Running out of (private) addresses on College LAN

[Bruce123]

Hi all,

 

We have come up against a problem, which I am sure must be fairly common, but I have been unable to find any good documentation/guides on options, and on how best to deal with it.

 

Basically, when the network at the main College site was first setup it was done using an class C IP address range (funnily enough it's not a private range, but a public one we which we no longer own and may be used elsewhere on the Internet, but that's another matter). This limits us to 254 hosts on the network.

 

Anyway, with steady expansion over the years, we now find that we are running out of IP adresses (the DHCP server was regularily running out) causing serious problems with laptops/PCs not working on the network. For the moment I have addressed this by setting the lease period to 30 minutes, and we have an autoshutdown system (primarily used to save power) to to turn PCs after 35 mins of idletime (on the logon screen).

 

But it's not going to keep things going for much longer, as there is need for further expansion (e.g. PCs and Wifi access points). We cannot deploy additonal access points, even though we have them, because it will tip the no. of IP addresses over the limit too often. So as you can see we are up against a problem. I have considered:

 

1. Changing to IP range to private/16 (e.g. 172.16.0.0) thus giving us around 65,000 IP addresses (I think). But this sounds like a big job, we'd need to change the IP addresses on all static devices, servers.
    
   
2. Setting up routing to split the network into two; but what is the best way/device to do this? We have a Netgear WiFi Controller which manages our WAPs. I wondered if we could use this to hand out a different range IP addresses to all WiFi devices. But having looked that the config/docs, I don't understand how to do it; not being very familar with VLANs. Netgear ProSafe support don't sound too sure either; one said we would definately need to plug the Netgear Controller into a physical router device.
    
   
3. We do have several routers already (to route traffic to the 3 other College sites), would it be feasible to use one of these? I'm not sure but with them being very old, their Ethernet ports may only work at 10Mbit (10BaseTX) so it may cause a bottleneck.
   

I just wish there was some simple, not too expensive, hardware device with 2-3 ports which could be used for this purpose.

 

One underlying concern with the routing option is how the other routers on the network will find out about this new subnet. Would this happen through some automatic routing discovery protocol? Can this be done by just tick a RIP tick box somewhere? Even though I think our routers use a new protocol than this.

 

Sorry this is turned out to be very long.

 

Any advice much appreciated!

 

Many Thanks,

 

Bruce.

Edited May 24, 2009 by Bruce123

[localzuk]

I think your best, and simplest, option is a new range. It's a big job, but as you say you only have a few hundred devices, it won't be that big a job.

 

Any routing etc... seems like making a simple problem into a complex one.

[FN-GM]

hanging to IP range to private/16 (e.g. 172.16.0.0) thus giving us around 65,000 IP addresses (I think). But this sounds like a big job, we'd need to change the IP addresses on all static devices, servers.

 

It depends on the subnet mask, if you use it at 255.255.0.0 you will have 65534 addresses to use. I would cansider what subnet mask you use to suite your network. Will use have that many devices on the LAN?

 

This will help - Online IP Subnet Calculator

[Bruce123]

It depends on the subnet mask, if you use it at 255.255.0.0 you will have 65534 addresses to use. I would cansider what subnet mask you use to suite your network. Will use have that many devices on the LAN?

 

This will help - Online IP Subnet Calculator

 

I was looking at a subnetmask of 255.255.0.0. We don't actually need 65K IP addresses, it's just that /16 is the next step up from a /24 range, which we are on.

 

One other reason for totally changing the range (which I didn't mention) is that some MS software considers our range as "external" to our Intranet, presumably this is because it isn't within any of the private ranges specified in RFC1918.

 

But I'd really prefere to not change range just yet, as I have a feeling that it get really complex and time-consuming, but we may have to.

 

Thanks,

 

Bruce.

[amfony]

sounds like you need to incorporate some segmentation IE Vlans IE subnets IE routing .. sorry you will need this.

 

If you are running out of IP's on a /24 network then you are only using max ~250 devices. Believe it or not this is not that many devices (as in, if you are using dhcp for clients then the static devices would probably take up %10 of your scope - therefore about 25 devices to manually configure, it could be worse!)

