How to Configure Subnets and Choose the Right IP Addressing Scheme for CompTIA Network+ (N10-008)

Introduction

If you’re prepping for CompTIA Network+ N10-008 and you run into the objective “Given a scenario, configure a subnet and use appropriate IP addressing schemes,” don’t make the mistake of turning it into a straight memorization drill for a handful of subnet masks. What the exam is really asking for is a lot broader than that. You’ve got to size subnets, spot valid host ranges, decide when static or dynamic addressing makes sense, verify gateways, understand the basics of IPv4 and IPv6, and troubleshoot those moments when a client ends up in the wrong network or doesn’t get a DHCP lease at all.

Honestly, the easiest way to make subnetting finally click is to connect the math to real network design. You subnet so you can keep users away from servers, fence off guest Wi-Fi, reduce broadcast noise, support voice and management networks, and make routing and security policy a whole lot cleaner. And in the real world? Yeah, that stuff matters every single day. On the exam, calculation matters. Actually, let me say it another way: in the field, good judgment matters just as much as the math.

N10-008 objective map: configure subnetworks, choose appropriate IP addressing schemes, distinguish public/private/APIPA/link-local addressing, verify default gateways, and apply basic IPv6 concepts.

Why subnetting matters

Subnetting isn’t just one trick in the toolbox; it solves several real problems at the same time. It helps conserve address space through CIDR and VLSM, keeps Layer 2 broadcast domains under control, creates cleaner security boundaries, and makes troubleshooting faster because each subnet usually lines up with a specific function, department, or VLAN.

In a standard enterprise design, one IP subnet usually maps to one VLAN. Now, that’s not some universal law carved into stone, but it is best practice because it lines up Layer 2 separation with Layer 3 addressing and policy. That kind of alignment makes life a whole lot easier when you’re chasing a weird connectivity issue at 4:30 on a Friday and everybody’s suddenly very interested in your phone ringing. A flat network where users, servers, printers, voice phones, and guest devices are all piled into the same space is harder to secure, harder to troubleshoot, and harder to scale.

Good subnetting also gives you room to grow, which is really important if you don’t want to paint yourself into a corner. If you leave room for new departments, more branches, or future wireless expansion, you can avoid that miserable renumbering project later on.

IPv4 addressing fundamentals

IPv4 is 32 bits long, and we usually write it in dotted decimal, like 192.168.10.25. A subnet mask, or prefix length, tells you which bits belong to the network portion and which bits belong to the host portion. So in 192.168.10.25/24, the first 24 bits belong to the network and the last 8 bits belong to the host.

The private IPv4 ranges are:

• 10.0.0.0/8
• 172.16.0.0/12
• 192.168.0.0/16

These ranges are not routable on the public internet. Most organizations use NAT or PAT at the edge so internal hosts with private addresses can still reach external networks. That’s the bridge between internal private space and the public internet. PAT is the many-to-one version, and you’ll sometimes hear it called NAT overload.

Special-use IPv4 ranges you should know:

• 127.0.0.0/8 = loopback
• 169.254.0.0/16 = IPv4 link-local; Windows commonly calls this APIPA
• 0.0.0.0 = unspecified address, and 0.0.0.0/0 = default route
• 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24 = documentation ranges

APIPA deserves a precise note: 169.254.0.0/16 is link-local IPv4 addressing. In enterprise troubleshooting, seeing a 169.254.x.x address usually means DHCP didn’t work when DHCP was supposed to work, although link-local addressing can be intentional in isolated setups.

Prefix and mask conversion

You’ve got to get comfortable moving back and forth between prefix notation and dotted-decimal masks. Each full 8-bit octet made up of all 1s equals 255. For partial octets, the binary place values are 128, 64, 32, 16, 8, 4, 2, and 1.

For example, /27 means there are 27 network bits. That gives you 24 full bits plus 3 more bits in the last octet:

11111111.11111111.11111111.11100000 = 255.255.255.224

Common conversions:

Exam trap: block size is not the same as usable hosts. A /27 has a block size of 32, but only 30 of those are usable hosts.

Core subnetting math

For most conventional IPv4 LAN subnetting questions, usable hosts = 2^h - 2, where h is the number of host bits. That minus 2 is there because you lose one address to the network address and one to the broadcast address.

Now, there are real-world exceptions to that rule, and they do matter. A /31 is valid on point-to-point links, and it doesn’t follow the traditional minus-2 rule. A /32 identifies a single host route. For Network+ purposes, though, you’ll usually be working with the traditional LAN-style ranges like /24 through /30.

