt have much scope ).

 

Ive tried deleting the scope and attempted to make a new one wit the subnnt of 255.255.248.0 (2048) which should suffice, but the range begins at 10.64.88.0 which would overlap the admin range (and where ai start to worry as its only separated by vlan).

[oldbaritone]

It's a little (okay, a lot) complicated, but to determine what's a "local" address to you, XOR the destination against your own address (i.e. find out what bits are different) and then AND that result with the net mask. If the result is zero, it's a local address; if not, send the request to your gateway.

 

dsk, in your case, a student, let's say 10.64.92.123, tries to access an admin server at 10.64.90.1: (It's a lot easier to see this in Hex)

0A.40.5C.7B (student IP 10.64.92.123)

0A.40.5A.01 (admin IP 10.64.90.1)

00.00.06.7A (result of the XOR - just an intermediate result)

FF.FF.FE.00 (255.255.254.0/23 Net Mask - AND against the above)

00.00.06.00 (result is nonzero, so dest is non-local and request goes to gateway)

 

Now, do the same thing with the 248.0/21 Mask:

0A.40.5C.7B (student IP 10.64.92.123)

0A.40.5A.01 (admin IP 10.64.90.1)

00.00.06.7A (result of the XOR of the first two)

FF.FF.F8.00 (255.255.248.0/21 Mask - AND with above)

00.00.00.00 (result is zero, so request is local and direct communication is used)

 

In the first example, the request will be sent from the curri address to the gateway, which probably has IPsec rules to block traffic between the subnets. End result, the student in the curri subnet can't get to the admin server.

 

In the second example, the request will be processed directly between the two clients. There will be no gateway involved in the request, so the student will be able to communicate with the admin server. This amounts to plugging all of your students onto the admin subnet - probably not a good idea.

 

My suggestion would be to move one subnet farther away from the other subnet - at least to 10.64.128.xx if you can. The RFC1918 subnet reserves ALL of 10.x.x.x, so you might even want to look at moving the subnet block even farther - like 10.65.x.x, which would give you 65,535 addresses for each subnet. I'd guess it's probably easier to move the curriculum subnet, which is probably straight DHCP? Then you can have more space (i.e. use the 255.255.248.0/21 mask, or go to 255.255.240.0/20 - you can even go all the way to 255.255.0.0/16) without combining the subnets.

 

krb548 - your "supernet" is really the same thing, the other way around. The "standard" subnet for 192.168.x.x is 255.255.255.0, which gives each client direct access to any address that has the same first 3 numbers in the IP, or a subnet of 254 addresses. Your "supernet" is just a larger mask access for local communication.

"Good news-Bad news:" You're not going to be able to expand to 192.168.9.x, because that doesn't work in Binary/Hex.

Your choices will be:

192.168.0.? - 192.168.0.255 (Net Mask 255.255.255.0)

192.168.0.? - 192.168.1.255 (Net Mask 255.255.254.0)

192.168.0.? - 192.168.3.255 (Net Mask 255.255.252.0)

192.168.0.? - 192.168.7.255 (Net Mask 255.255.248.0)

192.168.0.? - 192.168.15.255 (Net Mask 255.255.240.0)

(the Binary/Hex is left as an exercise for the student...)

 

;-)

 

(Tech note: some 192.168.x.x routers may have troubles with the ".0" and/or the ".255" addresses because they don't handle the subnet properly according to the spec. I'd suggest avoiding ".0" and ".255" address assignments in the 192.168 block because of addressing problems in cheap routers. And the "supernet" may or may not work in 192.168.x.x for the same reason - If it doesn't, go to either the 10.x.x.x subnet, or the 172.16.x.x-172.31.x.x subnet, which are also reserved addresses as specified in RFC1918)

[Jay]

For info:

 

Our supplier informed me that CISCO recommended broadcast domains of no more than 1024 hosts.

[oldbaritone]

Good point, Jay.

 

The previous posts were wanting 2,000 - 4,000 or more addresses in a subnet. Certainly by the time the address space has gotten that large, it's time to move away from flat topology and subnet the address space (like admin or curriculum) into smaller broadcast domains, like department or building or dorm.

 

My explanation was about mechanics of the protocol, and certainly was not a recommendation to make domains that large. But if someone insists on being foolish, that's their prerogative.

 

Thanks.