Access List Tutorial

February 13th, 2011 Go to comments

In this tutorial we will learn about access list.

Access control lists (ACLs) provide a means to filter packets by allowing a user to permit or
deny IP packets from crossing specified interfaces. Just imagine you come to a fair and see
the guardian checking tickets. He only allows people with suitable tickets to enter. Well, an
access list’s function is same as that guardian.

Access lists filter network traffic by controlling whether packets are forwarded or blocked at
the router’s interfaces based on the criteria you specified within the access list.

To use ACLs, the system administrator must first configure ACLs and then apply them to
specific interfaces. There are 3 popular types of ACL: Standard, Extended and Named ACLs.

Standard IP Access List

Standard IP lists (1-99) only check source addresses of all IP packets.

Configuration Syntax

access-list access-list-number {permit | deny} source {source-mask}

Apply ACL to an interface

ip access-group access-list-number {in | out}

Example of Standard IP Access List

Configuration:

In this example we will define a standard access list that will only allow network [Link]/8
to access the server (located on the Fa0/1 interface)

Define which source is allowed to pass:

Router(config)#access-list 1 permit [Link] [Link]

(there is always an implicit deny all other traffic at the end of each ACL so we don’t need to
define forbidden traffic)

Apply this ACL to an interface:

Router(config)#interface Fa0/1

Router(config-if)#ip access-group 1 out

The ACL 1 is applied to permit only packets from [Link]/8 to go out of Fa0/1 interface
while deny all other traffic. So can we apply this ACL to other interface, Fa0/2 for example?
Well we can but shouldn’t do it because users can access to the server from other interface
(s0 interface, for example). So we can understand why an standard access list should be ap -
plied close to the destination.

Note: The “[Link]” is the wildcard mask part of network “[Link]”. We will learn
how to use wildcard mask later.
Extended IP Access List

Extended IP lists (100-199) check both source and destination addresses, specific UDP/TCP/
IP protocols, and destination ports.

Configuration Syntax

access-list access-list-number {permit | deny} protocol source {source-mask} destination

{destination-mask} [eq destination-port]

Example of Extended IP Access List

In this example we will create an extended ACL that will deny FTP traffic from network
[Link]/8 but allow other traffic to go through.

Note: FTP uses TCP on port 20 & 21.

Define which protocol, source, destination and port are denied:

Router(config)#access-list 101 deny tcp [Link] [Link] [Link] [Link] eq 21

Router(config)#access-list 101 deny tcp [Link] [Link] [Link] [Link] eq 20

Router(config)#access-list 101 permit ip any any

Apply this ACL to an interface:

Router(config)#interface Fa0/1
Router(config-if)#ip access-group 101 out

Notice that we have to explicit allow other traffic (access-list 101 permit ip any any) as there
is an “deny all” command at the end of each ACL.

As we can see, the destination of above access list is “[Link] [Link]” which specifies a
host. We can use “host [Link]” instead. We will discuss wildcard mask later.

In summary, below is the range of standard and extended access list

Access list type Range

Standard 1-99, 1300-1999

Extended 100-199, 2000-2699

Named IP Access List

This allows standard and extended ACLs to be given names instead of numbers

Named IP Access List Configuration Syntax

ip access-list {standard | extended} {name | number}

Example of Named IP Access List

This is an example of the use of a named ACL in order to block all traffic except the Telnet
connection from host [Link]/8 to host [Link].
Define the ACL:

Router(config)#ip access-list extended in_to_out permit tcp host [Link] host [Link] eq
telnet

(notice that we can use ‘telnet’ instead of port 23)

Apply this ACL to an interface:

Router(config)#interface Fa0/0

Router(config-if)#ip access-group in_to_out in

Where to place access list?

Standard IP access list should be placed close to destination.

Extended IP access lists should be placed close to the source.

How many access lists can be used?

You can have one access-list per protocol, per direction and per interface. For example, you
can not have two access lists on the inbound direction of Fa0/0 interface. However you can
have one inbound and one outbound access list applied on Fa0/0.

How to use the wildcard mask?

Wildcard masks are used with access lists to specify a host, network or part of a network.
The zeros and ones in a wildcard determine whether the corresponding bits in the IP address
should be checked or ignored for ACL purposes. For example, we want to create a standard
ACL which will only allow network [Link]/20 to pass through. We need to write an
ACL, something like this:

access-list 1 permit [Link] [Link]

Of course we can’t write subnet mask in an ACL, we must convert it into wildcard mask by
converting all bits 0 to 1 & all bits 1 to 0.

255 = 1111 1111 -> convert into 0000 0000

240 = 1111 0000 -> convert into 0000 1111

0 = 0000 0000 -> convert into 1111 1111

Therefore [Link] can be written in wildcard mask as

00000000.00000000.00001111.11111111 = [Link]

Remember, for the wildcard mask, 1′s are I DON’T CARE, and 0′s are I CARE. Now let’s
analyze our wildcard mask.

Two first octets are all 0’s meaning that we care about the network 172.23.x.x. The third
octet, 15 (0000 1111 in binary), means that we care about first 4 bits but don’t care about last
4 bits so we allow the third octet in the form of 0001xxxx (minimum:00010000 = 16; max-
imum: 0001111 = 31).
The fourth octet is 255 (all 1 bits) that means I don’t care.

Therefore network [Link] [Link] ranges from [Link] to [Link].

Some additional examples:

+ Block TCP packets on port 30 from any source to any destination:

Router(config)#access-list 101 deny tcp any any eq 30

+ Permit any IP packets in network [Link] with subnet mask [Link] to any
network:

Router(config)#access-list 101 permit ip [Link] [Link] any

Apply the access control list to an interface:

Router(config)#interface fastEthernet0/0

Router(config-if)#ip access-group 101 in

Overview
Once an engineer has a basic understanding of how packet
forwarding/routing works, the next step is to move on to the method of
configuring routing. (If you're still not sure how packet forwarding/routing
works, take a look at my article "Basic Layer 3 Routing Concepts.")

