Enterprise networking projects

IP Addressing, Subnetting and VLAN Plan

The proposed addressing scheme for all three sites: department-level VLANs, matched subnets, reserved infrastructure capacity, and the WAN transit block.

Project
IPv4 addressing and VLAN plan — three sites
Focus
Subnetting, gateway placement, DHCP scope, capacity headroom
Outcome
105 automated assertions confirm the plan and the published figures agree

Design principles

  • No flat site network. Every department, server group, wireless network, printing pool, CCTV segment and management range sits on its own VLAN and subnet.
  • Infrastructure capacity is reserved separately from users. Network devices and peripherals cannot consume a department’s address pool.
  • Masks are sized to the requirement rather than defaulting to /24 everywhere: the head office uses /24 per department where 100 users across four departments justify it, while the branch and Egypt offices use /26 and /27 so the subnetting is real.
  • Addresses are reserved consistently: gateway at the first usable address, network infrastructure in the low static range, and the DHCP pool above it.
  • Summarisation is designed in: each site is one block, so a single route advertisement covers it.

Three-site topology

Three-site network overview: Riyadh head office, Riyadh branch office and Egypt satellite officeThe head office connects to a WAN cloud over a primary link. The branch office and the Egypt satellite office each connect to the same WAN cloud; the Egypt link is shown dashed because site-to-site VPN security is a design element rather than a demonstrated lab feature.WAN / ISP10.250.0.0/16 transitRiyadh Site 1 — Head OfficeCore + access switching · central services10.10.0.0/16 · 100 endpoint users11 VLANs · servers, voice, CCTV, mgmtRiyadh Site 2 — BranchBranch router + switching10.20.0.0/16 · 60 endpoint users7 VLANs · guest isolationEgypt — Satellite OfficeRemote LAN + secure WAN (design)10.30.0.0/16 · 50 endpoint users7 VLANs · local servicesprimary link · OSPFbranch link · OSPFVPN tunnel — design only
Figure 1 — Proposed three-site topology. Original diagram; the Egypt VPN path is a documented design, not a demonstrated lab feature.

Capacity check

The endpoint user figures count people with a device. They exclude switches, routers, firewalls, wireless access points, network printers, shared peripherals, servers, IP phones, CCTV cameras and other network-connected infrastructure — all of which have their own reserved capacity below.

Endpoint requirement against usable address capacity per site
SiteEndpoint requirementUsable capacity — user VLANsReserved — infrastructure VLANsHeadroom
Riyadh Site 1 — Head Office1001142308+1042
Riyadh Site 2 — Branch Office60186152+126
Egypt — Satellite Office50186152+136

Usable capacity excludes the network and broadcast address of each subnet and is computed from the subnets in the tables below.

Riyadh Site 1 — Head Office

10.10.0.0/16Design only

Headquarters · core and access switching, central services, WAN hub · 100 endpoint users

VLAN allocation table for Riyadh Site 1 — Head Office
VLANNamePurposeSubnetUsableGatewayStatic reserveDHCP pool
10HQ-USERS-ASales & Marketing (30 endpoints)10.10.10.0/2425410.10.10.110.10.10.2–10.10.10.2110.10.10.22–10.10.10.254
20HQ-USERS-BFinance & Accounts (20 endpoints)10.10.20.0/2425410.10.20.110.10.20.2–10.10.20.2110.10.20.22–10.10.20.254
30HQ-USERS-CHR & Administration (15 endpoints)10.10.30.0/2425410.10.30.110.10.30.2–10.10.30.2110.10.30.22–10.10.30.254
40HQ-USERS-DOperations & Technical (35 endpoints)10.10.40.0/2425410.10.40.110.10.40.2–10.10.40.2110.10.40.22–10.10.40.254
50HQ-SERVERSDomain controller, DNS, DHCP, file services10.10.50.0/266210.10.50.110.10.50.2–10.10.50.2110.10.50.22–10.10.50.62
60HQ-VOICEIP telephony handsets10.10.60.0/266210.10.60.110.10.60.2–10.10.60.2110.10.60.22–10.10.60.62
70HQ-WLAN-CORPStaff wireless10.10.70.0/2512610.10.70.110.10.70.2–10.10.70.2110.10.70.22–10.10.70.126
80HQ-WLAN-GUESTGuest wireless (isolated)10.10.80.0/266210.10.80.110.10.80.2–10.10.80.2110.10.80.22–10.10.80.62
90HQ-PRINTNetwork printers and shared peripherals10.10.90.0/273010.10.90.110.10.90.2–10.10.90.2110.10.90.22–10.10.90.30
100HQ-CCTVCCTV cameras and recorder10.10.100.0/266210.10.100.110.10.100.2–10.10.100.2110.10.100.22–10.10.100.62
110HQ-MGMTSwitches, router, APs, out-of-band management10.10.110.0/273010.10.110.110.10.110.2–10.10.110.2110.10.110.22–10.10.110.30

