A numbering plan is no fun to write and very unpleasant to repair. The difference between a plan that grows and a plan that jams sits in two decisions: where the location lives inside the address, and how much room you leave for what you do not know yet.
The convention the tool uses
The tool works from one rule: the first two numbers are the location, the third number is the VLAN. A new VLAN starts at 10 with 192.168.10.1/24, the next one counts up by ten, and the third octet follows the VLAN number. Give a location on the network board the own address range 10.2, and that same plan becomes 10.2.10.1/24 there: the third and fourth octet stay put, only the first two are replaced.
That is the whole mechanism. You fill in the VLAN table once and give each location two numbers, and with that the address of every network in every building is settled.
The plan on one page
| VLAN | Used for | Head office 10.10 | Branch 10.21 | Branch 10.22 |
|---|---|---|---|---|
| 10 | Workstations | 10.10.10.0/24 | 10.21.10.0/24 | 10.22.10.0/24 |
| 20 | Guests | 10.10.20.0/24 | 10.21.20.0/24 | 10.22.20.0/24 |
| 30 | IoT and printers | 10.10.30.0/24 | 10.21.30.0/24 | 10.22.30.0/24 |
| 40 | Cameras | 10.10.40.0/24 | 10.21.40.0/24 | 10.22.40.0/24 |
| 50 | Voice | 10.10.50.0/24 | 10.21.50.0/24 | 10.22.50.0/24 |
| 99 | Management | 10.10.99.0/24 | 10.21.99.0/24 | 10.22.99.0/24 |
Someone seeing this page for the first time can read 10.21.40.17 as: branch 21, camera VLAN, device 17. That is the entire point.
Room to grow
- VLANs in steps of ten. Between 10 and 20 sit nine numbers you never need until you need them. The tool does this by itself on every new row.
- Do not start locations at 1. Begin at 10 for the head office and 21 for the first branch, and keep 11 to 19 free for whatever turns up at the head office. 10.1 and 10.2 look tidy until you have twenty locations and they mean nothing.
- Group by region or kind. 10.2x for branches, 10.3x for warehouses, 10.4x for home workers. Firewall rules can then be written against blocks instead of against every location separately.
- Management at the top. 99 stays 99, whatever else arrives. A fixed number for the management VLAN is the one convention nobody ever regrets.
Do not use 10.255 as a location range. The tool takes tunnel transfer networks from 10.255.255.0 and counts up by four per tunnel, with room for 64 of them. Leave that block alone.
Where the third octet runs out
VLAN ids go up to 4094, an octet goes up to 255. The convention therefore works up to VLAN 254; above that the tool fills the address in at 254 and you have to invent the rest. Stay under 254 if you want to keep the convention, or break it deliberately and write down why. Doing it halfway is the worst of the three.
Inside a /24
The tool divides a /24 the same way every time. The router takes .1. The DHCP pool runs from .10 to .254. In between, .2 to .9, is the room for fixed addresses.
| Range | Used for |
|---|---|
| .1 | The router on this VLAN |
| .2 to .9 | Switches, access points, other fixed equipment |
| .10 to .254 | DHCP |
Switches and access points in a site get their management address from that block: the tool counts on from the router's address in the order the devices appear in the site, so .2, .3, .4. That also means you start with eight fixed addresses per VLAN. If you need more, say for twenty cameras with fixed addresses, shrink the pool after pasting:
/ip pool set pool-vlan40-cam ranges=10.21.40.100-10.21.40.254Never put a fixed address inside the pool. The tool warns about it when you give a device on the board an address: that address is inside the DHCP range, keep fixed addresses outside it or the router may hand out the same one.
What the checks verify for you
- Two locations on the same range, or a range that is not two valid numbers.
- Two locations whose routers end up on the same subnets. The tool says explicitly that you will not be able to join them over a VPN later.
- Two devices with the same address, across the whole site, not only within one device.
- A VLAN that is not in the site table, or a planned host on a VLAN that does not exist.
- An address outside its own network, or on the network or broadcast address, or on the router's own address.
Three things that go wrong often
- Addresses that are not private. Private is
10.0.0.0/8,172.16.0.0through172.31.255.255and192.168.0.0/16. Something like172.168.30.0looks private and belongs to someone else. You find out when a service at that address turns out to be unreachable. - A /30 for a management network. Two usable addresses is enough for a point-to-point link, not for a switch, two access points and yourself.
- 192.168.1.0/24 or 192.168.0.0/24 at a location. That is the network of every home router on earth. A home worker coming in over a VPN then has your office network sitting in their living room.
Further reading: Planning addresses, Planning VLANs and Rolling out twenty branches.