CCNA IPv4 Addressing and Subnetting: Ranges, VLSM and Troubleshooting

An IPv4 address and its mask together define two things: the subnet the device belongs to and the device's own position inside it. The address is 32 bits written as four decimal octets; the mask (or prefix length, such as /26) says how many of those bits, counted from the left, are the network part. The remaining bits are the host part.

Every subnet has three kinds of address:

• the network address: all host bits 0, the first address in the block, names the subnet itself;
• the broadcast address: all host bits 1, the last address in the block, reaches every host on the subnet;
• the usable host range: everything in between.

A device uses its own mask to decide whether a destination is on-link (same subnet: ARP for it directly) or off-link (different subnet: send the frame to the default gateway). Almost every IPv4 fault in this topic comes from that decision being made with the wrong numbers on one side or the other.

This lesson covers subnet arithmetic, sizing and VLSM, public, private and special-purpose ranges, IOS interface addressing (including secondary addresses and overlap checks) and troubleshooting mismatched addresses, masks and gateways. How hosts obtain an address from a DHCP server or relay, and client operating-system commands, belong to the DHCPv4 and client-connectivity lessons; IPv6 has its own lesson.

Use the block size (sometimes called the magic number) in the "interesting" octet, the one where the mask is neither 255 nor 0. Block size = 256 minus the mask value in that octet. Subnets in that octet start at multiples of the block size.

1. Find the interesting octet and its block size.
2. Find the largest multiple of the block size that is less than or equal to the address's value in that octet: that is the network address (octets to the right become 0).
3. The next multiple minus 1 gives the broadcast (octets to the right become 255).
4. Hosts are network + 1 through broadcast − 1.

Worked example, interesting octet is the 4th: 172.20.77.205/27. Block size 32, so subnets start at .160, .192, .224. 205 is in the .192 block: network 172.20.77.192, broadcast 172.20.77.223, hosts .193 to .222.

Worked example, interesting octet is the 3rd: 10.60.42.19/21. Block size 8, so third-octet blocks are 32, 40, 48. 42 is in the 40 block: network 10.60.40.0, broadcast 10.60.47.255, hosts 10.60.40.1 to 10.60.47.254. With a mask shorter than /24 the subnet spans several third-octet values (here 40 to 47), so the broadcast is found from the block, not from the address's own third octet.

The broadcast address is also the directed broadcast a remote sender would target to reach every host on that subnet (for example, wake-on-LAN). Cisco routers do not forward directed broadcasts by default (no ip directed-broadcast); that forwarding behaviour is a router feature, but the address itself is always the subnet's last address.

An address is a valid host address when it is inside the subnet and is neither the network nor the broadcast address of that subnet, under its own mask. The last octet alone proves nothing once the mask is shorter than /24:

• 10.44.6.255/23 is a normal host: the /23 spans 10.44.6.0 to 10.44.7.255, so .6.255 sits in the middle.
• 172.25.18.0/22 is a normal host in 172.25.16.0/22 (172.25.16.0 to 172.25.19.255).
• 10.20.9.0/21 is a host in 10.20.8.0/21, but 10.20.8.0/21 is the network address itself.
• 172.25.30.192/26 is the network address of its subnet and 172.25.30.255/25 is the broadcast address of 172.25.30.128/25, so neither can be assigned.

IOS refuses an ip address command whose address is the network or broadcast address of its own subnet (the /31 case below is the exception), so a rejected command is often a sign that the address and mask do not make a host.

Same-subnet test. Two addresses share a subnet only if applying the mask to each gives the same network address. With 10.71.140.9/19 (block size 32 in the third octet), the subnet is 10.71.128.0 to 10.71.159.255: 10.71.131.4 and 10.71.159.200 are in it, while 10.71.127.250 and 10.71.160.3, just either side of the boundaries, are not. On a router-to-router link, both ends must land in the same subnet; if they do not, each router sees the other as off-link and pings fail even though both interfaces are up/up. The fix is to give one end an unused host address in the other end's subnet, with the same mask.

Sizing answers two questions, and exam-style requirements often state both.

Hosts per subnet: with h host bits a subnet has 2^h addresses and 2^h − 2 usable hosts. Count every device that needs an address, including the gateway (the router interface, SVI or subinterface), then choose the smallest h that fits. Examples:

• 100 cameras + 1 gateway = 101 → 6 host bits give 62 (too few), 7 give 126 → /25 (255.255.255.128).
• 126 kiosks + 1 gateway = 127 → a /25 gives exactly 126, one short → /24 (255.255.255.0).
• 500 laptops + 9 printers + 1 gateway = 510 → 9 host bits give exactly 510 usable → /23. Counting the network and broadcast addresses as devices (512 needed) pushes people to /22.

