private lan recommended ip addressing

D_wathi
D_wathi used Ask the Experts™
on
Dear Experts

to setup new office what IP addressing is recommended as it is common to use 192.168.1.0/24 but I would like to go for something different and this network will have to be get connected over the VPN from other location and they may be using 19.168.1.0/24,  this new network yet to be setup will have internal dns and dhcp and leased line and mpls connectivity. the total users or end devices within this network will not be more than 75, I prefer other than 192.168.1.0/24 is there a recommend/best  practice in selecting a particular ip addressing for private lan network please suggest,  is it good to go with 192.168.0.1/24 or something like 192.168.100.0/24 or any other ip addressing recommended please suggest.
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Dr. KlahnPrincipal Software Engineer
Commented:
You can use either of the following CIDR blocks:  10.0.0.0/8, 192.168.0.0/16.  If you stay within 192.168, you still have around 250 /24 blocks available.
JohnBusiness Consultant (Owner)
Most Valuable Expert 2012
Expert of the Year 2018
Commented:
Do not use .1 - too common . Use .109 or .87 or something that is little used. Why? You may want to implement VPN and will need a different subnet. Do it now while you have a good opportunity

Author

Commented:
thanks , if going for 19.168.87.0/24 , then the start ip to 192.168.87.1 to 192.168.87.254 can be used and netmask 255.255.255.0 please correct me is this okay.
Ensure you’re charging the right price for your IT

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

Andy MIT Systems Manager
Commented:
thanks , if going for 19.168.87.0/24 , then the start ip to 192.168.87.1 to 192.168.87.254 can be used and netmask 255.255.255.0 please correct me is this okay.

That is correct.

Author

Commented:
thank you very much and the main office will have 700 end devices please let me know non common ip addressing there also VPN connection will happen with start ip, and last ip and netmask please
JohnBusiness Consultant (Owner)
Most Valuable Expert 2012
Expert of the Year 2018

Commented:
VPN needs a Gateway (single IP) and then a "subnet" for access to all the devices. You need a large subnet.

But your overall thinking is correct.
nociSoftware Engineer
Distinguished Expert 2018

Commented:
For 700 end devices (and some network equipment you will need 1024 address-block.   (also check if you need room for future growth.

1024 addresses means you would need a /22 block of addresses if in one block,
You may want to separate in multiple subranges f.e.   so   central is split  from periferal,   Phones from Workstations, WiFi even separated from that, possibly in a few flavors (Guest, Personnel, Management WiFi lans f.e.).
I would recommend against putting 700 devices in one broadcast domain/subnet. Otherwise broadcasts start taking too much resources and it gets more challenging from a security perspective.

Better to split the network into logical VLANs such as servers, "voice VLAN", wired workstations, wifi, .... This way you can e.g. isolate the Wifi VLAN from the rest.

Each smaller VLAN can probably suffice with a /24 IP range.

Author

Commented:
thanks for the reply, can you please explain me on multiple subranges on how to for peripheral, phones, workstations , wifi. if we go for VLAN should each VLAN to be same IP addressing or different i,e 192.168.87.0 one vlan and 19.168.88.0 another vlan if done so then how does routing happen should we have to go for L3 switch which can do this for us, please suggest.
Software Engineer
Distinguished Expert 2018
Commented:
Each VLAN needs to have their own address range, otherwise they are relatively unreachable...
and only one will be reachable from the outside.
You will need a router to forward messages between the various VLAN's .
An L3 switch basically is a L2 siwtch with router built in.  You will at least need manageable switches with VLAN support.
Also you may need a firewall to shield access between VLAN's, that might be more filtering than an L3-switch can provide conveniently.
As noci writes, you do need a L3 switch (a good one with sufficient power) for routing between the VLANs. Each VLAN having a different address range.

A firewall is especially useful for added security for the Wifi and voice VLANs. The devices on these kind of VLANs are often more insecure and you probably want to limit access to the rest of your network. If you have a guest Wifi, I would even see this as an absolute requirement.

Author

Commented:
each VLAN having different/own address range does it mean vlan1 with the addressing of 192.168.108.0/24 and VLAN2 192.168.109.0/24 as both are different i,e 109.0/24 and other one 108.0/24 please suggest me.
Yes both need to be different as in your example.
nociSoftware Engineer
Distinguished Expert 2018

Commented:
Yes ANY (V)LAN you need to connent to / communicate with needs to have a separate address that is distingishable.
==> different.  Take also VPN connections to other Private address subnets into account in distributing addresranges.
Natty GregIn Theory (IT)

Commented:
my two cents
subnets easier to manage

you can set up your vlans like this

10.8.20.1/24  (servers)
10.8.30.1/24  (voicelans)
10.8.40.1/24  (corporate)
10.8.50.1/24  (guess)
10.8.60.1/24  (BYOD)
10.8.70.1/24 (testing lab)

there is you 1000 ips

all you need after that is rules for who is allowed to talk to who

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial