Need help getting to grips with subnetting

[Kyle]

I am trying to get my head around sub-netting but not doing very well. Every time i look at examples in books and online i get in a mix. I can only really understand it better when it is relating to ip address ranges i am used to working with.

 

I am mainly keen to find out about what to do when you use up all the ips in your range. So if you have for example 1000 ips to dish out what happens when they are all used up and more clients need address?

 

Would some one be so kind and offer me help please to get my head round this bloody thing.

[webman]

I've found these very helpful - Firewall.cx and LearnToSubnet.com.

[Geoff]

Presumably your doing your CCNA exams, thus you just need to work out subnet masks from bit masks?

[SimpleSi]

Do you want to give us some numbers to talk about e.g. current ip range and network mask?

 

regards

 

Simon

[limbo]

Having recently run out of IP addresses in the subnet allocated to me by the LEA I know exactly what you have to do.

 

You get a second subnet or a bigger subnet.

 

A subnet makes a lot more sense when you convert the subnet mask to a single binary string - then you will find it will be a list of 1's then 0's. The number of 1's can vary (and therefore obvisouly the number of 0's) but they are never mixed so:-

 

11111111111111111111111100000000

 

or

 

11111111111111111111111111100000

 

But never

 

11111111111010011100111001010010

 

So my current subnet mask here is 255.255.252.0 which converted to binary is

 

11111111 11111111 11111100 00000000

 

So my first 22 digits are 1's and the remaining 10 are 0's

 

If you then converta any IP address in my subnet then you would see that the first 22 digits are identical to each other and the only digits that ever differ are the last 10. This is because the first 22 digits identify the subnet that the IP address lives in as determined by the subnet mask.

 

As you only have 10 binary digits with which to create your unique ip addresses for you PC's then you are limited to 1024 (in reality it would not be 1024 as some IP addresses have specific roles in the subnet - but do not worry about that at this stage)

 

In order to have more IP addresses you need to use more than 10 binary digits - so using 11 binary digits would give you 2048 unique IP addresses which would mean a different subnet mask where the last 11 digits were 0's and therefore only the first 21 digits can be used to identify the subnet which in turn means there are less subnets available.

 

A subnet allowing 2048 IP address would be

 

11111111 11111111 11111000 000000

 

or

 

255.255.248.0

 

At least - I think that is the way it works!!

[apeo]

I didnt think the LEA could extend the range that is given to a school, only give another range. If they could extend the range, surely that means 1 of 2 things. The LEA has a larger range for each school but only assigns part of it or reassign everyone.

[Geoff]

Indeed, it would depend how they do their capacity planning (or lack of it).

 

However having two subnets compared to just one has a performance implication. Your router(s) must route traffic between the subnets. Although I believe you can avoid this by pushing out a static route setting with DHCP as an option in your leases.

 

Another alternative would be to use a NAT firewall at your border and use a private IP range on your network.

[petectid]

I am trying to get my head around sub-netting but not doing very well. Every time i look at examples in books and online i get in a mix. I can only really understand it better when it is relating to ip address ranges i am used to working with.

 

I am mainly keen to find out about what to do when you use up all the ips in your range. So if you have for example 1000 ips to dish out what happens when they are all used up and more clients need address?

 

3 Com publish a good document on understanding IPv4 addressing, it covers CIDR and VLSM these are areas you need to look at you will find it here

[strawberry]

limbo-- great answer!, many thanks, should come in useful as i wans't really sure of it either.

[tscnmuk]

Having recently run out of IP addresses in the subnet allocated to me by the LEA I know exactly what you have to do.

 

Just out of curiosity how many IP addresses did your LEA assign you? We have been given loads more than we will ever need.

 

Tom

[apeo]

1022 here. We deal with the issue of running out of ip addresses by setting up appropriate lease times and for the most part that works. If our network increases anymore then we would have to look at what Geoff has mentioned and create our own private network (easy enough to setup).

[Geoff]

The CIDR article in Wikipedia is a good starting point as well.

 

http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing

[djm968]

Another alternative would be to use a NAT firewall at your border and use a private IP range on your network.

 

 

This is by far the best option and it also adds an additonal layer of security but you must remeber that acces to any device on your LAN behind the firewall will require "double natting"

[Geoff]

This is by far the best option and it also adds an additional layer of security but you must remember that access to any device on your LAN behind the firewall will require "double natting"

 

Personally I would use a DMZ . I have talked about this kind of setup previously.

 

http://www.edugeek.net/index.php?name=Forums&file=viewtopic&p=69060#69060

 

The diagram in the post illustrates my preferred setup for a DMZ (even though in that context we're not discussing them).

[limbo]

Sorry - been away short listing for the last couple of hours so just catching up.

 

Our subnet is 255.255.252.0 so we have around 1000 IP addresses. The LEA have a few for routers, proxy servers VC equipment etc. and then we have a lot of laptops (couple of hundred) that switch between being docked with a hardwire and then roaming on wireless which double the number of IP addresses the laptop uses.

