Introduction to Subnetting 

Intro to Subnetting by Aaron G. Rombaut

Introduction: Subnetting is a way for network administrators to use available network address space without waste. A general rule of thumb in networking is to remember a subnet = broadcast domain = vlan.

Discussion: An IPv4  address consists of four octets in dotted decimal notation. Each octet contains eight bits ranging in value from 0 to 255. A common IPv4 address many home users may be familiar with is 192.168.1.1. This by itself is called a host or node address. This address is given to a network node on a network and identifies it. It is a made up number given by a network administrator and resides at layer 3 of the OSI model. With the information given, however, we don’t know the network it resides on.

In order to find out the network the host address is on, we need to know the subnet mask. A common subnet mask home users may be familiar with is 255.255.255.0. Once we have the IP address and the subnet mask, it’s simply a matter of performing a binary calculation.

Tip: When you see a ‘255’ in a subnet mask, you carry the octet value from the IP address

Tip: When you see a ‘0’ in a subnet mask, you mark that octet with a ‘0’

Example: Using the 192.168.1.1 IP address and 255.255.255.0 subnet mask, I will demonstrate the tips given.

IP Address: 192.168.1.1
Subnet Mask: 255.255.255.0
Network Address: 192.168.1.0

A more difficult example would be as follows:

IP Address: 192.168.1.45
Subnet Mask: 255.255.255.248

The subnet mask given here is a subnet of the previous example. Notice that the last octet of the subnet mask has increased from 0 to 248. This increase indicates that the network administrator has borrowed host bits to make the network smaller.

A visual representation of 255.255.255.0 is nnnnnnnn.nnnnnnnn.nnnnnnnn.hhhhhhhh where ‘n’ represents network bits and ‘h’ represents host bits. A visual representation of the subnetted network’s subnet mask is nnnnnnnn.nnnnnnnn.nnnnnnnn.nnnnnhhh. Notice that in the fourth octet, there are five ‘n’ bits and only three ‘h’ bits? This indicates that the administrator ‘borrowed’ host bits to make a smaller network.

To calculate the Network Address here, the first tip still applies, you still carry the 192.168.1 part of the address since the subnet mask in those lined up octets are 255. Where it gets interesting is the fourth octet. This is actually called the interesting octet.

As mentioned in the beginning, an IP address is made up of four octets in dotted decimal notation. Each octet contains eight bits ranging from 0 to 255. I will break this up to illustrate.

First layout your eight bit placeholders.

_  _  _  _  _  _  _  _

The value of each of these placeholders is as follows, 128 64 32 16 8 4 2 1. Since bits are binary, you can only use a ‘1’ or a ‘0’. In order to convert the decimal number 45 given in the example to binary, you simply mark the appropriate value in the placeholder that gives you the sum. For instance, 128 does not go in 45, so you would mark a ‘0’ in the ‘128’ placeholder. 64 also does not go in 45, so again, you would mark a ‘0’. 32 does go into 45, so in this case, you would place a ‘1’ in the 32 placeholder. You continue doing this until you have met the decimal number. If there are any open placeholders to the right, you finish them with ‘0’.

The binary representation for decimal 45 is 00101101. This is the hardest part of learning how to subnet.

For subnet masks, it’s much easier as the bits have to be contiguous. This means that you will not have an octet consisting of 1, 0, and then more ones. Remember the range for an octet is 0 to 255. A ‘0’ octet is where all binary bits are turned off. So, the binary representation of decimal ‘0’ is 00000000. A ‘255’ octet is where all binary bits are turned on. So, the binary representation of decimal ‘255’ is 11111111. Since subnet masks consist of contiguous ‘1’, then there is a finite number of addresses to remember.

Tip: remember the eight permutations for subnet masks

128.0.0.0 (128 + 0 + 0 + 0 + 0 + 0 + 0 + 0)
192.0.0.0 (128 + 64 + 0 + 0 + 0 + 0 + 0 + 0)
224.0.0.0 (128 + 64 + 32 + 0 + 0 + 0 + 0 + 0)
240.0.0.0 (128 + 64 + 32 + 16 + 0 + 0 + 0 + 0)
248.0.0.0 (128 + 64 + 32 + 16 + 8 + 0 + 0 + 0)
252.0.0.0 (128 + 64 + 32 + 16 + 8 + 4 + 0 + 0)
254.0.0.0 (128 + 64 + 32 + 16 + 8 + 4 + 2 + 0)
255.0.0.0 (128 + 64 + 32 + 16 + 8 + 4 +2 + 1 )

Putting it all together: So now that we know our binary representation for decimal 45, we also know our binary representation for the subnet mask. Place the binary 45 above the binary 248. From here, you will apply binary AND rules to get the result. The result of this operation is the network (or subnet) address.