A larger subnet also fits, but a "smallest that fits" rule makes it wrong.

Number of subnets: borrowing s bits from a starting prefix gives 2^s equal subnets. Borrowed bits = new prefix − original prefix. Dividing 172.19.64.0/20 into /26s borrows 6 bits: 64 subnets of 64 addresses, 62 usable each. Modern IOS uses subnet zero and the all-ones subnet by default, so the count is 2^s, not 2^s − 2.

Both at once: the bits are a fixed budget. From a /16, every bit borrowed for subnets is a bit taken from hosts. With 172.27.0.0/16, 120 subnets need 7 bits (128) and 400 hosts need 9 bits (510): 7 + 9 = 16, so only /23 satisfies both. When a requirement says "at least N subnets and as many hosts as possible", borrow the fewest bits that reach N: from 172.22.0.0/16, 200 subnets need 8 bits (2^7 = 128 is too few), giving /24 (255.255.255.0). Always check a candidate mask against every stated requirement; neighbouring masks usually satisfy one and break the other.

Variable-length subnet masking (VLSM) divides one block into subnets of different sizes. It works as long as every subnet starts on a boundary that is a multiple of its own block size and no two ranges overlap.

1. Size each requirement (hosts + gateway → prefix).
2. Expand every existing allocation into its full range; the listed network address alone hides how far it extends.
3. Walk the free space from the lowest address and pick the first valid boundary for the new size that lies entirely in free space.

Example: in 10.90.4.0/24, Engineering has .0/26 (.0 to .63) and Finance .64/28 (.64 to .79). A 20-host VLAN needs a /27 (block 32), so candidates are .0, .32, .64, .96: the first one lying entirely in free space is 10.90.4.96/27. Free space starts at .80, but 80 is not a multiple of 32, so it can start a /28 at most.

A larger block must start on a larger boundary. On a router with 172.26.16.0/21 (172.26.16.0 to 172.26.23.255) and 172.26.24.0/24 already in use, a 900-host segment needs a /22 (1,022 usable), which must start on a third octet that is a multiple of 4. 172.26.24.0/22 would contain the existing /24, so the first free /22 is 172.26.28.0/22. Whatever host address you type in the ip address command, the mask decides which block it lands in.

When auditing a plan, list every allocation as a start–end range, including both halves of any /26 or larger, and only then look for gaps.

Point-to-point links and loopbacks have so few addresses on them that the usual network-and-broadcast overhead becomes the main design choice.

/30: 172.30.9.20/30 covers .20 to .23; .20 and .23 are reserved, so the two routers take .21 and .22. The next link starts at .24.

/31: RFC 3021 lets both addresses of a two-address block be used, because a link with only two ends needs no broadcast address. 192.168.77.14/31 holds exactly 192.168.77.14 and 192.168.77.15, so the far end takes the other address of the pair and there is no room for a third device. IOS accepts the even address even though it would be a network address under /30 rules; on an Ethernet interface it warns that a /31 mask should be used cautiously on interfaces that are not point-to-point.

/32: a loopback is virtual and has no neighbours on its subnet, so a host route uses exactly one address. Numbering loopbacks with /32s lets a single /24 serve up to 256 routers.

Public addresses are globally routable; RFC 1918 private addresses are reused inside organisations and reach the internet only through NAT; special-purpose blocks are neither and have fixed meanings. The exact boundaries are what matter.

The edges are the test. The 172.16.0.0/12 block covers second octets 16 to 31 only: anything from 172.16.0.0 to 172.31.255.255 is private, while 172.15.x.x and 172.33.x.x are public, as are 192.167.x.x and 9.x.x.x. When a whole prefix must be private, expand it to a range first: 172.20.0.0/14 (172.20–172.23) and 10.64.0.0/10 (10.64–10.127) are entirely private, while 10.0.0.0/7 also covers 11.x.x.x and is not.

Reading the clues: an outside address in 100.64.0.0/10 is not a public address: the ISP translates it again upstream (carrier-grade NAT), so nothing configured on the customer edge alone makes it reachable from the internet. A self-assigned 169.254.x.x address means the host requested a DHCP lease and received none; the problem to chase is DHCP reachability (covered in the DHCPv4 and client-connectivity lessons). No 127.x.x.x address can be used on a real interface for traffic between devices, because a host treats every 127 destination as itself and never puts the packet on the wire.

An IOS interface has exactly one primary IPv4 address, set with ip address <address> <mask>. Each address creates a connected route for its subnet.

