CCNA online course

How to Create IPv4 Subnets

Learn IPv4 subnetting step by step: calculate masks, CIDR prefixes, block sizes, network ranges, usable hosts, broadcasts, FLSM, VLSM, and verification.

Subnetting divides one IPv4 network into smaller logical networks. This lesson explains how to calculate subnet masks, network addresses, usable host ranges, broadcast addresses, equal-size subnets, and variable-size subnets.

Before beginning, understand dotted-decimal IPv4 notation, binary numbers and powers of two, router and switch interfaces, default gateways, and the difference between local and routed traffic.

Why Subnet a Network?

An IPv4 subnet is a logical division of a larger IP network with its own network prefix and address range. A routed subnet normally forms a Layer 2 broadcast boundary: broadcasts from one subnet are not forwarded into another subnet by a router.

• Address conservation: Allocate address space according to the number of devices instead of giving every segment a large network.
• Organization: Separate departments, locations, server networks, management networks, and user networks.
• Security boundaries: Apply firewall rules, access control lists, and routing policies between subnets.
• Routing efficiency: Use structured address plans and, where appropriate, route summarization.
• Reduced broadcast traffic: Broadcasts remain within a smaller broadcast domain.

A VLAN is a Layer 2 segmentation mechanism on switches. A subnet is an IP-layer addressing division. They are different concepts, but they are commonly paired: one VLAN usually maps to one IP subnet, and a router or Layer 3 switch routes between them. See trunk ports and router-on-a-stick for VLAN transport and inter-VLAN routing.

IPv4 Addresses and Subnet Masks

An IPv4 address is a 32-bit logical address, usually written as four decimal octets separated by periods. Each octet represents eight bits and ranges from 0 through 255.

192.168.10.25
11000000.10101000.00001010.00011001

A subnet mask is another 32-bit value. Mask bits set to 1 identify the network portion; mask bits set to 0 identify the host portion.

Address:  192.168.10.25   11000000.10101000.00001010.00011001
Mask:     255.255.255.0   11111111.11111111.11111111.00000000
Network:  192.168.10.0    11000000.10101000.00001010.00000000

The network address can be found conceptually by performing a bitwise AND between the address and the mask. A 1 AND 1 produces 1; every other combination produces 0.

CIDR prefix length is slash notation showing how many leading bits are network bits. For example, /24 means 24 network bits and 8 host bits.

Common CIDR Prefixes

A longer prefix creates more, smaller subnets. It leaves fewer host bits, so each subnet supports fewer addresses.

Borrowing Host Bits

Subnetting extends the network prefix by borrowing bits from the original host portion. If you borrow n bits, the number of equal-size subnets is 2ⁿ. The remaining host bits determine the size of each subnet.

The conventional usable-host formula applies to normal multi-host subnets. The first address is the network address and the last is the broadcast address, so neither is normally assigned to an endpoint.

Subnet Increment and Address Ranges

The interesting octet is the mask octet that is neither 255 nor 0. Subnet boundaries increment in that octet. The block size or increment is 256 minus the mask value in that octet.

For 255.255.255.192, the interesting octet is the fourth octet and the block size is 256 − 192 = 64. The subnet boundaries are therefore 0, 64, 128, and 192.

1. List the network boundaries by repeatedly adding the block size.
2. The network address is the boundary at the beginning of the block.
3. The broadcast address is one less than the next boundary.
4. The usable range begins one address after the network and ends one address before the broadcast.

Example: Split 192.168.10.0/24 into Four Equal Subnets

Four subnets require 2 borrowed bits because 2² = 4. The original prefix is /24; borrowing two host bits produces /26. The mask is 255.255.255.192, leaving six host bits. Each subnet has 2⁶ = 64 total addresses and 62 conventional usable hosts.

Choosing a Subnet from a Host Requirement

To support a required number of devices, select the smallest subnet whose usable capacity is large enough. Find the smallest value of h satisfying 2h − 2 ≥ required hosts.

For 50 usable hosts:

• /27 leaves 5 host bits: 2⁵ − 2 = 30 usable hosts, which is insufficient.
• /26 leaves 6 host bits: 2⁶ − 2 = 62 usable hosts, which is sufficient.

Therefore, choose a /26 for a 50-host conventional LAN. The extra capacity can accommodate a gateway, infrastructure addresses, growth, and reservations.

FLSM: Equal-Size Subnets

Fixed Length Subnet Masking (FLSM) uses one prefix length for every subnet created from a parent network. Use FLSM when segments have similar host requirements or when uniformity is more important than maximum address efficiency.

1. Identify the parent prefix and the required number of subnets.
2. Choose the smallest number of borrowed bits for which 2^bits meets the subnet requirement.
3. Add those bits to the parent prefix.
4. Convert the resulting prefix to a mask.
5. Calculate the block size and list every network boundary.
6. Record network, usable, and broadcast addresses.

In the /24 example, two borrowed bits produce four /26 subnets. Each has the same mask, capacity, and address structure.