Host sizing example: You need 50 hosts. /27 gives 30 usable, so it is too small. /26 gives 62 usable, so /26 is the correct choice.

Interesting octet rule: the interesting octet is the octet where the mask is neither 255 nor 0. The block size method works because subnet boundaries move in increments based on the least significant network bit in that octet, which is the same thing as 256 minus the mask value in that octet.

Fast subnetting methods and worked examples

Method:

1. Identify the interesting octet.
2. Subtract the mask value from 256.
3. List subnet boundaries using that increment.
4. Find the range containing the address.
5. Derive network, broadcast, and usable range.

Example 1: 192.168.10.130/26

/26 = 255.255.255.192. Interesting octet is the fourth. The block size is 64. So the ranges are 0-63, 64-127, 128-191, and 192-255. Since 130 falls in 128-191:

• Network: 192.168.10.128
• Broadcast: 192.168.10.191
• Usable: 192.168.10.129-190

Example 2: 10.10.8.0/23

/23 = 255.255.254.0. Interesting octet is the third. Block size is 2 in the third octet. That means the subnets step by two in the third octet: 10.10.0.0/23, 10.10.2.0/23, 10.10.4.0/23, 10.10.6.0/23, 10.10.8.0/23, and so on. So the range for 10.10.8.0/23 runs from 10.10.8.0 through 10.10.9.255.

Example 3: 172.16.18.44/20

/20 = 255.255.240.0. Interesting octet is the third. The block size is 16. So the third-octet ranges are 0-15, 16-31, 32-47, and 48-63. Since 18 falls in 16-31:

• Network: 172.16.16.0
• Broadcast: 172.16.31.255
• Usable: 172.16.16.1-172.16.31.254

Same-subnet test: Are 10.1.1.62/27 and 10.1.1.65/27 in the same subnet? No, they’re not. /27 increments by 32 in the last octet. Nope. 62 falls in the 32-63 range, while 65 falls in the 64-95 range, so they’re not in the same subnet.

Gateway validation example: Host 192.168.50.10/26 with gateway 192.168.50.65 is invalid. A /26 breaks the last octet into ranges of 0-63, 64-127, 128-191, and 192-255. The host sits in the 0-63 subnet, but the gateway is sitting in the 64-127 subnet.

CIDR, summarization, and verification

CIDR uses prefix lengths instead of those old classful boundaries. Classful addressing is basically obsolete now, but you’ll still see old-school defaults like /8, /16, and /24 show up in exam distractors, so don’t let that throw you off.

Route summarization is what happens when you combine contiguous, properly aligned routes into one shorter prefix. For example, 192.168.4.0/24 through 192.168.7.0/24 can be summarized as 192.168.4.0/22.

Verification process:

1. Confirm the routes are contiguous.
2. Confirm the starting network aligns with the summary block size.
3. Compare common binary bits to find the shared prefix.
4. Confirm the summary does not include unintended networks.

Invalid summary example: 192.168.5.0/24 through 192.168.8.0/24 cannot be cleanly summarized as one /22 because the starting boundary is misaligned. And this is a big gotcha: over-summarization can black-hole traffic if you advertise a summary for networks you don’t actually own or route.

VLSM scenario walkthrough

VLSM lets you hand out different subnet sizes based on what each group actually needs, which is why it’s so useful in real networks. The workflow is pretty straightforward: sort the requirements from largest to smallest, allocate the biggest block first, and keep track of what’s left as you go.

Scenario 1: 192.168.10.0/24

• Guest Wi-Fi: 100 hosts = /25
• Engineering: 60 hosts = /26
• HR: 25 hosts = /27
• Finance: 12 hosts = /28
• Network devices: 6 hosts = /29

Remaining space: 192.168.10.248/29.

Scenario 2: branch office using 10.20.0.0/22

• Users: 180 hosts = /24
• Guest: 90 hosts = /25
• Voice: 50 hosts = /26
• Servers: 20 hosts = /27
• Management: 12 hosts = /28
• WAN point-to-point: 2 hosts = /30 or /31 in real-world designs

A clean allocation could be:

• Users: 10.20.0.0/24
• Guest: 10.20.1.0/25
• Voice: 10.20.1.128/26
• Servers: 10.20.1.192/27
• Management: 10.20.1.224/28
• WAN: 10.20.1.240/30

Documentation tip: keep an IPAM-style table with VLAN ID, subnet, gateway, DHCP range, exclusions, and purpose. In practice, VLSM designs usually go sideways when people stop documenting the leftover space and assume they’ll remember it later.

