IP addressing scheme feedback wanted

[actech]

Hi,

 

My head office is looking at changing our IP address scheme to suit a proposed WAN rollout next year. I have attached a spreadsheet with the proposed scheme and I would appreciate any feedback.

 

Thanks

Rowan

Site Block Template 1 3.xlsx

[featured_spectre]

Ok from what I can see, it looks generally sound, but why not allow for scope?

 

I would do this (example IP scheme)

 

Routers and switches - 10.1.1.3 - 10.1.1.250

Servers - 10.1.2.3 - 10.1.2.250

Wireless - 10.1.3.3 - 10.1.3.250

Printers - 10.1.4.3 - 10.1.4.250

Special Workstations - 10.1.5.3 - 10.1.5.250

IP telephone system - 10.1.6.3-10.1.7.250

Misc - 10.1.8.3 - 10.1.8.250

 

This allows for massive scope, will all work on your subnet range (if i am not mistaken) and will allow you to expand or use up other IP addresses if the need arises.

 

 

Reason 10.x.x.1, 10.x.x.2, 10.x.x.251, 10.x.x.252, 10.x.x.253, 10.x.x.254 are not used, is you never know if you need a few over lapping IP addresses.

[rosswilson]

Reason 10.x.x.1, 10.x.x.2, 10.x.x.251, 10.x.x.252, 10.x.x.253, 10.x.x.254 are not used, is you never know if you need a few over lapping IP addresses.

 

Nephilim, could you expand upon this a little please? I am in a similar position to actech and i'm intreiged by your mention of "over lapping IP addresses". What do you mean?

 

Sorry for slightly hijacking your thread actech, but hopefully my question is something that crossed your mind too

 

Many thanks,

 

Ross

[CyberNerd]

Sorry, this makes no sense to me

How do you come up with a 32bit subnet mask?

 

Routers and switches - 10.1.1.3 - 10.1.1.250

Servers - 10.1.2.3 - 10.1.2.250

Wireless - 10.1.3.3 - 10.1.3.250

Printers - 10.1.4.3 - 10.1.4.250

Special Workstations - 10.1.5.3 - 10.1.5.250

IP telephone system - 10.1.6.3-10.1.7.250

Misc - 10.1.8.3 - 10.1.8.250

try using a subnet calculator.

Online IP Subnet Calculator

 

Best to lump printers and severs into the same vlan, and separate workstations geographically.

[featured_spectre]

cybernerd, I day say, if i'm not mistaken, i am happy to say that i have been proven wrong.

[CyberNerd]

I uploaded our network VLAN topology.

 

The 'B' class network for servers is historical. not got around to re-addressing them all yet!

network topology.pdf

[mjs_mjs]

i'm likeing the student vlan id 666, little devils.

[mjs_mjs]

our network is smaller than most of yours and we have 1022 possible addresses, all on one subnet, about 500 actual machines - what improvements could i make to speed things up? (we just have installed a hp540something vz switch if that helps)

[actech]

Thanks for the feedback. I understand what you mean about scope nephilim, but this is the result of talking to all the techs in our diocese. The chances of anyone filling all of the ranges set aside for different functions is minimal (it went on the highest current numbers +75%). The chances of some schools having over 400 pc's is the more likely scenario at this stage.

[CyberNerd]

our network is smaller than most of yours and we have 1022 possible addresses, all on one subnet, about 500 actual machines - what improvements could i make to speed things up? (we just have installed a hp540something vz switch if that helps)

 

We only have circa 700 machines - but created much larger vlans to allow for scalability.

Consider 500 machines in one network - every machine will send broadcast packets (arp,dhcp etc) to every other machine on the network, which they will need to process to see if the packets are for them. Creating VLAN's of say 100 machines in each network will cut this traffic by 1/5th and provide security between the different networks. HP/3com have very good documentation on vlans, it would mean setting up the core switch as a layer 3 router, tagging the ports attached to the edge switches with a vlan id, setting up the edge switches to be in those vlans and setting up appropriate dhcp scopes.

[mjs_mjs]

ahh, so it would mean that broadcast stuff like WOL couldn't be sent accross the network?

[CyberNerd]

not normally, but some switches can be configured for directed broadcast of WOL traffic

[cbrasga]

First recommendation, get away from the 10.x.x.x network. Unless you see yourself ever coming close to using 16,000,000 addresses or need an obscene amount of networks, go with a Class B (172.16.0.0 - 172.31.255.255). Most 10.x.x.x networks never even scratch 1% of the IP address allocation. People use that network as the lazy way to never run out of addresses, rather than taking time to plan a logical network(s). A 10.x.x.x network can take days to scan if you ever feel like discovering/auditing your network resources. Additionally, I see A LOT of organizations go with a the 10.x.x.x networks, so if your company/school connects or merges with another organization/network which coincidentally runs on a 10.x.x.x, you will run into conflicts/routing issues.

 

Second, broadcast domains used to be a big issue back in the day because every broadcast needs to get processed by the CPU. With today's powerful CPUs it is hardly an issue, but that is still no reason not to run a clean network. I would recommend no larger than 512 nodes per network segment. So VLANs are your friends.

 

I agree with your allocations beginning with Static IPs first then Dynamic IPs.

