Designing an IP Addressing Plan for Your Company

In many companies, addressing is whatever the first modem or router decided: every device in 192.168.1.0/24, a few servers with addresses nobody remembers choosing, and printers whose addresses change from time to time. This is tolerable until the day the company opens a new branch, sets up remote work or wants to segment the network. From that day on, changing addresses means touching every piece of equipment.

Which Ranges Should You Use?

There are three standard private ranges for internal networks:

• 10.0.0.0/8
• 172.16.0.0/12
• 192.168.0.0/16

The 10.0.0.0/8 range offers the most space and gives more flexibility for multi-branch designs. Avoid very common ranges such as 192.168.0.0/24 and 192.168.1.0/24; these are also used by home routers, and when an employee connects from home over VPN, the address overlap prevents them from reaching company servers.

Never use public addresses, meaning addresses that belong to the internet, on your internal network; users’ access to the real services at those addresses on the internet will break.

A Hierarchical Plan

Readability is the most important quality of a good plan. A common pattern is to give each part of the address a specific meaning:

• Second octet: location or branch; for example, 10.1 for headquarters, 10.2 for the first branch and 10.100 for data center servers.
• Third octet: function or VLAN; for example, 10 for users, 20 for servers, 30 for phones and 99 for management.

With this pattern, the address 10.2.30.15 tells you without looking at the documentation: first branch, phone network. Each branch also gets a contiguous block that can be advertised as a single route, such as 10.2.0.0/16; this simplifies routing and firewall rules between branches.

Size of Each Subnet

• A /24 subnet has a maximum of 254 usable addresses and is sufficient and readable for most segments.
• If a segment has more devices, consider a /23 with 510 usable addresses, or split it into two VLANs.
• Avoid creating very large subnets, such as a full /16 for all users; it defeats the purpose of segmentation and increases broadcast traffic.
• For point-to-point links between routers, small subnets such as /30 or /31 are enough.

A Convention Within Each Subnet

A fixed convention inside every subnet speeds up troubleshooting. For example:

1. Address .1: the network gateway, meaning the firewall or Layer 3 switch.
2. Addresses .2 to .20: network equipment and servers with static addresses.
3. Addresses .21 to .49: DHCP reservations, such as printers.
4. Addresses .50 to .250: the DHCP range for regular devices.

It doesn’t matter if you choose exactly these numbers; what matters is that they are the same across all branches and segments.

Design and Rollout Steps

1. List all segments, branches and the number of devices in each, and leave room for several years of growth.
2. Define the hierarchical pattern and reserve blocks for future branches and services.
3. Record the complete address table in your network documentation before making any changes.
4. Change addresses in phases: low-risk segments first, then servers. Before changing a server’s address, identify the applications and devices that connect to it by IP address.

Common Mistakes

• Choosing a range that overlaps with a branch, a business partner or VPN users’ home networks.
• A plan with no room for growth that falls apart when the first branch is added.
• Entering servers’ IP addresses instead of their names in application settings.

Checklist

• An uncommon private range with no overlaps has been chosen.
• Each branch and each function has a defined address block.
• A consistent convention for the gateway, static addresses and DHCP
• Room for growth for new branches and segments
• The address table is documented and up to date.

It is best to prepare an addressing plan before connecting branches or segmenting the network. ITPlus724 engineers can design a plan that fits your company and carry out the migration without disrupting work.