• Re-entering ip address replaces the primary. The old address and its connected route disappear; IOS neither rejects the command nor keeps the old address as a secondary. Hosts using the old address as their gateway lose it.
• ip address <address> <mask> secondary adds another subnet to the same interface while the primary stays. This is how one untagged segment can carry two subnets, each with an on-link gateway, for example when a subnet runs out of space or a host with a fixed address sits in a different subnet from the router.
• Overlaps are refused. IOS will not configure an address whose subnet overlaps a subnet already connected on another interface (or the interface's own primary for a secondary). It prints a message naming the new network and the interface it collides with, in the form % <network> overlaps with <interface>. Masks may differ freely between interfaces; only overlapping ranges are refused.

Overlaps are found by expanding the ranges, because the typed address hides them. 172.29.64.1/21 spans 172.29.64.0 to 172.29.71.255 and therefore contains 172.29.70.0/24. On a switch with Vlan20 at 192.168.32.1/22 (192.168.32.0 to 192.168.35.255), a later 192.168.35.65/26 on Vlan40 falls inside it and is rejected, while 192.168.36.0/24 starts just after it and is accepted. Configuration is checked in the order entered: the second command of a colliding pair is the one refused.

The same check limits how far a mask can be widened. If Gi0/0 is 172.21.64.1 and Gi0/1 holds 172.21.68.0/24, a /23 or /22 on Gi0/0 (ending at 172.21.65.255 and 172.21.67.255) is accepted, but a /21 or anything shorter would swallow 172.21.68.0/24 and is refused.

Dynamic assignment and duplicates. Instead of a static address, an IOS interface can lease one as a DHCP client with ip address dhcp (common on an internet-facing interface); show ip interface brief then shows DHCP in the Method column, and the leased address and mask are installed like a static one. If another device already uses the interface's address, IOS logs a duplicate-address message, %IP-4-DUPADDR: Duplicate address <address> on <interface>, sourced by <MAC>, which names the MAC address of the other device. Hosts detect the same conflict by ARP (most operating systems report an address conflict and may refuse the address). Symptoms of an undetected duplicate are intermittent: connections drop or reach the wrong device as ARP caches flip between the two MAC addresses.

Verifying addresses:

So the absence of a secondary in show ip interface brief or show interfaces proves nothing; check show ip interface or the running configuration.

Troubleshoot by evaluating the on-link decision from each side separately: the sender's address and mask decide where it sends the request, and the receiver's (or router's) decide where the reply goes. A path can work in one direction and fail in the other.

Gateway outside the host's subnet

A host at 172.17.8.70/26 with gateway 172.17.8.1 (the router's 172.17.8.1/26) is in 172.17.8.64/26, while its gateway is in 172.17.8.0/26. The address is a valid host, but the gateway is off-link, so nothing beyond the segment works. A fix has to make both sides agree: the host must see the gateway as on-link, and the router must have a connected route covering the host so that replies can return. Normally that means an unused address inside the router's subnet, with the router's mask.

When a host's address must stay as it is, a secondary address on the router interface, inside that host's subnet, gives the host an on-link gateway and the router a connected route to it, without disturbing the hosts that use the primary.

Mask too short on a host

A host with 172.24.6.30/16 whose real segment is 172.24.6.0/24 thinks 172.24.9.10 is on-link and ARPs for it instead of using the gateway. Internet destinations still go to the gateway and work, which makes the symptom selective. IOS enables proxy ARP by default, so a router may answer that ARP and hide the error; with no ip proxy-arp the ARP goes unanswered and the connection fails. Proxy ARP never affects a host resolving the router's own address.

Mask too long on a host

With the router at 192.168.60.1/24, HostA at 192.168.60.200/25 and HostB at 192.168.60.30/24, HostA (in 192.168.60.128/25) sees .30 as off-link and sends the request to the router. The router's /24 includes .30, so it forwards the packet back out the same interface (and by default also sends HostA an ICMP redirect). HostB sees .200 as on-link and replies directly. The ping succeeds, which is why mask mismatches can stay hidden until the router is not there to help.

Mask too long on the router

If the router is 192.168.88.254/25 but the hosts use /24 and are spread across the whole /24, every host sees the gateway as on-link and sends to it. The router has only 192.168.88.128/25 connected: hosts in the upper half work, while replies to hosts in the lower half have no connected route and follow the router's other routes (for example, a default route); IOS may also ignore their ARP requests as coming from outside the interface's subnet. The router's mask has to describe the segment's real size before every host can be served.

A practical order

1. Write down each device's network address under its own mask.
2. Check the host and its gateway are in the same subnet from both points of view.
3. Check the address is not the network or broadcast address and is not duplicated (a duplicate-address log, a host conflict warning or an ARP entry that flips between MAC addresses).
4. Prefer the fix that changes the fewest devices while respecting any stated "must not change" constraint.