 

Going from /24 network to a /16 just to get more ip addresses is - what i believe - the totally wrong way to skin this cat. What you need to do is segment your clients from your servers, your Wifi Clients from your wired etc. By segmenting you increase the number of network you are actually using. Using these new networks will ofcourse increase your available IP Pool by (if /24) ~250.

 

I understand that this can be sticky (if your not comfortable with lan engineering so to speak it will be pretty tough troubleshooting) but routing/vlan-ing is the correct fix for this problem.

 

Sorry for the "bad" news.

[FN-GM]

Without changing your range for servers etc the only things you can really do are:

 

1. Shorten your lease time more

2. V-lan you network give each switch its own ip range. Keep your current IP range for devices with static addresses. You can only do this if you have layer 3 switches.

 

EDIT: beat me to it

Edited May 24, 2009 by FN-GM
extra

[amfony]

EDIT: beat me to it

 

Amfony FTW!

[garethEds]

Amfony FTW!

 

I've never dealt with setting up IP ranges. OUrs were given to us but the LEA - but would changinfthe range help your situation?

 

We use 10.180.8.1 - 10.180.15.253 on a subnet of 255.255.248.0 and it gives us a lot of addresses. I'm sure someone could tell me how to work this out (please - somebody tell me how to work it out).

 

Best wishes

 

GJE

[FN-GM]

I've never dealt with setting up IP ranges. OUrs were given to us but the LEA - but would changinfthe range help your situation?

 

We use 10.180.8.1 - 10.180.15.253 on a subnet of 255.255.248.0 and it gives us a lot of addresses. I'm sure someone could tell me how to work this out (please - somebody tell me how to work it out).

 

Best wishes

 

GJE

 

Sorry but whats the question?

[localzuk]

I understand that this can be sticky (if your not comfortable with lan engineering so to speak it will be pretty tough troubleshooting) but routing/vlan-ing is the correct fix for this problem.

 

Routing with his current range would be pointless - as he needs more addresses. So, what he needs to do is use new range(s) AND use vlans/routing. Routing on its own will make things more complex unless using a well thought out set of IP address ranges.

 

And also, he could easily go from a /24 to a /22 if he wanted... Which would give him 3 times the IPs. There would be no need to go the whole hog and use a /16.

[Edu-IT]

Sorry but whats the question?

How many addresses can he have?

[FN-GM]

How many addresses can he have?

 

ah right, he has 2046

[garethEds]

Sorry but whats the question?

 

I don't know. Been drinking. I just wondered if changing the range would help the original poster. I'd better go because we are on our third bottle of wine and this isn't good. LOLOLOL.

 

Soz people.

 

GJE

[garethEds]

ah right, he has 2046

 

Yes - I think I was asking people to tell me how to work that out.

 

GJE

[amfony]

Routing with his current range would be pointless ...

... and impossible

 

So, what he needs to do is use new range(s) AND use vlans/routing.

which is implicit (sorry for skimming over this)

 

... he could easily go from a /24 to a /22 if he wanted... Which would give him 3 times the IPs.

and expand the broadcast domain x3? Would you recommend this in any production environment?

 

Getting back on point i think that the OP has hit a critical mass on his/her network. This is the time to set things up the "right" way opposed to band aid fixes. However ofcourse its mid term (here i assume there aswell).

 

Tough situation - maybe the subnet mask change IS the right choice here for a temporary solution?

[Hacksawbob]

Class C subnet mask of

255.255.255.0

in binary =

111111111.11111111.11111111.00000000

the last range of 0 is what determines how many hosts/clients you can have in this case the final octet of zeros covers a range 255 in decimal, so 255 unique ip address, you subtract 2 as you dont use the 0 and the 255 so 253 potential clients.

 

if you have a

111111111.11111111.11111110.00000000

this equates to

255.255.254.0

this would allow one more binary position

so if you look at the host section

you cold have 1 11111111

ie 9 ones in binary which is 511 -4 this time as there are two 0 to 255 ranges so you have 507 client addresses. not enough? then steal another range for the hosts

 

 

heres a good example of custom subnetting which will give you 64 potential networks each with over 1000 clients

http://www.itdojo.com/synner/pdf/Subnetting%20by%20Colin.pdf

 

 

 

I'm getting a little rusty at this myself, and I wasn't too shiny to start with!

