0

I often hear that it is advisable when segmenting a network (VLSM) to have subnets that have a number of IPs that is as close as possible to the number of real machines.

I understand the usefulness of segmenting a network into subnets but why do you have to adjust their size? What is the problem of using a /24 mask for only 10 machines when it is a private network?

I think it is for security reasons (defense in depth) but are there other reasons?

Thanks a lot :)

Benoît
  • 103
  • 3
  • IP depletion mostly – Chopper3 May 11 '21 at 14:38
  • @chopper3 If it's on a private network we don't have this problem? – Benoît May 11 '21 at 14:43
  • Probably not then – Chopper3 May 11 '21 at 15:15
  • IMHO, defaulting to specific masks make it easier for the network administrator. E.g. my current client uses 10 / 8 for the company, /16 for each location and /24 for each room there, even if it's only a PC and a printer. This way there is hardly ever (e.g. data-centers may be different) a need to consult any documentation. – OttoEisen May 11 '21 at 15:59
  • Look at [this answer](https://networkengineering.stackexchange.com/a/33303/8499) that gives both sides. – Ron Maupin May 11 '21 at 19:19

2 Answers2

3

This sort of vague advice is based on the idea that IP addresses are a limited (and potentially costly) resource, so one should be as efficient as possible.

This doesn't really apply to private (RFC1918) addresses, since there are usually enough to go around.

You also have to balance this against the administrative cost of managing networks of different sizes, especially if the size has to change. Having lots of different subnet sizes is difficult to manage and troubleshoot. It's far easier to sacrifice a little efficiency for ease of management and ease of troubleshooting problems.

There are no security issues that come to mind.

Ron Trunk
  • 2,159
  • 1
  • 11
  • 19
2

I often hear that it is advisable when segmenting a network (VLSM) to have subnets that have a number of IPs that is as close as possible to the number of real machines.

I've never heard or read that. Can you cite any documentation that states as much?

What is the problem of using a /24 mask for only 10 machines when it is a private network?

There is no problem. Use a /24 if that's what you want to use.

I think it is for security reasons (defense in depth) but are there other reasons?

I don't see how the subnet size is related to security. Can you cite any documentation that states as much?

joeqwerty
  • 109,901
  • 6
  • 81
  • 172