Chapter 7Subnetting via TCP/IPIn This Chapter Learn what subnetting is Learn what subnetting isn’t Determine subnetting requirements Master subnet-related calculationsTCP/IP, of course, is a study into itself. Mastering the TCP/IP protocol suitein Windows 2000 Server is much more than understanding what IPaddresses, subnet masks, and default gateways are. Mastering TCP/IP is akinto mastering mathematics. That is, while you might be hired as a Windows2000 Server network administrator, having mastered TCP/IP enables you tobe successful when troubleshooting and tackling those network issues thatsimply aren’t covered in the books.Learning the fine art of subnet masking is akin to learning how to operate asailboat. What? How can that be? Here’s how. Sailing has best been describedas an endeavor that requires only common sense to be successful. That said,many of us who sail could improve our skills dramatically if we onlysharpened our common-sense skills. Subnetting is very much the same assailing: not terribly difficult, but making heavy use of our common-senseskills. So here we go!What Subnetting IsSubnetting is really the implementation of the divide-and-conquer strategy inthe TCP/IP community. Routers are used to divide, or subnet, networks intomultiple physical segments. So what comprises the conquering part? First onthe list is simplification. Whenever confronted with a tough problem or acomplex area, something that subnetting certainly is, a tried-and-truetroubleshooting strategy is to divide the problem into smaller elements thatyou can manage, solve, and conquer, if you will. Thus, by subdividing a largenetwork into smaller subnets, we conquer the network in our battles, not viceversa. So why would you do this? There are several benefits to subnettingincluding ease of administration, conservation of limited IP addresses, tighter4620-1 ch07.f.qc 10/28/99 12:02 PM Page 265and improved security, and more efficient use of networking resources viatraffic management.Easier administrationAdministration potentially is made easier by subnetting because you cansubdivide a large network logically and physically by routers. A cleannetwork is a happy network. The use of subnetting, properly done, enablesyou to organize your networks. And don’t overlook the harsh reality ofcorporate politics on your network. Subnetting allows you to divide yourenterprise-wide network along political boundaries. How? Remember that thecomplete trust domain model typically was implemented when no onetrusted each other and every little kingdom of users and resources had to beaccommodated. With subnetting, we can create little LANs that reflectdifferent groupings of users, resources and, in the language of the Windows2000 Server, objects.Less confiningSubnetting enables you to make network planning decisions without regardfor the single LAN cable, if you so desire. Whereas many of us old-timers inthe industry traditionally think of a network segment or subnet as a physicalcable run, with subnetting you have the opportunity to think much morelogically. Multiple TCP/IP subnets can exist with ease on a cable segment,allowing you to divide your network into small networks for reasons knownonly to you and God.Likewise, you also may join unlike IEEE standards and media into a singlesubnet using subnetting, so users on a Token Ring network maycommunicate with users on an Ethernet network. These users are joinedtogether on a single, logical IP network using subnetting.IP address conservationIn other sections of this book, I tout Microsoft Proxy Server as a way to saveprecious IP addresses. Properly implemented, IP subnetting enables one real,or Internet-registered, address to be partitioned into numerous internalnetwork addresses. Here, the router correctly routes packets between theexternal network or Internet and the internal or subnetted network. IPaddress conservation should be a fundamental guiding principle in yourWindows 2000 Server network design and planning efforts.Improved securityProperly implemented, subnetting can improve your network’s security fromexternal intruders. That’s because, as implied above, the router routes266 Part II: TCP/IP■ ■4620-1 ch07.f.qc 10/28/99 12:02 PM Page 266between the visible external network and the invisible networks in yourorganization. And while we consider justice to be blind in America, innetworking we know that peace is maintained the more that we make ourinternal networks invisible to external intruders. But don’t get me wrong.This security discussion in no way substitutes for a real firewall. It only ismeant to encourage you to think from a secure perspective when consideringthe design of your network.Another name for switching?What happens if ten WAN engineers get together to create a subnetting planfor a network? Inevitably, the discussion becomes one of routers versusswitches. Properly implemented, we can direct traffic to its location efficientlywithout having to be evaluated by computers all across the network. In effect,we can use subnetting to create smaller networks that logically are designedto keep traffic within the neighborhood (see Figure 7-1). We also can usesubnetting to reduce broadcasts in a similar manner.Figure 7-1: Subnetted or smaller networks within the larger networkSubnet 1Subnetting can reducenetwork traffic congestionby effectively limitingcertain traffic to onesubnet (dicted packetsand broadcasts)204.107.6.XXXSubnet 2204.107.7.XXXCompany Network204.107.7.109204.107.6.111Chapter 7: Subnetting via TCP/IP 267■ ■4620-1 ch07.f.qc 10/28/99 12:02 PM Page 267Bottom line?Know thy router when designing a network via subnetting. The router needsto be told how to distinguish between the host and network addresses. Butmore on that in a moment when we get into the details. Remember thatsubnetting provides planning and design flexibility and integrationpossibilities in ways you may or may not perceive today, but most likely willappreciate tomorrow.What Subnetting Isn’tSubnetting is not some elixir that cures fundamental design errors in yournetwork. In fact, the use of subnetting in a flawed network may compoundproblems, forcing you to return to the basics.OK, so you subnet your network into several smaller networks. What’s thedownside to that? You’ve allocated a portion of the bit pattern to the networkaddresses, thus limiting the quantity of host addresses on each of the smallernetworks. There are only so