8 VLSM, Summarization and Subnet Design · CCNA

Exam topics covered

1.6 Configure and verify IPv4 addressing and subnetting (VLSM)

Supporting skill for 3.3 Configure and verify IPv4 static routing (summary routes) and

3.4 ospf

Foundation. Chapter 7 subnetted networks into equal-sized pieces. Real networks are not that tidy: a headquarters LAN may need 300 addresses, a branch office 50 and a router-to-router link just two. Variable Length Subnet Masking (VLSM) lets you give each segment a subnet of the right size, all carved from one address block without overlaps. The reverse skill, route summarization, combines many subnets into one shorter prefix so that routing tables stay small. Both skills rest on the same idea: a prefix is a power-of-two block that must start on a multiple of its own size. This chapter teaches you to plan an addressing scheme from requirements, allocate it with VLSM, verify that nothing overlaps, and summarize the result.

8.1 Planning an Addressing Scheme

A good addressing plan starts with requirements, not arithmetic. Before allocating a single subnet, gather the following:

Segments and their host counts. Every VLAN, LAN, point-to-point link and loopback needs its own subnet. Count the addresses each will need, including router interfaces, printers, access points and IP phones, not just PCs.

Growth. Add headroom (a common rule is 25–50 percent) or reserve spare blocks next to each allocation so it can be enlarged later.

The address block you have been given. Usually a private RFC 1918 block from a larger corporate plan.

Hierarchy. Allocate addresses so that each site or region uses one contiguous block. Then each site can be advertised as a single summary route (Section 8.5).

8.2 Why VLSM?

With fixed-length subnet masks (FLSM), every subnet is the same size, so the size is dictated by the largest segment. If the largest LAN needs 100 hosts, every subnet must be a /25, including the WAN links that need only two addresses. Each /25 used on a WAN link wastes 124 addresses. VLSM removes that constraint: each segment gets the smallest prefix that fits, and the leftover space stays available.

Flsm /25

Vlsm

LAN A: 100 hosts (/25) WAN link: 2 used, 124 wasted (/25)
192.168.1.0 .128 .255
LAN A: 100 hosts (/25) free for more subnets (.132–.255)
WAN /30 (.128–.131)

Figure 8-1 With FLSM, a two-host WAN link consumes a whole /25. With VLSM it takes a /30, leaving 124 addresses for other subnets.

Note

VLSM needs a classless routing protocol, one that sends the prefix length with each route: OSPF, EIGRP, RIPv2, BGP and static routes all qualify. RIPv1 did not, which is why early networks used FLSM. Any network you build today supports VLSM.

8.3 VLSM Step by Step

The method is simple, and following it strictly guarantees there are no overlaps:

1. List the segments with their host requirements, including growth.
2. Sort them from largest to smallest. Allocating big blocks first keeps every allocation aligned on its own boundary without gaps.
3. For each segment, choose the prefix: the smallest h where 2 h − 2 ≥ hosts, prefix = 32

− h.

4. Allocate the next free block of that size, starting from the beginning of the address space. Because you work from large to small, the next free address is always a multiple of the new, smaller block size.
5. Record the network ID, prefix, first and last host, and broadcast. Move the “next free” pointer to the broadcast + 1.

8.3.1 A worked enterprise example

Acme Ltd has been given 10.20.0.0/22 (1,024 addresses) for its headquarters and two branches, shown in Figure 8-2. Table 8-1 lists the requirements, already sorted by size, and the resulting allocation.

Mgmt

WAN HQ–B1 (2)
WAN HQ–B2 (2)
WAN B1–B2 (2)

Lan: 100

Lan: 50

3 router loopbacks (/32)

Figure 8-2 Acme's network: four HQ VLANs routed by a Layer 3 switch, two branches, three WAN links and three router loopbacks. Numbers are hosts required.

Table 8-1 VLSM allocation for Acme Ltd from 10.20.0.0/22 (largest first)

Branch 2 LAN 50 /26 (62) 10.20.3.0/26 10.20.3.1 – 10.20.3.62 10.20.3.63 HQ Servers 25 /27 (30) 10.20.3.64/27 10.20.3.65 –

Walk through the first few rows to see the pattern. The users VLAN needs 300 hosts: 2 9 − 2 =

510 is the smallest fit, so it gets a /23 starting at the beginning of the block, 10.20.0.0/23 (10.20.0.0–10.20.1.255). The next free address is 10.20.2.0. Voice needs 120 hosts, a /25, so it takes 10.20.2.0/25 and the pointer moves to 10.20.2.128, exactly where the next /25 for Branch 1 begins. After the three WAN /30s and the loopbacks, the plan has used 895 of 1,024 addresses, and 10.20.3.128/25 remains free for growth. Figure 8-3 shows the result as an address map.

