1

This Saturday my IT group will be working on increasing the range of our subnet. We have run out of leases, and we are going to bump it up. There is no general question that I have; we have put together a rough outline of an agenda to follow. I’m just looking for any advice from the Community from any of you that have gone through this. Anything to look out for, etc.?

Thanks in advance.

10 Spice ups
2

My advice, don’t do it by changing your subnet mask. If you reach the point of needing to change the subnet mask, it is time to start looking at migrating to multiple VLANS.

Can you give more detail about what your plan currently is?

2 Spice ups
3

I would look at the layout of where the IPs are and plan to break things down into smaller logical groups rather than just expanding the range of the subnet.

4

Well we actually do have multiple VLANs already. We have a VLAN for the hardwired machines on our network (the subnet we are looking to increase), a VLAN for our VoiP phones, and a VLAN for our wireless devices. The original scope of our business is what we were planning to change the subnet mask on. We only had 252 leases available in that scope, and for 30 years that was enough. Now, however, our company is taking on quite a bit more employees(thus, machines). We were just going to up our subnet to a scope of 4k leases which would be sufficient. If it ever becomes to small of a scope, by then we would have to look into a bigger enterprise option.

Does that make sense? That is how we saw it going down.

5

Why not change it to a class B subnet? Supernetting always makes me cringe. I know a lot of people do it, but all it takes is one important device that doesn’t support, but doesn’t tell you and you have a freaking out network for no apparent reason.

2 Spice ups
6

Well, we need to keep the static IP addresses of some of the servers that we have on our network. We were thinking we may just not even allow DHCP to pass out the first few hundred leases so we could reserve those for reservations for printers, servers, etc. We had a vision of:

  1. Hold reservations on our DHCP server that are currently there (servers, printers, etc.).

  2. Log onto those machines and set them to dynamically assign thus allowing the reservation to be held for the MAC address of that machine so it would be assigned the same IP.

  3. Change the subnet mask on the switches.

  4. We would then just have users restart machines to have them dynamically assigned to our new scope.

Are we missing any potential critical issues here? I could be leaving some things out that my Manager has accounted for.

7

I have a class B supernet here and have had one for about 12 years. It does give you lots of options. As for instance, I have two physical buildings. One has 192.168.101.x d(with the third octet being related to the room number) and for the other building we use 192.168.2xx.x with the third octet being the room number also. So 192.168.222.1 would be the first reservation in room 22. All of our wireless points,depending on their location, use the .254, so when we see the ip of 192.168.222.254, we know that it’s a wireless point in room 22. Additionally, all of our printers are on the 192.168.10.x, so anything with a 10.x ip is a printer. Second building we prefix the last octet with a 2, so we know that 192.168.10.222 is the printer in room 22 in the second building. It sorta makes things nice.

We use Excluded ranges on our dhcp server and change them as we need to. it’s all very consistent and it lets us know at a glance what we are looking at when viewing IP’s for whatever reason.

I doubt you’ll outgrow a 255.255.0.0 subnet, as it’s over 65k ip addresses available and if you do, can I come see your data center? :slight_smile:

1 Spice up
8

ACK! Do not make a /16 (class B) subnet. Why on earth would you need 65k addresses on one VLAN anyway? There are soo many reasons not to do this.

  • It is going to take a network scanner (spiceworks?) a very long time to scan and keep up with a /16 network.
  • The more devices you put on one VLAN, the more broadcast traffic there will be on every port
  • What if you wanted to VPN either to a vendor/client or for remote access for employees. What are the chances that your /16 subnet overlaps with their subnet at home? If that /16 subnet was 192.168 or 10.0 I would say the chances of you running into this issue at some point is 100%.
  • Why???

You best bet is to add a new vlan and logically split up your desktop PCs into this new vlan. My rule of thumb is /24 is the most number of hosts I would ever want to troubleshoot/have down at one time. A /23 is an absolute maximum for me if I am putting hosts on a network. BTW, as I understand it, it is not supernetting unless you do it in a range that was not originally intended to have such a network like 192.168 which was only intended to have /24 as a maximum size.

The more you can split up your network into smaller areas the better.

1 Spice up
9

I’m going to have to agree with Ryadical. By segmenting into additional VLANs/subnets you will also be able to apply more granular access controls (with an intermediary firewall or router) to your network AND since you’ll be creating more broadcast domains you’ll mitigate the chance that a broadcast storm or other large-scale DoS-type network threat could take down your entire network.*

If you’re looking at a network redesign and don’t already have a dedicated server VLAN/network I would look at carving out space for that (and perhaps a DMZ segment) as well. As your company grows you’re going to want to make sure that not just anyone who plugs a laptop into an open wall jack can attack your crucial devices. Not every network threat comes from outside your company you know…

*Yes, I realize BPDUGuard and RootGuard prevent this but lots of companies don’t know any better.

10

It may be a lesson hard learned later in the future, but I think we are going to stay the course in expanding our subnet. If VLANs become a necessity later on down the road, we will make the adjustment then. We most definitely do not need the 65k leases; we will not be expanding to that size. We just plan to expand for future growth. I don’t foresee us using more than 1000 leases anytime in the near to mid future, but we are going to open up the possibility just in case.

As far as expanding a subnet goes, is the process a smooth one? Any rough edges to look out for?

Thanks,

Jay

11

Sorry for the late reply but I was out of town.

The reason I tell people to always replace subnets with new ones instead of changing a subnet mask is because you can and will run into strange connectivity issues on devices that you forget to change to the new mask. What makes it even more difficult to troubleshoot is that they often can be intermittent problems due to factors such as proxy-arp. If you replace the subnet, everything should just work, or not work and you will know exactly where your problems are.