Choosing the right addressing scheme

For most internal enterprise networks, private IPv4 space is the right starting point. For internet-facing services, you either use public addresses directly or publish the service through NAT. Just be careful with private address overlap when you’re dealing with mergers, VPNs, cloud environments, or partner connections. Private space is common, but it’s not globally unique, and that distinction matters more than people think.

Addressing strategy by device type:

• Routers, firewalls, switch management, and critical servers: usually static or tightly controlled reservations
• Workstations, laptops, phones, and guest clients: usually DHCP
• Printers, APs, and some servers: often DHCP reservations instead of manual static IPs

Static vs reservation: a manual static IP is configured on the device itself. A DHCP reservation still uses DHCP, but the server always gives the same address to a known MAC address. Honestly, reservations are often easier to manage centrally.

DHCP in routed networks

DHCP is more than just “automatic IPs.” You should understand the DORA process:

• Discover
• Offer
• Request
• Acknowledge

Because the initial Discover is a broadcast, routers do not forward it by default. So if the clients and the DHCP server live on different VLANs or subnets, you’ll need a DHCP relay, often called an IP helper, on the Layer 3 interface.

Scope design should include:

• Network and mask
• Default gateway option
• DNS servers
• Exclusions for statically assigned infrastructure
• Reservations for devices that need predictable addresses
• Lease duration sized for the environment

Shorter lease times are pretty common on guest networks where clients come and go all day. Longer leases usually make more sense on stable user LANs. Scope exhaustion, a disabled scope, a client on the wrong VLAN, or a missing helper address are all common reasons a lease fails.

Compact troubleshooting lab: A user in VLAN 40 receives 169.254.22.8. First, check whether the switchport or SSID is actually mapped to VLAN 40. Then verify that the VLAN 40 SVI has the correct helper address, confirm the DHCP scope for that subnet is active and not exhausted, and test reachability from the relay to the DHCP server.

IPv6 essentials and configuration methods

IPv6 is 128 bits long and written in hexadecimal notation. For example, you might see something like 2001:db8:abcd:1::10. The documentation prefix 2001:db8::/32 is reserved for examples, which makes it handy for labs and training material. You can drop leading zeros, and one consecutive run of zero groups can be compressed with ::.

Common IPv6 ranges:

• Global unicast: 2000::/3
• Unique local: fc00::/7, commonly fd00::/8 in practice
• Link-local: fe80::/10

Most LAN segments use a /64 prefix, especially where SLAAC is used. That is the standard subnet size to remember for Network+.

IPv6 has no broadcast. IPv6 uses multicast and can also use anycast. And instead of ARP, IPv6 uses Neighbor Discovery.

Address assignment methods:

• SLAAC: host self-configures from router advertisements
• Stateless DHCPv6: host uses SLAAC for addressing but gets other settings, such as DNS, from DHCPv6
• Stateful DHCPv6: DHCPv6 assigns the address and other options

Link-local addresses are automatically present on IPv6-enabled interfaces, and they’re required for local operations like Neighbor Discovery. A useful troubleshooting clue: if you only see fe80:: addresses, the interface has link-local IPv6 but may not have received a global or unique local address.

One important contrast with IPv4: IPv6 hosts often use the router’s link-local address as the default gateway, so do not blindly apply the IPv4 gateway wording to IPv6 behavior.

VLAN-aware subnet design and inter-VLAN routing

Best practice is usually one subnet per VLAN. VLANs keep Layer 2 broadcasts contained, while subnets define Layer 3 addressing boundaries that usually line up with those VLANs.

Example mapping:

• VLAN 10 Users = 192.168.10.0/24
• VLAN 20 Servers = 192.168.20.0/27
• VLAN 30 Voice = 192.168.30.0/26
• VLAN 40 Guest = 192.168.40.0/25

Inter-VLAN routing can be provided by a router-on-a-stick design or by Layer 3 switch SVIs. In a switched campus, each SVI often serves as the default gateway for its VLAN. Access ports place endpoints into a single VLAN, while trunk links carry multiple VLANs between switches, routers, or controllers.

Implementation checks when VLAN communication fails: verify VLAN membership, trunking, SVI status, correct gateway assignment, routing table entries, and any ACLs or firewall rules between subnets.