VLSM: Subnets Based on Different Requirements

Variable Length Subnet Masking (VLSM) allows different prefix lengths within one parent network. This avoids wasting large blocks on small links or departments.

Always allocate the largest requirement first. For each requirement, select the smallest block that provides the needed usable hosts, then begin the next allocation at the next available aligned boundary.

VLSM Example

Use 192.168.50.0/24 for LAN requirements of 100, 50, 20, and 10 hosts, plus a point-to-point router link. The LAN gateway is reserved as the first usable address in each LAN.

Addresses 192.168.50.244–192.168.50.255 remain unused and can be documented for future growth. The blocks do not overlap because each allocation begins after the preceding block's broadcast address.

Find Subnet Details from an IP Address

Given 172.16.35.77/27, first convert the prefix: /27 = 255.255.255.224. The interesting octet is the fourth octet, and the block size is 256 − 224 = 32.

1. List boundaries: 0, 32, 64, 96, 128, 160, 192, and 224.
2. The value 77 falls between 64 and 95, so the host is in the subnet beginning at 64.
3. Network address: 172.16.35.64.
4. Broadcast address: 172.16.35.95, one less than the next boundary, 96.
5. Usable range: 172.16.35.65–172.16.35.94.
6. If numbering from zero, this is subnet number 2 within the 172.16.35.0/24 parent. If numbering from one, it is subnet 3. State the convention used.

Binary AND validates the result: applying the mask keeps the first 27 bits and clears the final five host bits, producing 172.16.35.64.

Special Prefixes: /31 and /32

A /31 contains two addresses and is commonly used for point-to-point links under RFC 3021. In that context, both addresses can represent the two link endpoints, so the traditional assumption that one address is a network address and the other is a broadcast address does not apply in the usual way. Use /31 only when the devices and deployment support this behavior.

A /32 identifies one IPv4 address. It is used for a single-host route, loopback address, or host-specific route. It is not a conventional multi-host subnet.

Assigning Router Interfaces

A default gateway must be a usable address in the same subnet as its hosts. For two /26 LANs, 10.1.1.0/26 has usable addresses .1–.62, and 10.1.1.64/26 has usable addresses .65–.126.

enable
configure terminal
interface gigabitEthernet0/0
 ip address 10.1.1.1 255.255.255.192
 no shutdown
interface gigabitEthernet0/1
 ip address 10.1.1.65 255.255.255.192
 no shutdown
end

Do not assign 10.1.1.0, 10.1.1.63, 10.1.1.64, or 10.1.1.127 to ordinary hosts. These are network or broadcast addresses for the two /26 subnets.

Verification and Documentation

A useful subnet plan records the segment name, VLAN association, prefix, mask, network address, broadcast address, gateway, DHCP range, reserved addresses, and purpose.

show ip interface brief
show running-config | section interface
show ip route
show interfaces

Use these Cisco IOS commands to check interface addresses, administrative and operational state, configured masks, connected routes, errors, and link details. On endpoints, inspect local addressing and routes with:

ipconfig /all
ip addr show
ip route
ping <destination-ip>

Check that every configured address belongs to the intended subnet, every gateway is usable, DHCP ranges exclude gateways and reservations, and VLAN-to-subnet associations are documented. Compare network and broadcast boundaries to detect overlapping blocks before deployment.

Troubleshooting Subnetting Errors

Hosts in the Same LAN Cannot Communicate

• Compare the IP address and mask on each host.
• Calculate each host's network address; a neighboring subnet may have been assigned accidentally.
• Verify that the interface and switch port are up and that the port belongs to the correct VLAN.
• Check ARP information and duplicate-address alerts.

A Host Cannot Reach Outside Its Subnet

• Confirm that the default gateway is a usable address in the host's subnet.
• Ping the gateway first.
• Use show ip interface brief to check the router interface.
• Use show ip route to confirm a route toward the destination network.

Subnet Ranges Overlap

• Recalculate the block size from the mask's interesting octet.
• List every network and broadcast boundary.
• Allocate VLSM blocks from largest to smallest and start each block at a valid aligned boundary.
• Compare the address plan with the masks configured on devices.

A Network or Broadcast Address Was Assigned to a Device

• Calculate the first and last address of the conventional subnet.
• Assign hosts only between those boundaries.
• Confirm whether the link is genuinely a supported /31 point-to-point deployment before using both addresses.

Subnetting Checklist

1. Write the parent network and prefix.
2. Determine whether the design needs equal-size FLSM or mixed-size VLSM.
3. For FLSM, borrow enough bits to meet the subnet count.
4. For host requirements, leave enough host bits for usable capacity.
5. Convert the prefix to a dotted-decimal mask.
6. Find the interesting octet and block size.
7. List network, usable, and broadcast ranges.
8. Check alignment and overlaps.
9. Reserve gateways, DHCP exclusions, infrastructure addresses, and growth space.
10. Verify interfaces, VLAN associations, connected routes, and end-to-end reachability.

For routing context, review OSPF configuration and the OSI reference model.