Design an IP addressing plan for a company with a headquarters, two data centers and 40 branches.
Show the answer
Say this first
Hierarchical and summarizable. Take 10.0.0.0/8, give each large site a /16 and carve branches from one contiguous block, for example a /20 each from 10.16.0.0/14, which holds 64 branches and is advertised as one route. Inside every branch use the same layout, so the third octet offset tells you the function anywhere. Leave room for growth, cloud and VPN pools, and record it all in IPAM.
Go deeper
Company level
| Block | Use |
|---|---|
| 10.0.0.0/16 | Not used (a common default that clashes) |
| 10.1.0.0/16 | Headquarters campus |
| 10.2.0.0/16 | Primary data center |
| 10.3.0.0/16 | Secondary data center |
| 10.8.0.0/16 | Remote access VPN pools |
| 10.16.0.0/14 | Branches, a /20 each, 64 slots |
| 10.64.0.0/12 | Cloud VPCs and VNets |
| 10.255.0.0/16 | WAN transport: tunnel and point-to-point WAN subnets |
Branch level
Branch k (0 to 63) starts 16 x k further along in the third octet, rolling into the next second octet every 16 branches: branch 1 is 10.16.16.0/20, branch 15 is 10.16.240.0/20, branch 16 is 10.17.0.0/20. The layout inside branch 1:
| Offset | Branch 1 | Use |
|---|---|---|
| +0 | 10.16.16.0/24 | Wired users |
| +1 | 10.16.17.0/24 | Voice |
| +2 | 10.16.18.0/24 | Corporate wireless |
| +3 | 10.16.19.0/24 | Printers and IoT |
| +4 to +13 | 10.16.20.0 to 10.16.29.255 | Growth |
| +14 | 10.16.30.0/24 | Device management |
| +15 | 10.16.31.0/24 | Loopbacks (/32) and links (/31) |
What summarization gives you
Each branch advertises one /20. The WAN hubs advertise 10.16.0.0/14 toward the data centers and HQ, which then hold one route for every branch. Firewall rules and ACLs can say "all branches" in one line. A flapping branch subnet does not ripple through the network.
IPv6 alongside
A /48 per site and a /64 per VLAN. Writing the VLAN number into the fourth hextet keeps it readable: VLAN 10 at HQ could be 2001:db8:1:10::/64.
They will ask next
Why not hand out /24s as sites ask for them?
You get a random scatter: no summarization, routing tables and ACLs that grow with every subnet, and nobody can tell from an address where it lives. It works for ten subnets and becomes painful at a few hundred.
A branch outgrows its /20. What now?
Give it a second /20 from the branch pool. It stays inside 10.16.0.0/14, so the hub summary still covers it; the branch just advertises two routes. For the few large sites you expect, reserve the neighboring /20 up front so they can become an aligned /19.
Traps
- Forgetting alignment. 10.16.17.0/23 is not a valid block; a /23 must start on an even third octet.
- Leaving out cloud and VPN pools. They are where overlaps appear first.