If you are dead set in not creating a VLAN, this would be my approach:

-Do not use a common default subnet such as 192.168.0.X or 10.0.0.X. Make it something more obscure so that it lessens the chance of ever having to make a connection to a network with the exact same subnet. For example use 10.11.77.0 or 192.168.128.0. (though I would stay away from 192.168 if you want a network bigger than /24 because some devices may not like your subnet mask)

  • Most routers can have a secondary ip address on an interface. Add a second IP in a different subnet to the internal interface of your default gateway. If you do this, you can run both networks at the same time and everything will work. You will also be able to tell (based on your routers arp table) which clients have switched to the proper IP settings and which ones have not. You can also use this process to create multiple secondary IP addresses and run one subnet for DHCP, one for servers, one for static devices. The advantage of doing it this way is that if/when you decide to switch to VLANS, you do not have to change any IP addresses or subnet masks, you just move the IPs to their respective VLANS. On a cisco router you can use the command similar to:

ip address 1.2.3.4 255.255.252.0 secondary

  • If you followed my last advice by adding it as a secondary ip, migrate everything in stages. Change the DHCP scope first. Next change the printers, and workstations with static IPs. Finally change all of the servers.

(if you didn’t follow my advice you need to do the complete opposite and change everything at once)

1 Spice up
12

Thanks for the reply, but we took the bull by the horns over the weekend on Saturday. We deleted our old scope and added a new one back over the top of it.

Prior to the weekend, I recorded all of the machines and devices that we had statically assigned. On Saturday morning, we remoted into each of these devices and changed the subnet to 255.255.240.0. We did our Cisco switch that acts as our Default Gateway last. We overlooked our wireless VLAN we had set up that was sitting within our new range that we were creating. We had to TelNet into the Cisco switch and remove the wireless VLAN interface in order for us to be able to change the subnet mask. Once we had done that, we then deleted our old scope and recreated it again with a bigger subnet. This ultimately allowed us to keep our statically assigned printers, machines, servers, and switches as they originally were.

Our original scope was a x.x.100.1-254. Making the subnet change expanded the range from x.x.96.0 through x.x.111.254. What we decided to do was not use the x.x.96.0 through x.x.99.255 range. We were going to keep it for future use with a possible 3rd DHCP server if we needed it. We then chose to only let our current DHCP server hand out leases from x.x.102.1 through x.x.106.254. This did 2 things for us: 1) It allowed us to have our x.x.100.x and x.x.101.x separate from DHCP so we could continue using static assignments there and 2) It allowed to us to institute a DHCP failover with our second Domain Controller. We are going to make it a DHCP server and give it the x.x.107.1 through x.x.111.254 scope. We thought having this failover would be a good thing in case we had an issue with our primary DHCP server.

We have not yet set up another wireless VLAN yet; we just set up our WAPs to point to our default scope we just created. We are delaying our wireless VLAN setup because we are going to also introduce a guest wireless account for the first time. So it looks like that will be our next project. From one thing to next. :slight_smile:

13

Jay, glad you got everything worked out. What are you doing for wireless (and BYOD) management these days?

14

Prior to our changes we made Saturday, we were doing nothing. I and two of my fellow IT group members attended Spiceworld 2013 in Austin to learn more about Spiceworks 7 and the new MaaS360 integration it has. Our company is starting introduce more and more tablets and mobile devices into our network, and MDM is something that we are going to begin looking into, I believe.

What approach do you take?

15

Jay, to be honest I’m still figuring it all out myself, which is why I asked :slight_smile:

That said, I drink a lot of Cisco Kool-Aid so you may want to check out the Cisco Meraki MDM solution. It includes geo tracking/fencing, remote lock/wipe, forced disk encryption, some centralized configuration (like WLAN credentials) and much, much more. And it has the best price on the market - FREE! If you want to learn more about it check out one of their webinars on the subject or just go to the Meraki homepage , click “Login” in the top-right corner and proceed with creating a free account and try it for yourself.

Just so you know, it does take a little work to go through Apple’s certificate enrollment process that allows you to enroll and send push notifications to your iOS devices so if you’re short on time it may actually be more efficient to check out a webinar at your leisure.

If you’re looking for a BYOD solution too I think the Meraki wireless solution has some capability for device-based access policies but I don’t have first-hand experience with it. The Meraki APs do have quite a bit of features rolled into them though and we don’t use nearly half of them. You can get a free AP to try it out for yourself if you’re even remotely interested though.

In addition to the Meraki solutions, my company is just starting up a Managed Service practice and our monitoring tool (N-Able) includes Mobile Device Management capabilities. On the surface it seems to be on-par with or have slightly less features than the Meraki solution. Perhaps that’s a good comparison for a future blog post…

Lastly, for the commercial to enterprise-sized clients, Cisco does have a BYOD/MDM solution that provides user-based Unified Access across wired, wireless, and BYOD devices. It’s a much more powerful solution compared to the other MDM-focused solutions here but again, it provides policy-based access across your whole infrastructure rather than just the mobile/tablet devices.

As a disclaimer, my company is a Cisco and Cisco Meraki partner and the webinar links are affiliate links. We’re a small single-site company but we do have a 100% Meraki network infrastructure, including a MX Security Appliance, MS Switching, and MR Access Points. And they’re awesome.

16

PS I’m more of a network and VoIP guy than Wireless guy but I’d be happy to get you pointed in the right direction for more info on any of these if you’re interested.

17

Phil thanks for the information! We will keep it in mind as we look further into MDM in the future.

18

Quite welcome. Keep us posted on what you end up going with - I always like hearing what other companies are deploying and why!