10.20.0.0/22 (to scale)
Users /23 Voice /25 B1 /25 B2 /26 free /25
10.20.0.0 .2.0 .3.0 10.20.3.255
B2 /26 Servers /27 Mgmt free: 10.20.3.128/25
zoom: 10.20.3.0/24 WANs /30 + loopbacks /32 (.112–.126)

Figure 8-3 Allocation map of 10.20.0.0/22, drawn to scale. Each block starts on a multiple of its own size; the last quarter of the final /24 is still free.

Tip

Leave room for growth beside a subnet, not just inside it. If Branch 2 may double, allocate its /26 at the start of a free /25, so you can later widen it to a /25 without renumbering. Spreadsheet-based IP address management (IPAM) tools exist precisely to track these decisions.

8.3.2 Point-to-point links and loopbacks

WAN links and router-to-router Ethernet links need only two addresses. A /30 (two usable) is the traditional choice and is what most exam questions expect; a /31 (RFC 3021) halves the cost and is common in large data centres. Loopback interfaces use /32s because exactly one address is needed. Group these small allocations together at the end of the plan, as Acme did, so they do not fragment the space needed for larger subnets.

8.4 Avoiding and Detecting Overlaps

Two subnets overlap when any address belongs to both. Overlaps cause routing ambiguity and intermittent failures that are hard to diagnose: one router may install the /24, another the /22, and traffic goes to whichever is the longest match. Following the largest-first method avoids overlaps, but you will often have to check someone else's plan.

To test two subnets, compute the range of each (network ID to broadcast). They overlap if the start of either lies inside the other's range. Because prefixes are aligned blocks, two subnets either do not overlap at all or the smaller one lies completely inside the larger one: the shorter prefix contains the longer one if their network bits agree up to the shorter length.

Table 8-2 Checking pairs of subnets for overlap

Subnet 1 Range Subnet 2 Range Result

10.1.0.0/22 10.1.0.0 – 10.1.3.255 10.1.3.0/24 10.1.3.0 – 10.1.3.255 Overlap 192.168.1.64/26 192.168.1.64 –

10.0.0.0/30 10.0.0.0 – 10.0.0.3 10.0.0.4/30 10.0.0.4 – 10.0.0.7 No overlap

10.20.2.0/25 10.20.2.0 – 10.20.2.127 10.20.2.96/27 10.20.2.96 – 10.20.2.127

Overlap

Cisco IOS protects a single router from overlaps between its own interfaces. Different routers, however, cannot check each other, so an overlap between two sites goes unnoticed until traffic misbehaves.

R-HQ — console

R-HQ(config)# interface GigabitEthernet0/0/1
R-HQ(config-if)# ip address 10.20.3.113 255.255.255.252
R-HQ(config-if)# interface GigabitEthernet0/0/2
R-HQ(config-if)# ip address 10.20.3.114 255.255.255.248

% 10.20.3.112 overlaps with GigabitEthernet0/0/1

R-HQ(config-if)# ip address 10.20.3.117 255.255.255.252
R-HQ(config-if)# do show ip route connected | include 10.20.3.11

C 10.20.3.112/30 is directly connected, GigabitEthernet0/0/1
L 10.20.3.113/32 is directly connected, GigabitEthernet0/0/1
C 10.20.3.116/30 is directly connected, GigabitEthernet0/0/2
L 10.20.3.117/32 is directly connected, GigabitEthernet0/0/2

Figure 8-4 A mistyped mask (/29 instead of /30) makes the second WAN subnet overlap the first, and IOS rejects it. Output is illustrative of Cisco IOS 15 and IOS XE.

Exam alert

VLSM questions often list several proposed subnets and ask which one overlaps an existing allocation, or which next subnet can be assigned. Compute the range of every existing subnet first; then a proposed subnet is valid only if its network ID is a multiple of its block size and its whole range falls in free space.