 

The problem was most noticeable when we were setting up new equipment in parallel to the equipment it was going to replace - hence there being an extra couple of hundred machines on the network. We also have a few wireless PDA's just to add to the volume.

 

The lease is cut right down to a couple of hours but still get the odd problem until we can do the swap.

 

The LEA are providing us with a new, larger subnet. We toyed with the idea of a seperate internal subnet with a router or likewise acting as a gateway between the two - but in the long run it is not going to be a huge job to transfer over to a new range as most of our kit is DHCP anyway - just the servers and printers to swap over.

[bazuk]

i would download a subnetting calculator so save you from getting a migrain

 

baz

[ICTNUT]

I have been looking into thisone myself as I am about to change the IP layout at the school to build in some extra scope:

 

An IP subnet mask of: 255.255.248.0 would give you 2048 IP addresses based over 8 host networks i.e.:

 

192.168.1.0 - 192.168.2.0 - 192.168.3.0 - 192.168.4.0 - 192.168.5.0 - 192.168.6.0 - 192.168.7.0 - 192.168.8.0.

 

What you need to remember is that 192.168.0.0 and 192.168.0.8.255 can not be used so you only have 2046 IP's available.

 

This knid of setup is really good if you wish to "assign" IP's to specifc kit or VLANS.

 

We run VLANS in my school and the plan would be to do something like:

 

192.168.1.0 - Servers/Switches/Routers (VLAN1)

192.168.2.0 - Student PC's (VLAN2)

192.168.3.0 - Student PC's (VLAN2)

192.168.4.0 - Student PC's (VLAN2)

192.168.5.0 - Staff PC's/Admin PC's (VLAN3)

192.168.6.0 - Staff PC's/Admin PC's (VLAN3)

192.168.7.0 - Wireless Access (VLAN4)

192.168.8.0 - SPARE

 

Not any easy thing to turn around but if you manage to work out your subnet first this will save you alot of hassle. The idea is to capacity plan, look at what you have already (number of devices that need an ip address) then double it.

 

It's always easier to have more than you need than to have less and strugle to add more later.

[limbo]

Before you set up this VLAN just have a check with your ISP.

 

This was one of the options we considered (the LEA guys and me) but they realised it might cause problems because other sections of their network, that we would need access to, had a VLAN in the same way. This would mean that one of my PC's could in theory have the same IP address as another PC connected to the LEA network making access not only impossible but likely chaotic.

 

You are probably fine, and you have probably already checked it out with your LEA - but just worth a mention to anyone else thinking about doing this.

[SimpleSi]

@ictnut

 

I'm a bit confused about your suggested setup.

 

IF you use a subnet mask of 255.255.248.0 - you get a big range to put all your devices into.

 

But isn't VLANing (If that's the word to use ) on switches used to separate traffic from one network to another?

 

So, although all devices are on same subnet, the VLANing process will stop them communicating?

 

Or is that not what VLANs are for

 

regards

 

Simon

[bossman]

Nat with private address means you will never run out of addresses simple.

[SimpleSi]

@bossman

 

NATing could cause problems with other services supplied by a RBC -e.g. in Lancs, we have a cachepilot with Espresso on it that has a fixed IP RBC assigned address and also we are told to use fixed IP's for our Video conferencing.

 

Although I presume these issues are bypassable, I know the RBC wouldn't support doing so, so in reality NATing is not an option

 

regards

 

Simon

[Geoff]

This was one of the options we considered (the LEA guys and me) but they realised it might cause problems because other sections of their network, that we would need access to, had a VLAN in the same way. This would mean that one of my PC's could in theory have the same IP address as another PC connected to the LEA network making access not only impossible but likely chaotic.

 

This situation is possible but unlikely. The following conditions would need to be true:

 

1) Two schools had be allocated the same IP range by the LEA.

2) They wanted to communicate with each other.

 

VLAN's are not relevant to this problem, it's purely a traffic management tool. It's a clash of IP ranges that's the issue.

 

So, although all devices are on same subnet, the VLANing process will stop them communicating?

 

Correct. One would probably have a router/firewall combination to allow communication between hosts on separate VLANs as required.

 

NATing could cause problems with other services supplied by a RBC -e.g. in Lancs, we have a cachepilot with Espresso on it that has a fixed IP RBC assigned address and also we are told to use fixed IP's for our Video conferencing.

 

Implememting a DMZ solves the first problem, port forwarding (or a Gatekeeper or a SOCKs proxy) the second.

[limbo]

@Geof - the resources that may have a similary range are part of the LEA hosted services - things that they provide that we want to use - not within another school so 2) would definately be true and 1) the entire 192. range within the two vlans would be the same so you would be going say 192.168.1.48 in my school to the LEA service running on 192.168.1.48 in their VLAN.

 

It probably would be ok - but they suggested not to risk it.

[Geoff]

VLAN tagged data should not exit your internal network. If it does, your network is broken.

 

If your LEA network is accepting VLAN tagged data then their network is broken.

 

Implement proper egress/ingress filtering on your border firewall.

[limbo]

@Geoff - Just repeating what I was told in the hope of helping someone else.