Riyadh Site 2 — Branch Office

10.20.0.0/16Design only

Branch · router and switching, inter-site routing · 60 endpoint users

VLAN allocation table for Riyadh Site 2 — Branch Office
VLANNamePurposeSubnetUsableGatewayStatic reserveDHCP pool
10BR-USERS-ABranch staff — sales and operations10.20.10.0/266210.20.10.110.20.10.2–10.20.10.2110.20.10.22–10.20.10.62
20BR-USERS-BBranch administration and finance10.20.20.0/266210.20.20.110.20.20.2–10.20.20.2110.20.20.22–10.20.20.62
30BR-SERVERSLocal file and print server10.20.30.0/273010.20.30.110.20.30.2–10.20.30.2110.20.30.22–10.20.30.30
40BR-PRINTPrinters and shared peripherals10.20.40.0/273010.20.40.110.20.40.2–10.20.40.2110.20.40.22–10.20.40.30
50BR-WLANBranch staff wireless10.20.50.0/266210.20.50.110.20.50.2–10.20.50.2110.20.50.22–10.20.50.62
60BR-GUESTGuest wireless (isolated)10.20.60.0/266210.20.60.110.20.60.2–10.20.60.2110.20.60.22–10.20.60.62
70BR-MGMTSwitches, router, access points10.20.70.0/273010.20.70.110.20.70.2–10.20.70.2110.20.70.22–10.20.70.30

Egypt — Satellite Office

10.30.0.0/16Design only

Satellite · remote LAN, secure WAN connectivity · 50 endpoint users

VLAN allocation table for Egypt — Satellite Office
VLANNamePurposeSubnetUsableGatewayStatic reserveDHCP pool
10EG-USERS-AEgypt staff — operations and technical10.30.10.0/266210.30.10.110.30.10.2–10.30.10.2110.30.10.22–10.30.10.62
20EG-USERS-BEgypt administration and finance10.30.20.0/266210.30.20.110.30.20.2–10.30.20.2110.30.20.22–10.30.20.62
30EG-SERVERSLocal services10.30.30.0/273010.30.30.110.30.30.2–10.30.30.2110.30.30.22–10.30.30.30
40EG-PRINTPrinters10.30.40.0/273010.30.40.110.30.40.2–10.30.40.2110.30.40.22–10.30.40.30
50EG-WLANOffice wireless10.30.50.0/266210.30.50.110.30.50.2–10.30.50.2110.30.50.22–10.30.50.62
60EG-GUESTGuest wireless (isolated)10.30.60.0/266210.30.60.110.30.60.2–10.30.60.2110.30.60.22–10.30.60.62
70EG-MGMTSwitches, router, access points10.30.70.0/273010.30.70.110.30.70.2–10.30.70.2110.30.70.22–10.30.70.30

WAN transit and loopbacks

WAN links and router loopbacks live in their own block — 10.250.0.0/16 — so a single site summary route can never leak into a site’s departmental address space.

Point-to-point WAN links and router loopbacks
LinkSubnetSide ASide B
HQ ↔ Riyadh Branch10.250.0.0/3010.250.0.1 (R-HQ)10.250.0.2 (R-BR)
HQ ↔ Egypt10.250.0.4/3010.250.0.1 (R-HQ)10.250.0.2 (R-EG)
Router loopbacks10.250.255.0/24Used as OSPF router IDs and stable management targets

Routing between sites is designed with OSPF, using router loopbacks as router IDs and stable management targets. Site blocks and the WAN block are summarised deliberately so one route advertisement per site is enough. The Egypt link's site-to-site VPN is a documented design, kept separate from anything demonstrated in a lab — see the capability notes on the project page.

Reserved for growth

Address space held back deliberately and documented here so it is not allocated by accident.

  • 10.10.111.0/24 Held for future head office growth; the remainder of 10.10.0.0/16 is unallocated.

Lab verification

Content pending — SwitchLab verification output for this addressing plan

The plan is designed but not yet built in the lab. Verification output — interface addressing, routing tables, DHCP leases and connectivity tests — is published here once produced, never before.