8.5 Route Summarization

Route summarization (also called route aggregation) advertises one shorter prefix in place of several longer ones. Instead of telling the rest of the network about 172.16.12.0/24, 172.16.13.0/24, 172.16.14.0/24 and 172.16.15.0/24, a branch router can advertise just 172.16.12.0/22. The benefits are significant:

Smaller routing tables, which means less memory, faster lookups and smaller routing updates.

Stability. If one /24 inside the summary flaps, the summary itself stays up, so routers elsewhere do not have to recalculate. Summarization hides instability.

Simpler configuration: one static route or ACL entry instead of many.

8.5.1 Finding the summary: line up the bits

To find the best summary of a group of networks, write the octet where they differ in binary, line them up, and count how many leading bits they share. The summary keeps those common bits and sets the rest to zero.

172.16.12.0 172.16.00001100.00000000
172.16.13.0 172.16.00001101.00000000
172.16.14.0 172.16.00001110.00000000
172.16.15.0 172.16.00001111.00000000
22 common bits

Summary 172.16.00001100.00000000 = 172.16.12.0/22 (255.255.252.0)

16 bits (172.16) + 6 matching bits of the third octet = /22

Figure 8-5 The four networks agree in their first 22 bits (blue); the last two bits of the third octet (green) vary. The summary is 172.16.12.0/22.

A shortcut works when the networks are a contiguous, power-of-two count of equal-sized subnets: four /24s summarize to a /22 (four = 2

, so subtract 2 from the prefix), eight /24s to a

/21, and so on, provided the first network is a multiple of the new block size. 172.16.12.0 qualifies because 12 is a multiple of 4. If it were 172.16.13.0–172.16.16.0 the four networks would not align, and no single /22 would cover exactly those four.

8.5.2 Exact versus inclusive summaries

When the networks do not form an aligned power-of-two block, you have two choices. Consider 10.1.4.0/24 through 10.1.9.0/24 (six networks):

Exact summarization uses several prefixes that together cover only those networks: 10.1.4.0/22 (4–7) and 10.1.8.0/23 (8–9).

The smallest single summary lines up the bits of 4 (00000100) through 9 (00001001); they share only the first four bits, giving 10.1.0.0/20 (10.1.0.0–10.1.15.255). That route also claims 10.1.0.0–10.1.3.255 and 10.1.10.0–10.1.15.255, which may exist elsewhere. An inclusive summary is acceptable if those extra addresses are unused or live behind the same router. If they exist elsewhere, the more specific routes for them still win by longest match, but if they do not exist at all, traffic to them follows the summary and is dropped at the far end, possibly after a routing loop. That is why routers that generate summaries usually install a Null0 discard route for the summary.

Watch out

Never accept a “summary” whose network ID is not a multiple of its block size. 172.16.13.0/22 is not a valid network; IOS would store it as 172.16.12.0/22. Always check alignment as the final step.

8.5.3 Supernetting

The term supernet describes a summary whose prefix is shorter than the classful mask of the networks inside it, for example combining eight class C networks 192.168.8.0/24 through 192.168.15.0/24 into 192.168.8.0/21. Supernetting was one of the original motivations for CIDR: ISPs aggregate blocks of customer networks so that the Internet routing table carries one route per provider block instead of one per customer. Mechanically, it is exactly the same bit-alignment process.

8.5.4 Configuring and verifying a summary route

The simplest summary is a static route. In Figure 8-6, Branch router B3 has four LANs, 172.16.12.0/24 through 172.16.15.0/24. Core router R-Core needs only one route to reach all of them.

Figure 8-6 One summary static route on R-Core replaces four specific routes.

R-Core(config)# ip route 172.16.12.0 255.255.252.0 10.0.0.2 ! one route for four /24s

R-Core — console

R-Core# show ip route static

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP ...

Gateway of last resort is not set
172.16.0.0/22 is subnetted, 1 subnets
S 172.16.12.0 [1/0] via 10.0.0.2

R-Core# show ip route 172.16.14.77

Routing entry for 172.16.12.0/22
Known via "static", distance 1, metric 0
Routing Descriptor Blocks:
* 10.0.0.2
Route metric is 0, traffic share count is 1

Figure 8-7 The summary appears as a single static route, and a lookup for any host in the four LANs matches it.