00101101 – 48
11111000 – 248

Tip: When you see a ‘1’ and a ‘1’, the result is ‘1’
Tip: When you see a ‘1’ and a ‘0’, the result is ‘0’
Tip: When you see a ‘0’ and a ‘0’, the result is ‘0’

The result of the above calculation is 00101000. Now you convert this back to decimal. 0 + 0 + 32 + 0 + 8 + 0 + 0 + 0 = 40, therefore, the network address is 192.168.1.40 for the IP Address 192.168.1.45 with a subnet mask of 255.255.255.248. Easy, right?

Learning the Magic Number Method

Remember when I said to learn the eight subnet mask permutations? It’s going to be very important for quickly finding subnetting answers. This method does not require you to convert decimal to binary and then back to decimal.

Let’s use the following example:
IP Address: 192.168.20.34
Subnet Mask: 255.255.255.224

First, lay out the eight permutations again:
128 192 224 240 248 252 254 255

Next, lay out the octet placeholder values:
128 64 32 16 8 4 2 1

Let me also mention that the tips regarding ‘255’ or ‘0’ in the subnet mask still apply to figuring out the network address.

So, with what we know up to this point, we have the network address as 192.168.20.something. The something in this case is our interesting octet as well. The subnet mask is where we will focus our attention. Notice that the fourth octet in the subnet mask is ‘224’? Now look at what place this is in with regards to an octet, in this case the third place from the left. We always work from left to right, the most significant bit (MSB) to least significant bit (LSB). The third value of the octet is ’32’, so in a zero-based network (the router uses the ‘0’ subnet), you would have:

0
32
64
96

256

Basically, you start with ‘0’ and count in intervals from your ‘magic number’. The magic number is the value of the placeholder where your subnet mask is. You are looking for the number before the interesting octet value of the IP Address, in this case ’34’, and the value after. So in this case, ’34’ is between ’32’ and ’64’, therefore our Network Address is 192.168.20.32.
If you are on a test and forget your octet values, you can simply deduct the value of the subnet octet from 256. The reason you use 256 is because there are 256 possible values including zero. In our example, 256 – subnet octet value of 224 = 32. This is our magic number and also the number you increment by. See, the magic number method is tons easier and much faster, especially when you are sitting for a networking certification!

Practice Questions

Decimal to Binary Conversions
23
223
255
123
12

Binary to Decimal Conversions
00100010
11111111
10101010
11010110
11001100

Binary AND Operations
11010110
11101010

10101010
11110101

10100111
11010110

11010101
10111011

11000011
11111100

Find the Network Address

IP Address: 192.168.1.234
Subnet Mask: 255.255.255.0

192.168.168.23
255.255.255.128

172.10.10.123
255.255.0.0

10.25.123.47
255.0.0.0

10.10.20.30
255.255.255.252

Add and Remove VLANs on a Trunk

Where access ports allow for only one data VLAN and one voice VLAN, a trunk port can carry one or more VLANs. Generally, you would use a trunk to connect switches together where you need to carry traffic. In some cases, you would configure a trunk port to connect to a server, such as a virtual server. If the device needs to use more than one VLAN, then you will want to configure the port as a trunk port.

Configure

The following commands will set up the interface to trunk mode exclusively. This will turn off Dynamic Trunking Protocol (DTP). Depending on the hardware you are on, you may need to set the encapsulation mode. Most newer equipment and code should default to using 802.1Q encapsulation, though.

Switch#configure terminal
Switch(config)#interface interface-id
Switch(config-if)#switchport trunk encapsulation {dot1q | isl}
Switch(config-if)#switchport mode trunk

In order to add and remove VLANs on a trunk, you need to go to the interface and specify whether you want to add or remove VLANs.

