1

I want to make sure that I am going about this the right way. Currently we are using 192.168.0.x with a subnet mask of 255.255.255.0. We randomly test equipment that needs an IP address and therefore needs a large number of DHCP addresses available at any given time.

I want to expand our IP range and I want to make sure that I have this correct.

If I choose 192.168.0.1 with a subnet of 255.255.240.0 that should give me addresses all the way through 192.168.15.254, correct?

I realize that I would have to change the subnet mask on all my static devices in order for everything to work correctly, including my firewall. Is there anything else I am missing?

I want to reserve 192.168.0.x to servers, switches and printers only for static assignment. Sometimes our engineers need to use a static IP for their workstation when contecting a testing device, and I would arrange for them to use 192.168.1.x.

So then I would, for example, set 192.168.2.x through 192.168.15.x, for example, as DHCP. My DNS servers (2 Windows servers) would be in the 192.168.0.x range and are both DHCP servers. I could split the scope between the 2 if I wanted.

One questions I have for this scenario is, do I have to put in a zone in DNS for 192.168.0.x, 192.168.1.x, 192.168.2.x and so on, as well as a reverse or will it just pick this up on it’s own? I would still just have the GW address of 192.168.0.1.

Is there anything else I need to be aware of? I have seen companies use this many IPs before but I was never involved in the setup, and was never able to see how things were configured.

Thanks!

Lucy

12 Spice ups
2

In order to use that many subnets (16), you’d be moving from a class C to a class B private network. Class B networks usually use 172.16.X.X format.

Another option you could look at would be creating VLANs for each network since you’re wanting to group like devices together anyways. This will give you better security and functionality.

But to answer your question, yes a 255.255.240.0 mask yields 16 subnets for a total of 4094 hosts.

3

I did fail to mention one thing. We have a phone system that is managed by an external company. They chose 192.168.10.x as the IP range for the phones. This was my real reason for expanding the IP range out so far. 192.168.0.x-192.168.7.x would be more than enough for us. So that would be 255.255.248.0, correct? I could possibly convince the phone provider to change the IP range of the system though I have no idea how easy it is for him to do. He wants to be able to use our internal DNS so that the voicemail system can email voicemails and we are running O365, so it needs to go outbound.

Does that still push me into a Class B?

Thanks,

Lucy

4

While traditionally Class C subnets are /24 subnets, you can use up to a /16 within the specification.

The private IP address ranges are:

  • Class A: 10.0.0.0 - 10.255.255.255 (10.x.x.x/8)
  • Class B: 172.16.0.0 - 172.31.255.255 (172.16.x.x/12)
  • Class C: 192.168.0.0 - 192.168.255.255 (192.168.x.x/16)
1 Spice up
5

If I choose 192.168.0.1 with a subnet of 255.255.240.0 that should give me addresses all the way through 192.168.15.254, correct?

Yes, correct.

Is there anything else I am missing?

No. You can keep your gateway at 192.168.0.1 and use every address from 192.168.0.2 to 192.168.15.254 - including the ones in that range that end in .0.

So then I would, for example, set 192.168.2.x through 192.168.15.x, for example, as DHCP. My DNS servers (2 Windows servers) would be in the 192.168.0.x range and are both DHCP servers. I could split the scope between the 2 if I wanted.

Yes, absolutely.

One questions I have for this scenario is, do I have to put in a zone in DNS for 192.168.0.x, 192.168.1.x, 192.168.2.x and so on, as well as a reverse or will it just pick this up on it’s own? I would still just have the GW address of 192.168.0.1.

DNS can hold name records for any IP. It doesn’t care what your IP is. It only cares what your domain is. If you expand the network and re-ip a domain member host, it will re-register in DNS with the new IP.

1 Spice up
6

The phones can be inside your network range, on your LAN. They’ll be able to read the DNS server or any other host you have. The phones would use the same gateway as any other host. Just don’t assign those IPs to any other device.

7

This is my own practice and you can take it with a grain of salt.

When I start getting over 250 (/24) clients and the inevitable device sprawl my next step is 255.255.0.0

Why? Because 255.255.0.0 is a nice even number. The only thing I have to remember is 255.255.0.0

It’s internal RF 1918…I can do whatever the hell I want with it. Restricting your subnet according to max potential devices is fine for network tests and Cisco engineers who need a life but has no real value in RFC 1918. Devices create traffic…not how big your class range is.

I then drop devices into a 192.168.1.x or 192.168.2.x or 192.168.3.x or whatever. Servers go into the ‘1’ range, printers go in ‘2’ range, wifi cameras go in the ‘3’ range, DHCP goes in the 10-13 range, etc. I can use 192.168.99.x if I want to. Who cares…it’s 255.255.0.0. I’ve literally worked with engineers who think I need some OK from a Star Chamber at Cisco corp to use 255.255.0.0 on my own network.

What makes this nice is devices are now logically grouped and I can create Firewall groups and restrictions in a matter of seconds and administer them accordingly. I know that everything in the 3 range is a wifi camera…10-13 are DHCP devices…simple…nice. I can have 4 devices in the 192.168.7.x range…who cares. I know if it’s in the 7 range it’s a smart TV. A rogue anything shows up quickly and is easy to track.

2 Spice ups
8

Personally, I always use 10. addresses. So much neater, and far more scalable. 192.168 is so ugly, and 172.16 isn’t any better. I’m puzzled why anybody still uses these. These are private IP addresses, use them any way you want.

Also, the whole “Class A” etc thing is not relevant to anything anymore. It was relevant about a million years ago when devices made assumptions about masking based on the “Class” of the subnet, but not anymore.