 

plug a laptop into that router set it to autonegotiate the NIC speed and see what it finds ie whether it is 10 or 100 mbit

 

This would be a really good time switch to using a valid private IP address range!

[srochford]

What IP ranges are used on the other sites? Are they also public IPs? How many are there?

 

Moving to a new range is hard when you have a lot of fixed IP devices (because ideally you need to change them all at the same time) but what you can do to move in the right direction is set the devices to use reserved DHCP addresses.

 

At the moment I'm guessing that you have an exclusion range in your DHCP (eg suppose you're using 195.194.12.1 - 195.194.12.255 for your addresses then only 195.194.12.21 up are used for DHCP). You identify 2-3 devices, take their addresses out of the exclusion block and reserve them for the specific MAC addresses, configure the device to use DHCP and restart it (or restart networking on it).

 

There are very few devices which can't be configured like this (I probably wouldn't put a DNS server on DHCP although it can be done). Once you've got everything using DHCP then you just change the scope on the server and wait for machines to request a new address. With a lease time set at 30 minutes you could make the change at (say) 4pm and it would all be working on the new addresses before 5pm

 

Hint: Add the reservations using netsh commands and save them in a spreadsheet. When you need to change the reservations for the new scope it's really easy to just update the commands and put in new reservations.

netsh dhcp server dc1 scope 192.168.1.0 addreservedip 192.168.1.10 00112233445566 machine.college.ac.uk

if you put the MAC, IP and name in columns A, B and C then a formula in D will generate the code and all you have to to is update column B to get the new setup.

 

Something I've not done but I think would work is to start preparing the new scope before you need it - you then just make the old scope inactive and the new one active at the change over time

 

The only thing which might make this harder is if your routers to the other sites can't cope with private addresses (eg you're using public addresses on the other sites) It's not the end of the world - you just need to change them at the same time.

[tom_newton]

I second the calls for a complete range change - using public addresses in a non-routeable scenario is asking for bother.

 

This is also a good chance to hide everything you can behind DNS - which will help moves in the future - the only thing which should ever be configured as a raw IP is your DNS server(s)

[GrumbleDook]

I second the call for a new range too, but a managed move can be done.

 

I would also go for a /22 range within the 172.16.x.x class, anything more than 1024 addresses and I would suggest you need to look at segmenting your network and having a good understanding of supernetting!

 

Depending on your existing router or your existing core switch you could actually add this new range in now, ensure your routing is correct between the two ranges and slowly migrate devices across. We have a number of primary schools in my LA who are at the limit of their existing ranges and will be given a new, larger range ... and a slow migration is going to be how it gets done.

 

It also depends how your NAT is done too ... especially if you host anything internally.

[OverWorked]

I was recently in a similar situation, but using a private class C (192.168.0.0/24) which had become full. I just moved over to a private class B (172.16.0.0/16). It was a lot easier than I expected.

 

GrumbleDook's right in that anything over about 1000 addresses and you should start segmenting, but less than that you'll be OK.

 

I carefully planned out the changes with a spreadsheet. Classify your equipment into three basic types: static addresses, DHCP reservations, and normal DHCP dynamic leases.

 

In the DHCP server, create a new scope for the new subnet. You can disable this scope until ready. In it manually create the DHCP reservation using the mac addresses from the existing scope. (I think there's a way of exporting, assuming Windows Server, the mac addresses from the old scope; but you'll have to manually paste the mac addresses into the new reservations). The majority of machines using dynamic addresses will sort themselves out when the new range becomes active.

 

For the machines with static addresses, make sure you can log on to them with a local account, if anything goes wrong and they get cut off from the network. Temporarily give them second IP addresses on the new subnet. I found that servers had a few problems at this 'changeover' stage and that they wouldn't work properly until the old IP addresses were deleted, but it wasn't anything serious.

 

When you're ready, in the DHCP server, enable the new scope and disable the old.

 

After that it's just tidying up. Watch for any software that needs to be reconfigured for the new subnet, like apps (like IE) accessing the proxy server on a new IP.

[srochford]

(I think there's a way of exporting, assuming Windows Server, the mac addresses from the old scope; but you'll have to manually paste the mac addresses into the new reservations).

 

You can use the netsh command to do both the export from the old scope and the import into the new scope - no need to do copy and paste :-)