To add one or more VLANs to the trunk:

Switch#configure terminal
Switch(config)#interface interface-id
Switch(config-if)#switchport trunk allowed vlan add vlan-id,vlan-id,vlan-id

To remove one or more VLANs from the trunk, you replace the add parameter with remove. It may appear odd that the allowed parameter is in the command but think of it like this, you are removing an allowed VLAN from the trunk.

Switch#configure terminal
Switch(config)#interface interface-id
Switch(config-if)#switchport trunk allowed vlan remove vlan-id,vlan-id,vlan-id

Verify

To verify what interfaces are trunks and what VLANs are configured, you would use the following command:

Switch#show interfaces trunk

You may also want to check the switchport configuration for the interface.

Switch#show interfaces interface-id switchport
Name: interface-id
Switchport: Enabled
Administrative Mode: trunk
Operational Mode: trunk
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: dot1q
Negotiation of Trunking: On
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)
Voice VLAN: none
Administrative private-vlan host-association: none
Administrative private-vlan mapping: none
Administrative private-vlan trunk native VLAN: none
Administrative private-vlan trunk encapsulation: dot1q
Administrative private-vlan trunk normal VLANs: none
Administrative private-vlan trunk private VLANs: none
Operational private-vlan: none
Trunking VLANs Enabled: All
Pruning VLANs Enabled: 2-1001
Capture Mode Disabled
Capture VLANs Allowed: ALL
Protected: false
Unknown unicast blocked: disabled
Unknown multicast blocked: disabled
Appliance trust: none

Troubleshoot

When you try to set the interface to trunk mode, you may encounter an error message regarding the trunk encapsulation. This occurs on older hardware, but you may still see it. You just need to set the trunk encapsulation first, then go back to configuring the interface as a trunk.

Switch(config-if)#switchport mode trunk
Command rejected: An interface whose trunk encapsulation is "Auto" can not be configured to "trunk" mode.

Trunks will carry multiple VLANs only if they are created. If you look at the output of the show interfaces trunk command and do not see the VLANs you expect, ensure the VLANs are created on the device.

Assigning Switch Ports to VLANs

Interfaces on Cisco switches can belong to two VLANs, one for data traffic and one for voice traffic. You set the interface to be an access port. This also turns off trunking and VLAN Trunking Protocol (VTP).

Configure

The following command will configure an access port. An access port is intended for data traffic.

Switch#configure terminal
Switch(config)#interface interface-id
Switch(config-if)#switchport mode access
Switch(config-if)#switchport access vlan vlan-id

In order to configure a voice VLAN, you follow the exact same procedure as above, but this time, use the voice vlan keyword in place of the access keyword. The following command will configure a voice port. A voice port is intended for voice traffic.

Switch#configure terminal
Switch(config)#interface interface-id
Switch(config-if)#switchport voice vlan vlan-id

Verify

The following command will output switchport statistics for the interface you choose.

Switch#show interfaces interface-id switchport

The above command will output the following:

Name: interface-id
Switchport: Enabled
Administrative Mode: static access
Operational Mode: static access
Administrative Trunking Encapsulation: negotiated
Operational Trunking Encapsulation: native
Negotiation of Trunking: Off
Access Mode VLAN: vlan-id (vlan-name)
Trunking Native Mode VLAN: 1 (default)
Voice VLAN: vlan-id

You can also look at the running-config output for the interface.

!
interface interface-id
switchport access vlan vlan-id
switchport mode access
switchport nonegotiate
switchport voice vlan vlan-id
!

Troubleshooting

An issue you may run into is seeing  an inactive VLAN entry when you check the status of the switchport.

Switch#show interfaces interface-id switchport
Name: interface-id 
Switchport: Enabled 
Administrative Mode: static access 
Operational Mode: static access 
Administrative Trunking Encapsulation: negotiated 
Operational Trunking Encapsulation: native 
Negotiation of Trunking: Off 
Access Mode VLAN: vlan-id (inactive) 
Trunking Native Mode VLAN: 1 (default) 
Voice VLAN: vlan-id

This occurs when a VLAN was assigned to an interface and then the VLAN was deleted. This could be a result of administrative error or with configuring a protocol like VLAN Trunking Protocol (VTP). If you are not careful, you could plug a switch into the network that will delete the current vlan.dat file. When the VLAN is deleted, the assigned VLAN does not go away. As you can see from the above output, you can see that where the name of the VLAN is usually displayed, instead, you see the word inactive. No traffic flows and the packets are dropped.