This article discusses the main categories of routing configuration and

goes over the different types of dynamic routing protocols that are
available and commonly used.

Choosing How to Configure Network Routing

There are two primary ways of configuring routing: statically and

dynamically. Static routing is typically used on very small networks, where
the number of routes to be configured is just as small. However, static
routing is sometimes used in larger networks as a small piece of an overall
dynamically controlled routing infrastructure. In such cases, static routes
typically configure default routes, or direct traffic out of the network to
another network controlled by another party.

Dynamic routing is built to deal with network changes automatically as

the topology changes within the network, and are typically used on all
other network types not previously mentioned.

Let's visualize this with the topology shown inFigure 1 . This example
shows a number of different paths that a message can take when leaving
R1 and destined for R6. For example, it could go R1 > R2 > R4 > R6, or it
could go R1 > R3 > R4 > R6. When configuring static routing, typically the
engineer has a single path in mind to reach the destination. So, to
configure a route from R1 to R6 using the path through R2 and R4, a static
route would need to exist on R1, R2, and R4 for the forward trip (R1 > R6),
and another route would need to exist on R6, R4, and R2 for the reverse
trip (from R6 back to R1). Keep in mind that this route is for a single
reachable destination.
Figure 1 Base topology.

To provide reachability to every destination that potentially exists in the

network, the engineer would need to calculate the best paths for each
destination initially, and then individually configure each route along each
best path. Obviously, this process can quickly become very time-
consuming. And what happens if a failure exists along the calculated best
path?

These reasons indicate why dynamic routing protocols are used on larger
networks, and static routing is left for very small networks or other
specific use cases. Dynamic routing protocols avoid the manual
configuration problem; they also are built to handle many complex
topologies, as well as dealing with network outages—without the need for
additional administrative attention.

Types of Dynamic Routing

After selecting the dynamic routing method, the engineer must make
some additional decisions involving the types of dynamic routing
protocols. At the highest level are two main categories of dynamic routing
protocol: exterior gateway protocols (EGPs) and interior gateway protocols
(IGPs). EGPs connect multiple network domains; they're called exterior
because the protocol is exterior to the network domains. (A

domain in this case is a specific organization or service provider network.)

IGPs handle the routing inside these network domains; these protocols are
the most common, as each company with a network handles its own
network domain.

Modern networks use only a single EGP: the Border Gateway Protocol
(BGP). As you might expect, a number of different IGPs are available,
depending on the requirements of each network. Four IGPs are the most
popular:

Open Shortest Path First (OSPF)

Enhanced Interior Gateway Routing Protocol (EIGRP)

Intermediate System to Intermediate System (IS-IS)

Routing Information Protocol (RIP)

These EGP and IGP protocols are split into three different types of routing
protocol: distance vector, link-state, and path vector. There are a number
of important differences between these types. The next three sections
discuss each type of routing protocol in detail.

Distance Vector Protocols

A few main attributes are associated with traditional distance vector

routing protocols:

The router's view of the network is only discovered from the known routes
of its neighbors ("routing by rumor").
The router sends a complete version of its routing table to its neighbors at
regular intervals.

They take a long time to converge after a failure because the update is
only sent at regular intervals.

Compared with link-state protocols, distance vector protocols have a

higher risk of causing routing loops.

The only modern routing protocol that is traditionally distance vector is

RIP. It advertises a complete copy of its routing table every 30 seconds via
all enabled interfaces.

Once a router receives an update from a neighbor, it places the update

into the routing table (assuming that there are no conflicts). If something
happens and the route becomes unreachable, the route remains in the
routing table for at least 180 seconds (default invalid timer) before being
marked as unreachable. This technique slows down the convergence of a
failed route and delays traffic from being routed along an alternate path.

RIP comes in three versions: RIP version 1, RIP version 2, and RIPng. Their
operations are very similar; however, there are a few differences: RIP
version 1 broadcasts updates, whereas RIP version 2 multicasts updates.
This design prevents non-RIP devices from processing extra packets every
30 seconds. RIP version 2 also supports subnetted (classless) networks,
while RIP version 1 only supports classful networks. RIPng works similarly
to RIP version 2, but for IPv6 addresses.

EIGRP is technically a distance vector protocol in that its view is based on

its neighbors' views alone, but it has some features that make it act like a
link-state protocol. This is why EIGRP is usually discussed as being a
hybrid protocol, using attributes from both traditional distance vector as
well as link-state protocols. Crossover features include the use of
neighborships and triggered partial updates, to name two.

Loop management for distance vector routing protocols uses two different
methods: poison reverse and split horizon. Poison reverse is used every
time a new route is learned from a neighbor; when this happens, the
router automatically sends a route advertisement back out the learned
interface with an infinite metric. This action prevents the neighbor from
using that route to the newly learned destination.

Split horizon is also used when a router advertises routes out its
interfaces. With split horizon, if a route was learned on interface 1, it will
not advertise that same route back out interface 1.

Link-State Protocols

Link-state protocols provide each of the routers in a network with a

network-wide view, giving each router the ability to calculate the best
path through the network. All modern link-state routing protocols use
Dijkstra's shortest path algorithm.

Link-state protocols work by establishing neighborships with connected

routers and exchanging a copy of the known network (not just the routing
table contents) to these neighbors. All updates that are received are
immediately relayed to all other connected neighbors.