Dynamic routing protocols can summarize too. In OSPF, summarization happens at area border routers with the area range command, and at autonomous system boundary routers with summary-address ; both are beyond the CCNA's single-area OSPF scope but rely on exactly the arithmetic in this chapter. A well-designed hierarchical plan, like Acme's single 10.20.0.0/22 block, makes such summaries possible: the entire company can be advertised to a data centre or partner network as one route.

LAB Plan and verify a VLSM design

Goal: Allocate 192.168.50.0/24 for a small site and summarize it. Requirements: LAN-A 100 hosts, LAN-B 50, LAN-C 20, LAN-D 10, and two point-to-point links. Steps:

1. Sort by size and allocate largest first (answer in Table 8-3).
2. Configure each router interface with the first usable address of its subnet and confirm that IOS accepts every address without an overlap error.
3. On the upstream router, configure one static route for 192.168.50.0/24 toward the site.

Verify: show ip route connected on the site router lists each subnet with the expected prefix length (the heading reads “variably subnetted” because several masks are in use). From the upstream router, show ip route 192.168.50.70 matches the /24 summary.

Table 8-3 Lab answer: VLSM allocation of 192.168.50.0/24

8.6 Practice Problems

Every answer below was generated and checked with Python's ipaddress module.

8.6.1 Problems

1. VLSM. Allocate 172.30.16.0/21 for these segments, largest first: LAN 1 400 hosts, LAN 2 200, LAN 3 100, LAN 4 60, LAN 5 30, and four point-to-point WAN links (/30). How much space remains?
2. Summarize. 10.10.32.0/24 through 10.10.39.0/24 (eight networks)
3. Summarize. 172.16.64.0/20 and 172.16.80.0/20
4. Summarize. 192.168.1.0/26, 192.168.1.64/26, 192.168.1.128/26 and 192.168.1.192/26
5. Summarize. 10.0.8.0/24, 10.0.9.0/24 and 10.0.10.0/24 (smallest single summary)
6. Summarize. 172.20.4.0/24 through 172.20.7.0/24
7. Summarize. 10.1.96.0/22, 10.1.100.0/22, 10.1.104.0/22 and 10.1.108.0/22
8. Overlap? 10.50.0.0/21 and 10.50.6.0/23
9. Overlap? 192.168.10.96/27 and 192.168.10.64/27
10. Overlap? 172.18.128.0/18 and 172.18.200.0/24
11. Overlap? 10.9.9.8/29 and 10.9.9.12/30
12. Next subnet. 192.168.100.0/24 already has 192.168.100.0/25 and 192.168.100.128/26 assigned. What is the first available /27?
13. Next subnet. 10.5.0.0/22 already has 10.5.0.0/24, 10.5.1.0/26 and 10.5.1.64/30 assigned. What is the first available /25?

8.6.2 Answers

Table 8-4 Answer to problem 1: VLSM allocation of 172.30.16.0/21 Segment

Problem 1 leaves 1,040 of 2,048 addresses free: 172.30.19.240/28, 172.30.20.0/22.

2. 10.10.32.0/21 (255.255.248.0). Exact: no extra addresses.
3. 172.16.64.0/19 (255.255.224.0). Exact: no extra addresses.
4. 192.168.1.0/24 (255.255.255.0). Exact: no extra addresses.
5. 10.0.8.0/22 (255.255.252.0). Inclusive: also covers 256 addresses not in the list (exact summary: 10.0.8.0/23, 10.0.10.0/24).
6. 172.20.4.0/22 (255.255.252.0). Exact: no extra addresses.
7. 10.1.96.0/20 (255.255.240.0). Exact: no extra addresses.
8. Yes. 10.50.0.0/21 = 10.50.0.0–10.50.7.255; 10.50.6.0/23 = 10.50.6.0–10.50.7.255.
9. No. 192.168.10.96/27 = 192.168.10.96–192.168.10.127; 192.168.10.64/27 = 192.168.10.64–192.168.10.95.
10. No. 172.18.128.0/18 = 172.18.128.0–172.18.191.255; 172.18.200.0/24 = 172.18.200.0– 172.18.200.255.
11. Yes. 10.9.9.8/29 = 10.9.9.8–10.9.9.15; 10.9.9.12/30 = 10.9.9.12–10.9.9.15.
12. 192.168.100.192/27. The /25 covers .0–.127 and the /26 covers .128–.191, so the first free /27 starts at .192.
13. 10.5.1.128/25. 10.5.0.0/24 is used; in 10.5.1.0/24, .0–.63 and .64–.67 are used, so 10.5.1.0/25 is not free; the next /25 boundary is 10.5.1.128.