Personally, I would setup ranges for your devices, for example .20-.49 for switches, .50-.69 for servers, .70-.99 for wireless. It makes IDing IPs/devices easier rather than having to reference a list because the device type changes at a random number.

I'm also a little surprised you didn't include any spares for your "General Purpose Servers".

 

Lastly, don't you mean the IP will being using a /24 mask rather than /32? Unless you're using the mask to specifically identify the IP address itself in the list.

 

Just my 2 cents.

 

Also, if you want to fly me out to Australia I'd be happy to help you with the project.

Edited September 17, 2010 by cbrasga

[mjs_mjs]

not normally, but some switches can be configured for directed broadcast of WOL traffic

 

bummer - alot of our software (rm and tutor) use broadcasting....

[rosswilson]

First recommendation, get away from the 10.x.x.x network. Unless you see yourself ever coming close to using 16,000,000 addresses or need an obscene amount of networks ...

 

I think he is proposing to use the a /21 network mask for his subnets. It just so happens that he has chosen to use the 10.x.x.x IP address format. So the quote above is not strictly true; yes 10.x.x.x subnets do exist and they commonly have a /8 subnet mask, but in this case the OP has chosen differently.

 

A /21 subnet mask would allow up to 2046 devices on one subnet. However, I do agree with you that it remains good practice to keep to the 512 devices per subnet rule.

 

Ross

[cbrasga]

I think he is proposing to use the a /21 network mask for his subnets. It just so happens that he has chosen to use the 10.x.x.x IP address format. So the quote above is not strictly true; yes 10.x.x.x subnets do exist and they commonly have a /8 subnet mask, but in this case the OP has chosen differently.

 

A /21 subnet mask would allow up to 2046 devices on one subnet. However, I do agree with you that it remains good practice to keep to the 512 devices per subnet rule.

 

Ross

 

I understand he will be subnetting the 10.x.x.x network, but I would still stay away from using a Class A network unless there will actually be a need for it. Even with subnetting it is a waste of a Class A network because it will be extremely underutilized. Use a Class B network.

[rosswilson]

I understand he will be subnetting the 10.x.x.x network, but I would still stay away from using a Class A network unless there will actually be a need for it. Even with subnetting it is a waste of a Class A network because it will be extremely underutilized. Use a Class B network.

 

But if he is subnetting his network with a /21 subnet mask then the whole concept of Class A, Class B, and Class C networks disappear. What was once referred to as a "Class A" network is simply a subnet with a /8 subnet mask. The concept of Class ABC networks was before CIDR subnetting was introduced.

 

Quote from Wikipedia:

 

Classful addressing is obsolete and has not been used in the Internet since the implementation of Classless Inter-Domain Routing (CIDR) starting in 1993. For example, while 10.0.0.0/8 was a single class A network, it is common for organizations to divide it into smaller /16 or /24 networks.

 

A classful network is a network architecture used in the Internet until around 1993. It divides the address space for Internet Protocol Version 4 into five address classes. Each class, coded in the first four bits of the address, defines a different network size (number of hosts), or a different network type (unicast or multicast).

 

Maybe I am interpreting you wrong, but how will the OP be "extremely underutiliz[ing]" this "Class A" network?

 

Ross

[cbrasga]

To put it into a simple physical analogy, lets say the network addressing space is a piece of land and a subnet is a house. You can build 10 houses on a 16,000,000 acre piece of land and even though each house is self-contained and cozy, it's a waste of land for just those 10 houses.

 

I'm coming from the arena of having a logical and orderly network. Why use a class A if you're subnetting down to only a few networks or hosts?

[actech]

There is a need for the 10.x.x.x subnet. Eventually all of the schools in our diocese will be connected by a WAN so there will be thousands of devices within the range. The range at my school will be 10.208.48.0/21, which is excessive, but the reasoning for giving such big scopes for particular devices is so that if I had to go to another school I know roughly what the possible ip of a device could be.

 

PS you're welcome to come and help, but you would have to pay your own way sorry

[rosswilson]

Thanks for the good analogy I was trying to come up with one earlier too.

 

But what real "waste" is there in using the 10.x.x.x IP range? After all, the whole 10.x.x.x IP range is private. By choosing to use 10.x.x.x instead of 192.168.x.x or 172.16.x.x just means actech has a lot more IP addresses to play with (3 octets) ... and it would seem he will need a fair few IPs if all his other schools are to be connected onto the same LAN/WAN/MAN.

 

10.0.0.0 - 10.0.7.255 would be his first subnet, then 10.0.8.0 - 10.0.15.255 would be the second and so forth. 10.255.248.0 to 10.255.255.255 would be his last subnet.

 

By using the 10.x.x.x private address range actech can have 8192 (/21) subnets. If he had used 192.168.x.x he only has two octects to play with, thus reducing the amount of (/21) subnets he can have to 32.

 

Ross

[cbrasga]

I'm simply advocating, right sizing an organization's network (not subnets, the whole network). With a /21 on a 10.x.x.x network that accommodates 8192 networks with 2046 devices per network. So if the organization is going to come close to using 8,000 subnets (including room for growth) then go ahead and use a 10.x.x.x network. If an organization will have closer to 30 subnets, which is more realistic, then use a 172.16.x.x /21 allowing for 32 networks and 2046 hosts per.