Both OSPF and IS-IS are link-state protocols, and both use Dijkstra's
algorithm for best-path mapping. However, their configurations are quite
different, and the selection of one versus the other is based mainly on the
requirements of a specific network. OSPF is more commonly deployed in
enterprises, and IS-IS is more popular in service provider networks.

Path Vector Protocols

The only path vector protocol in use today is BGP. When BGP is
configured, it will have a copy of all reachable autonomous systems
(BGP's term for network domains, discussed earlier) and the path to reach
them. This information gives the protocol a clear view of which networks it
can reach and the advertised path to each.
A BGP router also uses a number of different path attributes to determine
which path it will end up using to reach a specific destination. Since BGP is
an EGP and is used to route between routing domains, often multiple
paths are available to reach a destination. By using a combination of
these path attributes, a router selects the route it uses.

Summary

Whether to use a static or dynamic method of routing is frequently

determined by the size of the network; if the network is very small (a few
nodes), a static routing solution could work. However, even if the network
is small, a dynamic routing method can be used without a lot of
configuration, and it will continue to work as the network grows.

The type of dynamic routing protocol to use largely depends on the

vendor of the networking equipment in use. OSPF and EIGRP are two of
the most popular routing protocols used on enterprise networks. Of these
two, EIGRP is typically considered easier to configure, but until recently it
has been Cisco proprietary, and therefore typically not supported on other
vendors' equipment.

If you're deploying only Cisco equipment, the selection is a bit more

dependent on the training of your staff and which protocol they best
understand and prefer.

Part 2 of this series will walk through how a network converges for a
distance vector network versus a link-state network, along with covering a
few common additional dynamic routing protocol features.

SPANNING TREE PROTOCOL

Spanning Tree Protocol (STP) was developed before switches were created
in order to deal with an issue that occurred with networks that were
implementing network bridges. STP serves two purposes: First, it prevents
problems caused by loops on a network. Second, when redundant loops
are planned on a network, STP deals with remediation of network changes
or failures.
The difference between a bridge and a switch is that a switch functions
like a multiport bridge; whereas a bridge might have two to four ports, a
switch looks like a hub and, on an enterprise network, will usually have 12
to 48 ports. As you go through this chapter, note that STP technology uses
the term bridges, when you are actually placing switches (multiport
bridges). At the time STP was created, switches did not exist. Clear as
mud?

STP is a Layer 2 protocol that passes data back and forth to find out how
the switches are organized on the network and then takes all the
information it gathers and uses it to create a logical tree. Part of the
information STP receives defines exactly how all the network switches are
interconnected.

STP builds this information by sending out network packets called Bridge
Protocol Data Units (BPDUs or sometimes BDUs). These BPDUs — or rather
the data in them — control the way STP determines the network topology.

The following figure shows a basic network with simplified 4-digit MAC
addresses for the switches. All the switches on the network will send BPDU
frames to the entire network, even if a network that does not have any
loops. These packets, by default, are sent out on the network every two
seconds, are very small, and do not negatively affect the network traffic.

If you are performing a packet capture on a network, however, be aware

that these packets fill your capture screen quickly and can be distracting
when reviewing your captured data. The initial process of sending BPDU
frames will determine which switch will be the Root Bridge and act as the
controller or manager for STP on the network. By default, the Root Bridge
is the switch with the numerically lowest MAC address.
Identifying Root Ports

The BPDU, which every switch sends, contains information about the
switch and its

Bridge ID that uniquely identifies the switch on the network. The Bridge ID
is made of two components: a configurable Bridge Priority value (which is
32,768 by default) and the switch MAC address.

If none of the switches on your network has had its Bridge Priority values
adjusted, then the switch with the lowest MAC address will be the Root
Bridge; but if the Bridge Priority values on your network have been
modified, the Root Bridge will be the switch with the lowest Bridge Priority
value. The Root Bridge shown in the preceding figure is switch 11:11.

After the Root Bridge is identified, all other switches determine the
quickest path from themselves to the Root Bridge. Some switches have
more than one path to the Root Bridge due to a network loop. In the
preceding figure, switch 11:22 has two paths, one that is two hops away
from the Root Bridge and one that is one hop away.

If the speed of the networking technology is the same for all network
segments, the path with the fewest number of hops is designated as the
Root Port.

The switch will identify which of its interfaces is the Root Port. Each
network technology has a rated speed, so based on the technology of
each network segment between the switch and the Root Bridge, the
switch is able to calculate the cost of each available path.

The following table lists the STP cost associated with each network
technology speed. Notice in the table that the data rate is inversely
proportional to the STP cost.

Network Speeds and STP Costs

Data Rate STP Cost

4 Mbps 5,000,000

10 Mbps 2,000,000

16 Mbps 1,250,000

100 Mbps 200,000

1 Gbps 20,000

2 Gbps 10,000

10 Gbps 2,000

In the following figure, all the Root Ports are identified. In the event that a
switch has two paths to the Root Bridge and each path has the same cost,
then the switch will look at the BPDU frames from its closet neighbor on
each of the paths. The switch will designate its Root Port based on the
neighbor with the lowest Bridge ID.

Identifying Designated Ports

Each switch knows the least cost path to take to get to the Root Bridge,
which may require passing data to another switch's interface. For the sake
of this example, the main switch that is being used in the example the
reference switch and its neighbor the neighbor switch. The port on the
next closest switch (neighbor switch) to the Root Bridge that is facing the
reference switch is called the Designated Port .

The reference switch will use the Designated Port as its path to get to the
Root Bridge. The following figure identifies all the Designated Ports that
the downstream switches will use to send data to the Root Bridge.

Blocking Loops

You still have one outstanding problem to resolve. There are still loops on
this network that threaten to bring the current network down; however, by
working through how all the Root Ports and Designated Ports are
assigned, you have actually completed the work to resolve the loop issue
on the network.

In the figure immediately preceding this section, only two ports are used
to connect to neighboring switches that are neither Root Ports nor
Designated Ports. Because these ports do not have either role assigned to
them, they are part of a loop on the network. If you review the figure, you
should be able to identify the loops on the network. To resolve the loop
issue, STP puts these ports without a role into Blocking state, which
means these are Blocking Ports .

Blocking Ports are ports that do not allow traffic to be sent or received
through the port; it is blocking the traffic. Essentially, you could say that
the Blocking Ports have been disabled, but they are not disabled. Since
the ports are not disabled, the switch on the other end of the link still sees
the link as active, but frames that are sent over that link (excluding BPDU
frames) are dropped (blocked).

The following figure shows you the completed STP diagram, including the
Blocking Ports.

Rapid Spanning Tree Protocol RSTP Tutorial

June 5th, 2011 Go to comments

Note: Before reading this article you should understand how STP works. So
if you are not sure about STP, please read my article about Spanning Tree
Protocol tutorial first.

Rapid Spanning Tree Protocol (RSTP)

One big disadvantage of STP is the low convergence which is very

important in switched network. To overcome this problem, in 2001, the
IEEE with document 802.1w introduced an evolution of the Spanning Tree
Protocol: Rapid Spanning Tree Protocol (RSTP), which significantly reduces
the convergence time after a topology change occurs in the network.
While STP can take 30 to 50 seconds to transit from a blocking state to a
forwarding state, RSTP is typically able to respond less than 10 seconds of
a physical link failure.

RSTP works by adding an alternative port and a backup port compared to

STP. These ports are allowed to immediately enter the forwarding state
rather than passively wait for the network to converge.

RSTP bridge port roles:

* Root port – A forwarding port that is the closest to the root bridge in
terms of path cost
* Designated port – A forwarding port for every LAN segment
* Alternate port – A best alternate path to the root bridge. This path is
different than using the root port. The alternative port moves to the
forwarding state if there is a failure on the designated port for the
segment.

* Backup port – A backup/redundant path to a segment where another

bridge port already connects. The backup port applies only when a single
switch has two links to the same segment (collision domain). To have two
links to the same collision domain, the switch must be attached to a hub.

* Disabled port – Not strictly part of STP, a network administrator can

manually disable a port

Now let’s see an example of three switches below:

Suppose all the switches have the same bridge priority so the switch with
lowest MAC address will become root bridge -> Sw1 is the root bridge and
therefore all of its ports will be Designated ports (forwarding).

Two ports fa0/0 on Sw2 & Sw3 are closest to the root bridge (in terms of
path cost) so they will become root ports.

On the segment between Sw2 and Sw3, because Sw2 has lower MAC than
Sw3 so it will advertise better BPDU on this segment -> fa0/1 of Sw2 will
be Designated port and fa0/1 of Sw3 will be Alternative port.
Now for the two ports connecting to the hub, we know that there will have
only one Designated port for each segment (notice that the two ports
fa0/2 & fa0/3 of Sw2 are on the same segment as they are connected to a
hub). The other port will be Backup port according to the definition of
Backup port above. But how does Sw2 select its Designated and Backup
port? The decision process involves the following parameters inside the
BPDU:

 Lowest path cost to the Root

 Lowest Sender Bridge ID (BID)
 Lowest Port ID

Well, both fa0/2 & fa0/3 of Sw2 has the same “path cost to the root” and
“sender bridge ID” so the third parameter “lowest port ID” will be used.
Because fa0/2 is inferior to fa0/3, Sw2 will select fa0/2 as its Designated
port.
Note: Alternative Port and Backup Port are in discarding state.

RSTP Port States:

There are only three port states left in RSTP that correspond to the three
possible operational states. The 802.1D disabled, blocking, and listening
states are merged into the 802.1w discarding state.

* Discarding – the port does not forward frames, process received

frames, or learn MAC addresses – but it does listen for BPDUs (like the STP
blocking state)
* Learning – receives and transmits BPDUs and learns MAC addresses but
does not yet forward frames (same as STP).
* Forwarding – receives and sends data, normal operation, learns MAC
address, receives and transmits BPDUs (same as STP).

STP State RSTP State

(802.1d) (802.1w)

Blocking Discarding

Listening Discarding
Learning Learning

Forwarding Forwarding

Disabled Discarding

Although the learning state is also used in RSTP but it only takes place for
a short time as compared to STP. RSTP converges with all ports either in
forwarding state or discarding state.

RSTP Quick Summary:

RSTP provides faster convergence than 802.1D STP when topology

changes occur.
* RSTP defines three port states: discarding, learning, and forwarding.
* RSTP defines five port roles: root, designated, alternate, backup, and
disabled.

Note: RSTP is backward compatible with legacy STP 802.1D. If a RSTP

enabled port receives a (legacy) 802.1d BPDU, it will automatically
configure itself to behave like a legacy port. It sends and receives 802.1d
BPDUs only.

Subnetting Tutorial – Subnetting Made Easy

September 28th, 2011 Go to comments

In this article, we will learn how to subnet and make subnetting an easy task.

The table below summarizes the possible network numbers, the total number of each type,
and the number of hosts in each Class A, B, and C network.

Default subnet mask Range

Class A [Link] (/8) [Link] – [Link]
Class B [Link] (/16) [Link] – [Link]
Class C [Link] (/24) [Link] – [Link]

Table 1 – Default subnet mask & range of each class

Class A addresses begin with a 0 bit. Therefore, all addresses from [Link] to
[Link] belong to class A (1=0000 0001; 126 = 0111 1110).
The [Link] address is reserved for default routing and the [Link] address is reserved for
loopback testing so they don’t belong to any class.
Class B addresses begin with a 1 bit and a 0 bit. Therefore, all addresses from [Link] to
[Link] belong to class B (128=1000 0000; 191 = 1011 1111).
Class C addresses begin with two 1 bits and a 0 bit. Class C addresses range from [Link]
to [Link] (192 = 1100 0000; 223 = 1101 1111).

Class D & E are used for Multicast and Research purposes and we are not allowed to subnet
them so they are not mentioned here.

Note: The number behind the slash notation (/) specifies how many bits are turned on (bit 1).
For example:

+ “/8” equals “1111 1111.0000 0000.0000 0000.0000 0000” -> 8 bits are turned on (bit 1)
+ “/12” equals “1111 1111.1111 0000.0000 0000.0000 0000” -> 12 bits are turned on (bit 1)
+ “/28” equals “1111 1111.1111 1111.1111 1111.1111 0000” -> 28 bits are turned on (bit 1)
+ “/32” equals “1111 1111.1111 1111.1111 1111.1111 1111” -> 32 bits are turned on (bit 1)
and this is also the maximum value because all bits are turned on.

The slash notation (following with a number) is equivalent to a subnet mask. If you know the
slash notation you can figure out the subnet mask and vice versa. For example, “/8” is equi-
valent to “[Link]”; “/12” is equivalent to “[Link]”; “/28” is equivalent to
“[Link]”; “/32” is equivalent to “[Link]”.

The Network & Host parts of each class by default

From the “default subnet mask” shown above, we can identify the network and host part of
each class. Notice that in the subnet mask, bit 1 represents for Network part while bit 0
presents for Host part (255 equals to 1111 1111 and 0 equals to 0000 0000 in binary form).
What is “subnetting”?

When changing a number in the Network part of an IP address we will be in a different net -
work from the previous address. For example, the IP address [Link] belongs to class A and
has a default subnet mask of [Link]; if we change the number in the first octet (a block of
8 bits, the first octet is the leftmost 8 bits) we will create a different network. For example,
[Link] is in a different network from [Link]. But if we change a number in the Host part,
we are still in the same Network. For example, [Link] is in the same network of [Link].

The problem here is if we want to create 300 networks how can we do that? In the above ex-
ample, we can only create different networks when changing the first octet so we can create a
maximum of 255 networks because the first octet can only range from 1 to 255 (in fact it is
much smaller because class A only range from 1 to 126). Now we have to use a technique
called “subnetting” to achieve our purpose.

“Subnetting” means we borrow some bits from the Host part to add to the Network part.
This allows us to have more networks than using the default subnet mask. For example, we
can borrow some bits in the next octet to make the address [Link] belong to a different net-
work from [Link].

How to subnet?

Do you remember that I said “in the subnet mask, bit 1 represents for Network part while bit
0 presents for Host part”? Well, this also means that we can specify how many bits we want
to borrow by changing how many bit 0 to bit 1 in the subnet mask.

Let’s come back to our example with the IP [Link], we will write all numbers in binary
form to reveal what a computer really sees in an IP address.

Now you can clearly see that the subnet mask will decide which is the Network part, which is
the Host part. By borrowing 8 bits, our subnet mask will be like this:
After changing the second octet of the subnet mask from all “0” to all “1”, the Network part
is now extended. Now we can create new networks by changing number in the first or second
octet. This greatly increases the number of networks we can create. With this new subnet
mask, IP [Link] is in different network from IP [Link] because “1” in the second octet
now belongs to the Network part.

So, in conclusion we “subnet” by borrowing bit “0” in the Host portion and converting them
to bit “1”. The number of borrowed bits is depended on how many networks we need.

Note: A rule of borrowing bits is we can only borrow bit 0 from the left to the right without
skipping any bit 0. For example, you can borrow like this: “1111 1111. 1100 0000.0000
0000.0000 0000” but not this: “1111 1111. 1010 0000.0000 0000.0000 0000”. In general, just
make sure all your bit “1”s are successive on the left and all your bit “0”s are successive on
the right.

In the next part we will learn how to calculate the number of sub-networks and hosts-per-
subne

Calculate how many networks and hosts-per-subnet

In our example, you may raise a question: “when we borrow 8 bits, how many sub-networks
and how many hosts per sub-network do it create?”

Note: From now, we will call sub-networks “subnets”. This term is very popular so you
should be familiar with it.

How many new subnets?

Because we can change any bit in the second octet to create a new subnet, each bit can be “0”
or “1” so with this subnet mask ([Link]) we can create 2 8 more subnets. From here we
can deduce the formula to calculate the newly created subnets. Suppose n is the number of
bits we borrow:

The number of newly created subnets = 2n

In our example, we borrow 8 bits so we will have 2n = 28 = 256 subnets!

How many hosts per subnet?

The number of hosts per subnet is depended on the Host part, which is indicated by the “0”
part of the subnet mask. So suppose k is the number of bits “0” in the subnet mask. The for-
mula to calculate the number of hosts is 2 k. But notice that with each subnet, there are two ad-
dresses we can’t assign for hosts because they are used for network address & broadcast ad-
dress. Thus we must subtract the result to 2. Therefore the formula should be:

The number of hosts per subnet = 2k – 2

In our example, the number of bit “0” in the subnet mask [Link] (in binary form) is 16
so we will have 2k – 2 = 216 – 2 = 65534 hosts-per-subnet!
Some other examples

Well, practice makes perfect so we should have some more exercises to be familiar with
them. But remember that this is only the beginning in your journey to become a subnetting
guru :)

Exercise 1

Your company has just been assigned the network [Link]. How many subnets and hosts-per-
subnet you can create with a subnet mask of [Link]?

(Please try to solve by yourself before reading the solution ^^)

Solution

First of all you have to specify which class this network belongs to. According to Table 1, it
belongs to class A (simply, class A ranges from 1 to 126) and its default subnet mask is
[Link]. Therefore if we use a subnet mask of [Link], it means we borrowed 16 bits
(to convert from 0 to 1).

[Link] = 1111 1111.0000 0000.0000 0000.0000 0000

[Link] = 1111 1111.1111 1111.1111 1111.0000 0000

Now use our above formulas to find the answers:

The number of newly created subnets = 2 16 = 65536 (with 16 is the borrowed bits)
The number of hosts per subnet = 2 8 – 2 = 254 (with 8 is the bit “0”s left in the [Link]
subnet mask)

Exercise 2

Your company has just been assigned the network [Link]. How many subnets and hosts-
per-subnet you can create with a subnet mask of [Link]?

(Please try to solve by yourself before reading the solution ^^)

Solution

[Link] belongs to class B with the default subnet mask of [Link]. But is the subnet
mask of [Link] strange? Ok, let’s write all subnet masks in binary:

[Link] = 1111 1111.1111 1111.1000 0000.0000 0000

This is a valid subnet because all bit “1”s and “0”s are successive. Comparing to the default
subnet mask, we borrowed only 1 bit:

[Link] = 1111 1111.1111 1111.0000 0000.0000 0000

Therefore:
The number of newly created subnets = 2 1 = 2 (with 1 is the borrowed bits)
The number of hosts per subnet = 215 – 2 = 32766 (with 15 is the bit “0”s left in the
[Link] subnet mask)

Exercise 3

Your company has just been assigned the network [Link]/28. How many subnets and
hosts-per-subnet you can create with a subnet mask of [Link]?

(Please try to solve by yourself before reading the solution ^^)

Solution

In this exercise, your company was given a “subnetted” network from the beginning and it is
not using the default subnet mask. So we will compare two subnet masks above:

/28 = 1111 1111.1111 1111.1111 1111.1111 0000 (=[Link])

[Link] = 1111 1111.1111 1111.1111 1111.1111 1100 (= /30)

In this case we borrowed 2 bits. Therefore:

The number of newly created subnets = 2 2 = 4 (with 2 is the borrowed bits)

The number of hosts per subnet = 2 2 – 2 = 2 (with 2 is the bit “0”s left in the [Link]
subnet mask)

In this exercise I want to go a bit deeper into the subnets created. We learned there are 4 cre-
ated subnets but what are they? To find out, we should write all things in binary:

Because two subnet masks (/28 & /30) only affect the 4th octet so we don’t care about the
first three octets. In the 4th octet we are allowed to change 2 bits (in the green box) of the IP
address to create a new subnet. So there are 4 values we can use: 00, 01, 10 & 11. After chan-
ging, we convert them back to decimal numbers. We get 4 subnets:

+ First subnet: [Link]/30 (the 4th octet is 00000000)

+ Second subnet: [Link]/30 (the 4th octet is 00000100)
+ Third subnet: [Link]/30 (the 4th octet is 00001000)
+ Fourth subnet: [Link]/30 (the 4th octet is 00001100)
So how about hosts per subnet? Please notice that all these 4 subnets are successive. So we
can deduce the range of these subnets:

+ First subnet: ranges from [Link] to [Link]

+ Second subnet: ranges from [Link] to [Link]
+ Third subnet: ranges from [Link] to [Link]
+ Fourth subnet: ranges from [Link] to [Link]

Let’s analyze the first subnet which ranges from [Link] to [Link]. Notice that all
networks (and subnets) have a network address and a broadcast address. In this case, the net-
work address is [Link] and the broadcast address is [Link] and they are not as-
signable or usable for hosts. This is the reason why we have to subtract 2 in the formula “The
number of hosts per subnet = 2k – 2″. After eliminating these 2 addresses we have 2 addresses
left (which are [Link] & [Link]) as calculated above.

In the next part we will learn how to calculate subnet quickly. This is also a “must” require -
ment for CCNA so you have to grasp it.

In the previous examples, we have to write all subnet masks and IP addresses in binary num-
bers to find out the results. It is a boring and time-consuming task. In this part I will show
you a shortcut to subnet without using a calculator or rough paper!

Subnetting – The quick & easy way

One important thing we should notice is that a valid subnet mask must have all bit “1”s and
“0”s successive, in which bit “1”s must be on the left; bit “0”s must be on the right. Therefore
we only have 8 situations:

Table 2 – lists all valid subnet masks

This is a very important table to do subnet quickly! Please take some time to learn it by heart.
Make sure you remember the right-most bit “1” position (the least significant bit 1, which are
in red in the above table) and their equivalent decimal values.

In most cases, this table is used to quickly convert a number from decimal to binary value
without any calculation. For example, you can quickly convert the 4th octet of the subnet
mask [Link] to 11111000. Or if you are given a subnet of /29 you will know it
equals to [Link] (by thinking “/24 is the default subnet mask of class C so /29 will
have the right-most bit “1” at 5th position).

Try to practice with these questions:

+ “/28” in binary form?

+ “[Link]” in binary form?
+ “[Link]” in slash notation form?
+ “/26” in binary form?
+ “[Link]” in binary form?
+ “[Link]” in slash notation form?

(Please try to solve by yourself before reading the solution)

Answers:

+ /28 -> 1111 1111.1111 1111.1111 1111.1111 0000

+ [Link] -> 1111 1111.1111 1111.1110 0000.0000 0000
+ [Link] -> /10
+ /26 -> 1111 1111.1111 1111.1111 1111.1100 0000
+ [Link] -> 1111 1111.1000 0000.0000 0000.0000 0000
+ [Link] -> /5

How to find out the increment number?

The increment is the heart of subnetting; if you can find out the increment, you can find all
the information to solve a subnetting question. So it is usually the first thing you must find
out in a subnetting question.

The increment number is the number specifying how “big” your subnets are. Let’s take an ex-
ample of the increment number! Did you remember the subnets in “Exercise 3” in the previ-
ous part? By changing bits in the Network part, we found out 4 subnets:

+ First subnet: [Link]/30 (the 4th octet is 00000000)

+ Second subnet: [Link]/30 (the 4th octet is 00000100)
+ Third subnet: [Link]/30 (the 4th octet is 00001000)
+ Fourth subnet: [Link]/30 (the 4th octet is 00001100)

In this case the increment is 4 (in the 4th octet) because the “difference” between two suc -
cessive subnets is 4 (from 0 -> 4; from 4 -> 8; from 8 -> 12)

There are 2 popular ways to find out the increment number:

1) Use the formula:

Increment = 256 – x

In which “x” is the first octet (counting from the left) which is smaller than 255 in a subnet
mask. For example:
+ In a subnet mask of [Link] -> x = 224
+ In a subnet mask of /29 -> x = 248 (because /29 = [Link])
+ In a subnet mask of 1111 1111.1111 1100.0000 0000.0000 0000 -> x = 252

In the case you see a subnet mask of [Link] (which is very rare in CCNA), x = 255

Note: Also remember which octet “x” belongs to because we have to plus the increment to
that octet.

Now let’s solve Exercise 3 again by using this formula:

Exercise 3 one again (with the formula 256 – x):

Your company has just been assigned the network [Link]/28. How many subnets and
hosts-per-subnet you can create with a subnet mask of [Link]?

The subnet mask is [Link] -> x = 252 (x belongs to 4th octet)

Therefore the Increment = 256 – 252 = 4

The initial network [Link]/28 is also the first subnet, so:

+ The first subnet: [Link]/30
+ The second subnet: [Link]/30 because the increment is 4 so we plus the network ad-
dress with it to get the next network address (0 + 4 = 4)
+ The third subnet: [Link]/30 (4 + 4 = 8)
+ The fourth subnet: [Link]/30 (8 + 4 = 12)

Note: We know there are only 4 subnets because we borrow 2 bits.

2) Learn by heart the decimal value of the rightmost bit “1” in the subnet mask:

Another way to find the increment value is to write “x” in binary: 11110000. Consider the
rightmost bit “1”, the decimal value of this bit is the increment value. In this case it equals to
16.

The table below summarizes the decimal values of bit “1” depending on its position. To use
this method, you should learn by heart this table:

Table 3 – How to find out increment based on the “least-significant” (rightmost) bit 1

Now let’s solve Exercise 3 again by using this method:

Exercise 3 one again (with the “decimal value of the rightmost bit 1” method):
Your company has just been assigned the network [Link]/28. How many subnets and
hosts-per-subnet you can create with a subnet mask of [Link]?

First use Table 2 to convert 252 to 1111 1100. The decimal value of the rightmost bit “1” is 4
(according to Table 3) -> The Increment is 4.

After finding out the increment we can deduce 4 subnets it creates.

The initial network [Link]/28 is also the first subnet, so:

+ The first subnet: [Link]/30
+ The second subnet: [Link]/30 because the increment is 4 so we plus the network ad-
dress with it to get the next network address (0 + 4 = 4)
+ The third subnet: [Link]/30 (4 + 4 = 8)
+ The fourth subnet: [Link]/30 (8 + 4 = 12)

Note: We should only choose one method to use and try to practice, practice & practice more
with it. Practice until you can solve any subnetting questions within 20 seconds!

Maybe you will ask why 256 can help you find the increment. In fact, by using the formula
Increment = 256 – x you are trying to separate the rightmost bit “1” from other bits:

256 – x = 255 – x + 1

In which “255 – x” will convert all bit “0”s to bit “1”s and all bit “1”s to “0”s while “+1” part
will make our result have only one bit “1” left. For example, if x = 240 then:

So in fact we can say two above methods are the same!

Now you learned all necessary things to become a subnetting guru. Please take some time to
practice as much as possible, only practice makes perfect! Below lists some subnetting ques-
tions you can practice with:

Here you will find answers to CCNA Subnetting Questions

Note: If you are not sure about subnetting, please read my Subnetting tutorial.

Question 1

Given a subnet mask of [Link], which of the following addresses can be assigned
to network hosts? (Choose three)

A–[Link]
B–[Link]
C – [Link]
D – [Link]
E – [Link]
F – [Link]

Answer: B C D

Explanation

A subnet mask of [Link] has an increment of 32 (the binary form of the last octet is
1110 0000) so we can’t use numbers which are the multiples of 32 because they are sub-net-
work addresses. Besides, we can’t use broadcast addresses of these sub-networks (the broad-
cast address of the previous subnet is calculated by subtracting 1 from the network address).
For example the network address of the 2nd subnet is x.x.x.32 then the broadcast address of
the 1st subnet is 32 – 1 = 31 (means x.x.x.31).

By this method we can calculate the unusable addresses, which are (notice that these are the
4th octets of the IP addresses only):

+ Network addresses: 0, 32, 64, 96, 128, 160, 192, 224.

+ Broadcast addresses: 31, 63, 95, 127,159, 191, 223.

Question 2

Which of the following host addresses are members of networks that can be routed across the
public Internet? (Choose three)

A–[Link]
B–[Link]
C–[Link]
D–[Link]
E–[Link]
F – [Link]

Answer: C E F

Explanation

Addresses that can be routed accross the public Internet are called public IP addresses. These
addresses belong to class A, B or C only and are not private addresses.

