Skip to content
Log in Sign up My account

1.1 Structured IPv4 and IPv6 Addressing Plans

Blueprint 1.1: Structured IPv4 and IPv6 addressing plans

  • Hierarchical, summarizable IPv4 plans (VLSM, bit-boundary allocation, growth reserve)
  • IPv6 plans (prefix sizing, nibble boundaries, site and function hierarchy, ULA versus GUA)
  • Point-to-point, loopback and management addressing conventions
  • Address plan impact on summarization, filtering, security policy and migration

An addressing plan is a routing design decision. A routing protocol can only summarize what the address plan lets it summarize, so a poor plan caps how stable and scalable every later design can be. On the exam, "structured" means hierarchical and aligned to the topology, so that one summary route can represent one failure domain.

Principles of a structured plan

Principle What it means What breaks without it
Hierarchy follows topology One contiguous block per region, then per site, then per function Summaries are impossible, so the routing table grows with every subnet
Bit-boundary allocation Blocks sized in powers of two, aligned to their size Summaries cover addresses that belong elsewhere, or several summaries are needed
Growth reserve Unused space left inside each block Adding a VLAN forces a new, non-summarizable prefix
Function separation Distinct ranges for users, voice, servers, infrastructure, management, guest ACLs, QoS classification and policy become long lists of exceptions
Consistency The same offsets used in every site Automation, templates and troubleshooting get harder

IPv4 allocation example

A company has four regions, each with up to 16 sites, and each site needs up to 8 subnets of /24 size. A consistent plan from 10.0.0.0/8:

Level Size Example
Region /17 (16 sites of /21) Region 1 = 10.0.0.0/17
Site /21 (8 subnets of /24) Site 2 of region 1 = 10.0.8.0/21
Subnet /24 inside the site block Users = 10.0.8.0/24

Do the arithmetic before you accept a plan. With 8 subnets of /24 per site, each site needs a /21 (8 x /24). Sixteen sites of /21 need a /17 per region (16 x /21 = 128 x /24 = /17). Four regions of /17 fit comfortably in 10.0.0.0/15. This leaves most of the 10/8 space free for growth, acquisitions and a separate infrastructure range.

graph TB
    ROOT["10.0.0.0/8 enterprise"] --> R1["Region 1: 10.0.0.0/17"]
    ROOT --> R2["Region 2: 10.0.128.0/17"]
    ROOT --> R3["Region 3: 10.1.0.0/17"]
    ROOT --> INF["Infrastructure: 10.250.0.0/16"]
    R1 --> S1["Site 1: 10.0.0.0/21"]
    R1 --> S2["Site 2: 10.0.8.0/21"]
    S1 --> U["Users 10.0.0.0/24"]
    S1 --> V["Voice 10.0.1.0/24"]
    S1 --> SV["Servers 10.0.2.0/24"]

Each region advertises one /17, each site one /21 to its regional hub. A site failure never changes the region summary.

Special-purpose IPv4 ranges to know

Range Use in design
10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 RFC 1918 private space. The enterprise default.
100.64.0.0/10 Shared address space (RFC 6598) for carrier-grade NAT. Useful as a non-RFC-1918 range when two merged companies both used 10/8. Not for general internet use.
169.254.0.0/16 Link-local. Seeing it on a host means DHCP failed.
/30 and /31 Point-to-point links. A /31 (RFC 3021) halves the space used by links and is supported on IOS XE routed interfaces.
/32 Loopbacks, router IDs, anycast and RP addresses

Infrastructure addressing conventions

Keep infrastructure separate from user space, because infrastructure addresses are the ones you protect with ACLs, CoPP, prefix filters and management ACLs.

  • Loopbacks from a dedicated /32 pool: one for the router ID and routing sessions (iBGP, MPLS LDP, tunnels), another for management if policy requires. Stable regardless of physical failures.
  • Point-to-point links from a dedicated pool, ideally summarizable per router pair or per site. Some designs use unnumbered or avoid advertising link prefixes at all (see prefix suppression in OSPF Design and the IS-IS equivalent in IS-IS and EIGRP Design).
  • Management in its own range, reachable out of band where possible. The VRF and management-network design belongs to the Network Services domain.
  • Anycast and RP addresses from a /32 range that is easy to identify in filters.

Exam trap

An addressing plan that is "efficient" (every subnet sized exactly to its host count and packed tightly) is usually the wrong answer when the question mentions summarization, growth or stability. Exam answers reward summarizable and aligned over dense. Wasting some space to keep a hierarchy is the intended trade-off.

IPv6 addressing plans

IPv6 removes the need to conserve addresses, so the design goals shift entirely to hierarchy, simplicity and security.

Item Guidance
Allocation from the provider or RIR Typically a /32 for an ISP and a /48 for an enterprise site or a /40 to /32 for a larger enterprise. Use what you are allocated.
Per site A /48 per site gives 65,536 /64 subnets. A /56 per site is common for smaller branches.
Per subnet Always /64 for LANs. SLAAC, neighbor discovery and many security features assume a 64-bit interface identifier.
Point-to-point links /127 (RFC 6164) is the recommended length to avoid ND cache exhaustion attacks on /64 links; /64 reserved but unused is also common, and /126 works.
Loopbacks /128
Boundaries Allocate on nibble (4-bit) boundaries (/48, /52, /56, /60, /64) so every prefix is readable as hex digits and summaries land on a digit

Example hierarchy inside one /48 site block, 2001:db8:a001::/48:

2001:db8:a001:0000::/52  user VLANs   (16 x /56 or up to 4096 /64)
2001:db8:a001:1000::/52  voice and video
2001:db8:a001:2000::/52  servers
2001:db8:a001:f000::/52  infrastructure and management

The fourth hextet encodes function in its first digit. A firewall rule can match "all voice in all sites" by a pattern, and one /52 summary per function is available if you ever need it.