Common subnetting pitfalls and troubleshooting workflow

Some of the most common mistakes are a wrong mask, a wrong gateway, a duplicate IP, overlapping scopes, overlapping subnets, assigning the network or broadcast address to a host, or using private ranges that collide with a connected VPN or branch network.

Decision tree:

1. Check the host IP and prefix
2. Validate the default gateway
3. Check DHCP lease details
4. Verify VLAN placement and L2 connectivity
5. Check routing beyond the local subnet
6. Check DNS if raw IP connectivity works but names fail
7. Check for duplicate IPs or overlap

Diagnostic command reference:

• Windows: ipconfig /all, arp -a, route print, tracert, nslookup
• Linux/macOS: ip addr, ip route, ip neigh, traceroute, dig
• Network devices: show ip interface brief, show vlan brief, show ip route

Wrong mask scenario: Two hosts are in the same VLAN. One host is 192.168.1.10/24 and the other is 192.168.1.130/25. The /24 host thinks both are local. The /25 host thinks 192.168.1.10 is remote because its local range is only 128-255. That mismatch can lead to asymmetric behavior and some really confusing ARP-versus-gateway decisions.

Duplicate IP case: A printer is manually set to 192.168.10.50, but that address is also inside the active DHCP pool. Symptoms can include intermittent connectivity loss, ARP table changes, or users suddenly reaching the wrong device. The fix starts with ARP tables, DHCP logs, and switch MAC table correlation. You remediate it by excluding or reserving the address and then correcting the static assignment.

Inter-VLAN failure case: Users in VLAN 10 cannot reach servers in VLAN 20. To troubleshoot that, confirm the client gateway points to the VLAN 10 SVI, make sure the VLAN 20 SVI is up, verify routing exists between the subnets, check that the trunks are carrying both VLANs, and make sure no ACL or firewall rule is blocking the traffic.

Security, performance, and integration considerations

Subnetting isn’t just about address math; it’s also a security tool. You can use it to separate guest traffic from internal users, isolate management interfaces, keep voice on its own VLAN, and place servers in controlled subnets where ACLs and firewall policy can enforce least privilege. Useful protections include DHCP snooping, IP source guard, and rogue DHCP server detection. And in IPv6-capable networks, rogue router advertisements can cause problems too.

From a performance standpoint, smaller broadcast domains cut down on ARP and broadcast noise, which is definitely worth the effort. Good summarization reduces route table size and routing churn. Good growth planning avoids renumbering and makes future branch additions easier.

Addressing also ties directly into NAT, VPNs, wireless, and VoIP. Guest wireless often uses DHCP with short leases and client isolation. Voice networks may require DHCP options for call control or configuration file transfer information depending on the platform. VPN and cloud connectivity often expose overlapping private IPv4 problems that looked harmless when the network was isolated.

Exam strategy, traps, and practice

Use this exam sequence: host count first, then choose the smallest prefix that fits, then determine the range, then validate gateway and addressing details.

Common Network+ traps:

• /27 is 30 usable hosts, not 32
• /28 is 14 usable hosts, not 16
• The gateway must be in the same IPv4 subnet as the host
• 169.254.x.x usually means DHCP failed when DHCP was expected
• IPv6 has no broadcast
• Link-local fe80::/10 is not the same as unique local fc00::/7
• Summarization requires contiguous, aligned networks

Rapid-fire drill:

• Need 12 hosts? /28
• Need 60 hosts? /26
• 192.168.5.70/26 belongs to subnet 192.168.5.64/26
• Can 10.1.1.31/27 talk directly to 10.1.1.32/27? No

Practice prompts:

1. Given 5 departments with different host counts, build a VLSM plan and leave growth space.
2. Given a host, mask, and gateway, determine whether the gateway is valid.
3. Given a client with 169.254.x.x, identify the most likely failure domain: VLAN, helper, DHCP scope, or server reachability.
4. Given several /24 routes, determine whether they can be summarized and justify the answer.
5. Given IPv6 addresses, identify link-local, unique local, and global unicast.

If you can size subnets quickly, test whether two addresses share a subnet, validate a gateway, recognize DHCP failure clues, and distinguish IPv4 private/public from IPv6 link-local/unique local/global unicast, you are right where Network+ wants you to be. Subnetting is not just math. It is one of the cleanest ways to think like a network designer and troubleshoot like a real technician.