Note:

Private class A IP addresses: [Link] to [Link]

Private class B IP addresses: [Link] to [Link]
Private class C IP addresses: [Link] to [Link]
Class D addresses are reserved for IP multicast addresses and can’t be routed across the Inter-
net (their addresses begin with [Link] address).

Also we can’t use 127.x.x.x address because the number 127 is reserved for loopback and is
used for internal testing on the local machine.

Question 3

A national retail chain needs to design an IP addressing scheme to support a nationwide net-
work. The company needs a minimum of 300 sub-networks and a maximum of 50 host ad-
dresses per subnet. Working with only one Class B address, which of the following subnet
masks will support an appropriate addressing scheme? (Choose two)

A–[Link]
B–[Link]
C–[Link]
D–[Link]
E–[Link]
F – [Link]

Answer: B E

Explanation

We need to remember the default subnet mask of class B is [Link]. Next, the company
requires a minimum of 300 sub-networks so we have to use at least 512 sub-networks (be-
cause 512 is the minimum power of 2 and greater than 300). Therefore we need to get 9 bits
for network mask (29=512), leaving 7 bits for hosts which is 2 7-2 = 126 > 50 hosts per sub-
[Link] scheme satisfies the requirement -> B is correct.

We can increase the sub-networks to 1024 ( 1024 = 2 10), leaving 6 bits for hosts that is 26= 64
> 50 hosts. This scheme satisfies the requirement, too -> E is correct.
Notice: The question asks “The company needs a minimum of 300 sub-networks and a max-
imum of 50 host addresses per subnet” but this is a typo, you should understand it as “”The
company needs a minimum of 300 sub-networks and a minimum of 50 host addresses per
subnet”.

Question 4

Which of the following IP addresses fall into the CIDR block of [Link]/22? (Choose
three)

A – [Link]
B – [Link]
C – [Link]
D – [Link]
E – [Link]
F – [Link]

Answer: B C E

Explanation

CIDR stands for Classless In4ter-Domain Routing, the difference between CIDR and VLSM
is slim and those terms are interchangeable at CCNA level.

To specify which IP addresses fall into the CIDR block of [Link]/22 we need to write this
IP address and its subnet mask in binary form, but we only care 3rd octet of this address be-
cause its subnet mask is /22.

(x means “don’t care”)

Next, we have to write the 3rd octets of the above answers in binary form to specify which
numbers have the same “prefixes” with 4.

4 = 0000 0100
8 = 0000 1000
7 = 0000 0111
6 = 0000 0110
3 = 0000 0011
5 = 0000 0101
12=0000 1100
We can see only 7, 6 and 5 have the same “prefixes” with 4 so B C E are the correct answers.

Question 5

Refer to the diagram. All hosts have connectivity with one another. Which statements de-
scribe the addressing scheme that is in use in the network? (Choose three)

A – The subnet mask in use is [Link].

B – The subnet mask in use is [Link].
C – The IP address [Link] can be assigned to hosts in VLAN1.
D – The IP address [Link] can be assigned to hosts in VLAN1.
E – The LAN interface of the router is configured with one IP address.
F – The LAN interface of the router is configured with multiple IP addresses.

Answer: B C F

Explanation

VLAN 2 has 114 hosts so we need to leave 7 bits 0 for the host addresses (2 7 – 2 = 126 >
114). Notice that we are working with class B (both Host A and Host B belong to class B)
and the default subnet mask of class B is /16 so we need to use 16 – 7 = 9 bits 1 for the sub-
network mask, that means the subnet mask should be [Link] -> B is correct.

By using above scheme, C is correct because the IP [Link] belongs to the sub-network
of VLAN 1 ([Link]/25) and can be assigned to hosts in VLAN 1.

For communication between VLAN 1 and VLAN 2, the LAN interface of the router should
be divided into multiple sub-interfaces with multiple IP addresses -> F is correct.

Question 6
The network [Link] has been divided into eight equal subnets. Which of the following IP
addresses can be assigned to hosts in the third subnet if the ip subnet-zero command is con-
figured on the router? (Choose three)

A – [Link]
B – [Link]
C – [Link]
D – [Link]
E – [Link]
F. [Link]

Answer: A C D

Explanation

If the “ip subnet-zero” command is configured then the first subnet is [Link]. Otherwise
the first subnet will be [Link] (we will learn how to get 32 below).

The question stated that the network [Link] is divided into eight equal subnets therefore
the increment is 256 / 8 = 32 and its corresponding subnet mask is /19 (1111 1111.1111
1111.1110 0000).

First subnet: [Link]/19

Second subnet: [Link]/19
Third subnet: [Link]/19
4th subnet: [Link]/19
5th subnet: [Link]/19
6th subnet: [Link]/19
7th subnet: [Link]/19
8th subnet: [Link]/19

In fact, we only need to specify the third subnet as the question requested. The third subnet
ranges from [Link]/19 to [Link]/19 so A C D are the correct answers.

Question 7

Refer to the exhibit. In this VLSM addressing scheme, what summary address would be sent
from router A?
A. [Link]/16
B. [Link]/20
C. [Link]/24
D. [Link]/16
E. [Link]/17
F. [Link]/16

Answer: A

Explanation

Router A receives 3 subnets: [Link]/18, [Link]/24 and [Link]/18.

All these 3 subnets have the same form of 172.16.x.x so our summarized subnet must be also
in that form -> Only A, B or C is correct.

The smallest subnet mask of these 3 subnets is /18 so our summarized subnet must also have
its subnet mask equal or smaller than /18.

-> Only answer A has these 2 conditions -> A is correct.