CCNA online course

What Is IPv4 Subnetting?

Learn IPv4 subnetting, broadcast domains, subnet masks, /24 to /25 splitting, routing, VLANs, security segmentation, and common troubleshooting issues.

Subnetting is the process of dividing a larger IP network into smaller logical IP networks called subnets. Subnetting is a core IPv4 skill because it controls broadcast scope, organizes departments, supports security policies, and helps routers manage traffic.

This lesson assumes you understand basic IP addressing, dotted-decimal notation, binary IPv4 values, and the basic difference between switches and routers.

What Is a Subnet?

An IPv4 address is a 32-bit address assigned to a network interface. It contains a network portion and a host portion. The network portion identifies the subnet, while the host portion identifies an interface within that subnet.

A subnet is a logical IP network identified by a network prefix and a subnet mask. Hosts in the same subnet share the same network prefix and can generally communicate locally through Layer 2 switching. Traffic between different subnets requires inter-subnet routing through a Layer 3 device, such as a router or multilayer switch.

Subnetting divides one parent address block into smaller child prefixes. For example, dividing 10.0.0.0/24 into two equal subnets creates 10.0.0.0/25 and 10.0.0.128/25. Both child subnets remain inside the original 10.0.0.0/24 address block.

IPv4 Prefixes and Subnet Masks

CIDR notation uses a slash followed by the number of leading network bits. In /24, the first 24 of the 32 IPv4 bits identify the network, leaving 8 host bits. In /25, the first 25 bits identify the network, leaving 7 host bits.

A subnet mask is the 32-bit value that distinguishes network bits from host bits. A binary 1 in the mask represents a network bit, and a binary 0 represents a host bit.

When a network is subnetted, one or more bits are borrowed from the host portion and added to the network portion. Borrowing one bit from a /24 creates two possible values for that bit, producing two /25 subnets. More network bits create more subnets, but fewer host bits mean fewer usable addresses in each subnet.

Address Roles Within a Subnet

For a conventional IPv4 subnet, usable host capacity is calculated as 2^h - 2, where h is the number of host bits. The two excluded addresses are the network address and broadcast address.

Why Subnetting Is Used

Smaller Broadcast Domains

A broadcast domain is the set of devices that receive a Layer 2 broadcast sent within a segment. An IPv4 broadcast sent inside a subnet is intended for all hosts in that subnet.

In one large subnet, every host shares the same broadcast domain. As the number of devices increases, more hosts must receive and process broadcasts, even when most of those hosts do not need the information. Subnetting creates smaller broadcast domains, reducing unnecessary broadcast processing.

Routers do not normally forward Layer 3 broadcasts between subnets. Therefore, a broadcast from an Accounting subnet remains in that subnet instead of entering the Marketing subnet through normal routing.

Logical Organization

Subnetting gives an administrator a way to organize addresses according to function or location. Separate subnets can be assigned to Accounting, Marketing, Engineering, guests, servers, voice devices, or network-management interfaces.

For example, a company might use one subnet for Accounting clients, another for general office users, and another for servers. The address plan then communicates useful information about the network's structure and makes administration easier.

Security Segmentation

Separate subnets provide boundaries at which security policy can be applied. A router, firewall, or multilayer switch can use an ACL, or access control list, to allow or deny traffic according to source, destination, protocol, or port.

Subnetting alone does not block all traffic. If inter-subnet routing is enabled and no restrictive policy is configured, hosts in different subnets may still communicate. Security requires controls such as ACLs, firewall rules, authentication, and appropriate application permissions.

Address and Routing Efficiency

Smaller, deliberately planned networks make it easier to allocate addresses according to need. They can also make routing more efficient. When adjacent subnet ranges are planned well, multiple routes may be represented by one larger route through route summarization.

Route summarization is the practice of advertising or representing multiple contiguous networks with one summary route. It reduces routing-table entries and can simplify route management.

One Large Subnet Versus Multiple Smaller Subnets

Example: One Large Office Subnet

Suppose an office uses 10.0.0.0/24. This network has 8 host bits and supports up to 254 usable host addresses, from 10.0.0.1 through 10.0.0.254. Its subnet mask is 255.255.255.0, and its broadcast address is 10.0.0.255.

If Accounting, Marketing, Engineering, servers, guests, and management devices all use this same subnet, they share one broadcast domain. A broadcast from one device is delivered throughout that domain. There is also no subnet boundary at which a router or firewall must evaluate traffic between those groups.

Example: Split 10.0.0.0/24 Into Two /25 Networks

To create two equal subnets, borrow one host bit from the /24 prefix. The resulting prefix is /25, with subnet mask 255.255.255.128. Each subnet has 7 host bits and supports 2^7 - 2 = 126 usable hosts.

The first subnet uses host bit values from 0 through 127. The second uses values from 128 through 255. The addresses at the boundaries are the network and broadcast addresses, not normal host addresses.

