You inherit one flat /16 VLAN with 3,000 devices and one router as gateway. How do you segment it without a big outage?
Show the answer
Say this first
Discover first, then build the new design beside the old one and move devices in small groups. Map every device and flow from ARP and MAC tables, DHCP leases and NetFlow, and find the statically addressed devices. Stand up the new routed core and per-function subnets, move the old gateway onto it, then migrate DHCP clients closet by closet and static devices last with their owners. The old subnet stays routed until it is empty, and firewall rules start permissive with logging, then tighten.
Go deeper
1. Discover
- ARP table on the gateway and MAC tables on the switches: what exists and where it plugs in.
- Compare DHCP leases with ARP entries. Addresses in ARP but not in DHCP are static: printers, servers, PLCs, cameras, anything with a hard-coded IP.
- NetFlow or firewall logs show who talks to whom, which becomes the future rule set.
- Find IP dependencies: licenses bound to addresses, ACLs, monitoring, partner VPNs.
2. Build beside the old network
New core or distribution with SVIs for new subnets from a fresh block that does not overlap the old /16. Trunk the legacy VLAN to the new core.
3. Move the gateway
In a short window, move the legacy gateway address to the new core, ideally as the FHRP virtual address. The new gateway announces itself with gratuitous ARP; hosts that miss it relearn when their ARP entry expires. Now old and new subnets route in one place.
4. Migrate in waves
Per closet: change access ports to the new VLAN and bounce each port so the client sees a link down and asks DHCP for a new lease. Check, then move the next closet. Phones and printers by type.
5. Static devices last
Re-address them with their owners, or leave them in the legacy subnet for now and shrink it later.
6. Security
Allow everything between the new segments at first, but log it. Build rules from what you see, then switch to deny by default per segment.
7. Retire
When the legacy ARP table holds only known stragglers, finish them and remove the VLAN.
They will ask next
Why not just change the mask from /16 to /24s in place?
Every host would need a new mask and often a new gateway at the same moment, static devices would break, and there is no gradual rollback. It is a big bang on 3,000 devices.
Traps
- Forgetting statically addressed devices. They are always the long tail of the migration.