Chapter review

Key terms

Vlsm

Flsm

Cidr

Ipam

Review questions

1. What is the main advantage of VLSM over FLSM?

A. It removes the need for a routing protocol
B. Each subnet can be sized to its requirement, reducing wasted addresses
C. It allows overlapping subnets
D. It works only with classful routing protocols

2. When allocating subnets with VLSM, in what order should segments be assigned?

A. Smallest to largest
B. Alphabetically
C. Largest to smallest
D. In the order the VLANs were created

3. A LAN needs 60 hosts. Which prefix wastes the fewest addresses?

A. /25
B. /26
C. /27
D. /28

4. Which summary exactly covers 172.16.12.0/24, 172.16.13.0/24, 172.16.14.0/24 and 172.16.15.0/24?

A. 172.16.0.0/16
B. 172.16.12.0/22
C. 172.16.12.0/23
D. 172.16.8.0/21

5. What is the smallest single summary route that includes 10.1.4.0/24 through 10.1.9.0/24?

A. 10.1.4.0/22
B. 10.1.0.0/21
C. 10.1.0.0/20
D. 10.1.4.0/21

6. Which two subnets overlap with 10.20.2.0/25? (Choose two.)

A. 10.20.2.96/27
B. 10.20.2.128/26
C. 10.20.2.64/28
D. 10.20.3.0/25
E. 10.20.1.0/24

7. 192.168.1.0/26 and 192.168.1.64/27 are already assigned. Which is the first /26 that can be assigned next?

A. 192.168.1.64/26
B. 192.168.1.96/26
C. 192.168.1.128/26
D. 192.168.1.192/26

8. Which statement about route summarization is true?

A. It increases the size of routing tables
B. It hides the instability of individual subnets inside the summary
C. It requires all subnets to use the same mask
D. It works only with RIPv1

9. Eight class C networks, 192.168.8.0/24 through 192.168.15.0/24, are aggregated into one route. What is this route, and what is the technique called?

A. 192.168.8.0/21, supernetting
B. 192.168.0.0/20, subnetting
C. 192.168.8.0/22, VLSM
D. 192.168.8.0/21, VLSM

10. Which prefix is the traditional choice for a point-to-point WAN link in a VLSM design?

A. /24
B. /28
C. /30
D. /32

11. An engineer writes the summary 172.16.13.0/22. What is wrong?

A. Nothing, it is valid
B. 13 is not a multiple of 4, so it is not a valid /22 network ID
C. /22 is too long for a summary
D. Summaries must use /16

12. Which two routing sources support VLSM because they carry the prefix length with each route? (Choose two.)

A. RIPv1
B. OSPF
C. Static routes
D. IGRP
E. Classful auto-summary

Answers

1. B. VLSM lets each segment use the smallest prefix that fits.
2. C. Largest first keeps every block aligned on its boundary with no gaps or overlaps.
3. B. /26 gives 62 usable hosts; /27 gives only 30.
4. B. Third octets 12–15 share their first six bits (000011xx): 16 + 6 = /22.
5. C. 4 = 00000100 and 9 = 00001001 share only four leading bits, giving /20 (10.1.0.0– 10.1.15.255).
6. A, C. 10.20.2.0/25 spans .0–.127, which contains .96/27 and .64/28. The others start at .128 or lie outside 10.20.2.x.
7. C. .64/26 would overlap the .64/27, and .96 is not a /26 boundary. The next free /26 boundary is .128.
8. B. A flapping subnet inside a summary does not change the summary route itself.
9. A. Eight /24s = 2

, so /21; 8 is a multiple of 8. A summary shorter than the classful /24 is a supernet.

10. C. /30 provides exactly two usable addresses (a /31 is also valid on point-to-point links).
11. B. A /22 has block size 4 in the third octet; valid network IDs are 172.16.12.0, .16.0, and so on.
12. B, C. OSPF and static routes are classless. RIPv1 and IGRP are classful.