Accounting and Marketing now have separate broadcast domains. A device in Accounting sends traffic to a Marketing device through its default gateway, such as a router interface or multilayer-switch virtual interface. The tradeoff is that each subnet has fewer usable addresses than the original /24.

Subnetting Versus Unrelated Network Ranges

True subnetting creates smaller prefixes contained within an original parent prefix. The two /25 networks 10.0.0.0/25 and 10.0.0.128/25 are valid subdivisions of 10.0.0.0/24.

By contrast, 10.0.0.0/24 and 10.1.0.0/24 are two distinct networks from different portions of the private 10.0.0.0/8 range. Assigning them to different departments may be a valid addressing design, but it does not divide 10.0.0.0/24 into smaller subnets.

Departmental Segmentation With VLANs

A VLAN is a Layer 2 logical segmentation method commonly associated with a separate IP subnet. Switch ports assigned to an Accounting VLAN can connect Accounting hosts, while ports assigned to a Marketing VLAN can connect Marketing hosts.

VLANs separate Layer 2 broadcast domains. A router or multilayer switch then provides inter-VLAN routing between the associated IP subnets. For example, an ACL could allow Accounting users to reach an approved financial-server service while denying unrelated access from other departments.

For related Layer 2 and inter-VLAN configuration concepts, see Configure Trunk Ports and Configure Router on a Stick.

Routing Implications

Each subnet normally needs a default gateway: the local router or Layer 3 switch interface that a host uses to reach other subnets. The gateway interface must have an address in the host's own subnet.

A host compares the destination address with its own address and subnet mask. If the destination is local, the host attempts direct Layer 2 delivery. If the destination is remote, the host sends the packet to its default gateway.

A router's routing table contains routes to remote subnets. Directly connected interfaces create connected routes, while static routes or dynamic routing protocols can provide paths to additional networks. Route summarization can combine adjacent, well-planned ranges into a single route; this topic is explored further in OSPF Route Summarization.

Optional Cisco IOS Illustration

Configuration is not required to understand subnetting. The following example shows two Layer 3 interfaces acting as gateways for the two /25 subnets. The exact interface names and platform syntax may vary.

interface GigabitEthernet0/0
 ip address 10.0.0.1 255.255.255.128
 no shutdown

interface GigabitEthernet0/1
 ip address 10.0.0.129 255.255.255.128
 no shutdown

Hosts in Accounting could use 10.0.0.1 as their gateway, while Marketing hosts could use 10.0.0.129. In a VLAN-based design, these gateway addresses could instead be configured on switched virtual interfaces.

Useful Verification Commands

show ip interface brief
show ip route
ping <destination-ip>
show vlan brief

• show ip interface brief displays interface addresses and status.
• show ip route displays connected and learned routes.
• ping <destination-ip> tests reachability to a destination.
• show vlan brief displays VLANs and switch-port membership.

Troubleshooting Subnet Problems

Hosts Expected to Be in the Same Subnet Cannot Communicate

Check the IP address and subnet mask on every host. Two addresses can look similar but belong to different prefixes. Also check for a VLAN mismatch: devices may have compatible IP settings but be separated at Layer 2.

The IP address and subnet mask together determine whether a destination is local or whether traffic must be sent to the default gateway.

Separate Departments Can Still Reach Sensitive Resources

Separate subnets do not automatically deny traffic. Inter-subnet routing may be enabled without restrictive ACLs or firewall rules, or an existing policy may allow more traffic than intended. Review the routing path and the security policy applied to that path.

A Host Cannot Reach Anything Outside Its Subnet

Check whether the default gateway is present and correctly addressed. Verify that the router or multilayer-switch interface for the subnet is up and uses an address in the correct prefix. Then verify that a route exists to the destination network.

A Proposed Split Is Not a Subdivision

Confirm that every proposed child prefix is contained within the original parent range and that the prefix length increased. For example, the valid children of 10.0.0.0/24 when splitting equally are 10.0.0.0/25 and 10.0.0.128/25, not an unrelated network such as 10.1.0.0/24.

Key Points to Remember

• Subnetting divides one larger IP network into smaller logical IP networks.
• The prefix length and subnet mask identify the network and host portions of an IPv4 address.
• The network address identifies the subnet, the broadcast address reaches all hosts in the local subnet, and usable host addresses are assigned between them.
• Smaller subnets reduce broadcast scope and support organizational segmentation.
• Communication between separate subnets requires a router or multilayer switch and normally uses a default gateway.
• VLANs commonly provide the Layer 2 separation associated with separate IP subnets.
• Subnetting creates boundaries, but ACLs and firewall policies determine which inter-subnet traffic is allowed.
• Splitting a /24 into two equal networks produces two /25 networks with 126 usable hosts each.

For broader context, review Unicast, Multicast, and Broadcast Addresses and the OSI Reference Model.