How do you decide how many VLANs an office needs and how big each subnet should be?
Show the answer
Say this first
One VLAN per function per closet or switch stack: wired users, voice, printers and IoT, management, and guest kept away from everything internal. A /24 per access VLAN is the normal default, which caps the broadcast domain at 254 hosts and is plenty for one closet. I size for expected devices plus growth, keep the neighboring block free so a /24 can become a /23, and do not stretch VLANs between closets.
Go deeper
Example for one closet
| VLAN | Name | Subnet | Notes |
|---|---|---|---|
| 10 | USERS-C1 | 10.1.10.0/24 | Wired users in closet 1 |
| 20 | VOICE-C1 | 10.1.20.0/24 | Voice VLAN on the same ports |
| 30 | IOT-C1 | 10.1.30.0/24 | Printers, badge readers, cameras |
| 99 | MGMT | 10.1.99.0/24 | Switch and AP management |
| 999 | NATIVE-UNUSED | none | Native VLAN on trunks, no ports |
Closet 2 gets users at 10.1.12.0/24, keeping 10.1.11.0/24 free so closet 1 can grow into 10.1.10.0/23.
Quick sizes
| Prefix | Usable hosts | Typical use |
|---|---|---|
| /21 | 2046 | Large wireless client pool |
| /22 | 1022 | Wireless or guest pool |
| /23 | 510 | Large closet |
| /24 | 254 | Normal access VLAN |
| /27 | 30 | Small server or device group |
| /29 | 6 | Small transit or device group |
| /31 | 2 | Point-to-point link (RFC 3021) |
| /32 | 1 | Loopback |
Rules of thumb
- Keep VLAN numbers consistent per function across sites so people recognize them.
- Do not put users in VLAN 1. Use an unused VLAN as native on trunks.
- Wireless with a controller usually maps each SSID to one larger VLAN at the controller, or to a group of VLANs, instead of per-closet VLANs.
- Guest traffic goes straight to the internet through the firewall, never into internal subnets.
They will ask next
Why not one big /20 for all users in the building?
One broadcast domain and one spanning tree for the whole building, so one loop or noisy device affects everyone, and you lose the closet-level boundary for policy and troubleshooting. Address space is cheap in 10.0.0.0/8; failure domains are not.
Traps
- Sizing a subnet exactly to today's host count. Growth and DHCP lease overlap need headroom.