GUA versus ULA

Type Prefix Routable on the internet Typical use
Global unicast (GUA) 2000::/3 Yes User and server addressing
Unique local (ULA) fc00::/7, in practice fd00::/8 with a random 40-bit global ID No Internal-only systems, management networks, stable addressing independent of the ISP
Link-local fe80::/10 No, one link only Neighbor discovery, next hop for routing protocols

Do not plan on NAT66 to hide addresses. If you want addresses that do not change with the provider, use provider-independent space from the RIR or accept renumbering, and use ULA for internal-only services. IPv6 routers, hosts and applications routinely hold both a GUA and a ULA, and source address selection (RFC 6724) chooses between them, which is a design detail to test.

Exam trap

Using a prefix longer than /64 on a host LAN (for example /112 to "save space") breaks SLAAC and some first hop security features. If a stem asks for stateless autoconfiguration, the subnet prefix must be /64.

Address plan and policy

A good plan makes policy cheap:

  • Summaries: one prefix per site or region to the core, as shown above.
  • ACLs and firewall rules: one rule per function range, not per subnet.
  • QoS and classification: voice ranges recognizable by prefix when markings cannot be trusted.
  • Segmentation: VRF or SD-Access virtual network membership follows address blocks where possible.
  • Merger and acquisition: keep a reserved block ready, and plan NAT or a renumbering project when two companies overlap in RFC 1918.
graph LR
    ACQ["Acquired company 10.0.0.0/8 overlaps"] -- "NAT at boundary" --> CORE["Enterprise core"]
    ACQ -. "long term: renumber into reserved block" .-> CORE

Design exercise

Scenario. A retailer has 3 regional offices and 240 stores. Each store needs 4 subnets (POS, voice, wireless, infrastructure), none larger than 62 hosts. Each region will grow to at most 100 stores. The company currently uses 10.0.0.0/8 and has just acquired a competitor that also uses 10.0.0.0/8 with 50 sites. The network team wants regional summaries and no more than one prefix per store advertised to its regional hub. IPv6 deployment starts next year.

Requirements and constraints.

  • One IPv4 summary per store and one per region.
  • Room for growth to 100 stores per region.
  • The acquired company's addressing cannot be renumbered for 18 months.
  • A single IPv6 plan must be able to mirror the IPv4 hierarchy.
Model answer

Stores: each needs 4 subnets of up to 62 hosts, so four /26 subnets, which fit in one /24. Allocate a /24 per store. This gives a single advertised prefix per store and leaves no wasted aligned space that would split the summary.

Regions: 100 stores needs 100 x /24, and the next power of two is 128 x /24, which is a /17 per region. Three regions use three /17s (for example 10.16.0.0/17, 10.16.128.0/17 and 10.17.0.0/17), leaving the fourth /17 spare for a fourth region.

Acquisition conflict: the acquired company's 10.0.0.0/8 overlaps with ours. Keep the enterprise plan in a different part of the space (for example 10.16.0.0/12 and up, away from the low prefixes the acquired company is most likely to use) and place NAT at the boundary for 18 months, translating the acquired company into 100.64.0.0/10 or a dedicated block, then renumber site by site. Rejected: renumbering the acquired company first (violates the 18-month constraint), and merging the two flat 10/8 spaces (creates ambiguous routing).

IPv6: a /48 per store would be excessive for a 4-subnet site, so use a /56 per store from a /48 per region (256 /56 blocks per /48, which covers 100 stores). The first byte of the fourth hextet then identifies the store and the second byte the function (users, voice, wireless, infrastructure), mirroring the IPv4 split. Rejected: a /64 per store (leaves no room for the four VLANs), and any non-nibble boundary.

Infrastructure: a separate /16 for loopbacks and /31 links so none of it appears in the store summaries.

Quick check

A site needs 5 subnets of up to 100 hosts each and expects to double. What block should it be allocated to stay summarizable?

Each subnet is a /25. Five rounds up to eight, and doubling gives sixteen, so a block of 16 x /25 = 8 x /24 = /21. Allocating a /22 or /23 would force a second, non-contiguous block at growth.

Why is /127 recommended on IPv6 point-to-point links?

A /64 link with only two devices allows an attacker to send traffic to a large number of nonexistent addresses on the link, filling the neighbor cache of the router (ND exhaustion). A /127 limits the addresses to the two real ones (RFC 6164).

Which IPv6 address type is intended for internal-only addressing that survives a change of ISP?

Unique local addresses (ULA, fd00::/8 with a random global ID). Provider-independent GUA is the other option when internet reachability is also needed.

References

  • RFC 1918 (private address space), RFC 6598 (shared address space), RFC 3021 (31-bit prefixes) at rfc-editor.org
  • RFC 4193 (unique local addresses), RFC 6164 (/127 on inter-router links), RFC 6177 (IPv6 address assignment to end sites)
  • Cisco Enterprise Campus and WAN design guides (search "Cisco Validated Design campus" on cisco.com)
  • Cisco Live On-Demand Library: search "IPv6 addressing plan" and "enterprise IP addressing design"