2

We need to change our netmask in one of our sites since we plan to deploy VoIP phones. Currently we use a class A network address with a /24 netmask and would like to move to a /23 netmask.

We have 1 physical DC and 1 virtual DC (both running DNS), a DHCP server, an Exchange server, a WSUS server, a file server and a NAS which provides additional LUNs for the file server and some other not so important stuff.

I really don't know much about networking so please correct me if I'm wrong, but changing only the netmask from /24 to /23 should not be that much of a problem since it's technically the same network, right?

Steps I know of:

  • Adjusting network address and netmask in router
  • Change AD Sites & Services Subnet
  • Configure reverse lookup zone on DNS
  • Remove superseded DNS record of DCs/DNS-Server
  • Configure new DHCP scopes
  • Adjusting netmask of all static addresses

Is there anything special we need to take into account when moving to the new netmask? Like anything SMTP related, or something like port forwarding?

I must be sure that our Exchange will work as planned before making any major changes to our infrastructure.

1
  • 1
    You should seriously consider putting IP phones on a different subnet/VLAN. That way you could cleanly separate sensitive and potentially vulnerable devices into a zone of their own. Also, you wouldn't need to change your existing network...
    – Zac67
    Aug 5, 2021 at 6:38

2 Answers 2

4

I realize this is old, but maybe it can help someone else with the same question.

First, this is not a comprehensive plan. You need to follow good business practices, build out a full procedure with back out and test stages along the way. There may be brief network outages at the static devices if adjusting the Netmask causes the interface to reset. Don't connect over the interface that you are changing.

Second, going larger is by far the easier direction to change a Netmask, but make really sure you are not better off with separate segments before you go this route because going back smaller is not fun. You may also find hosts configured incorrectly when you do this process. Hosts can work with bad netmask entries in certain circumstances, but this is really dependent on the host IP stack.

Netmask defines if a given host is part of a particular network and if it can communicate directly with another host. It determines if the the packet needs to interact with a router or gateway to reach a particular destination node.

DNS: Nothing in DNS uses the netmask. That is why you don't need a DNS server in your current segment for it to work. Ditto for mail or any other IP based service.

DHCP Scope: You only need to change the DHCP Scope if you want the DHCP server to provide addressing within the new space. Since a DHCP scope needs to be contiguous addresses, and you cannot define multiple groups within an address space, you may run into a problem if your gateway IP address specifically or any of your static servers fall into the new scope and is assigned to another system unless a static DHCP assignment is created for all of those devices even if they are set static on the host. A coded assignment prevents the DHCP from assigning the IP, but since it is based on MAC address, the card breaking will break this static setting. Really, just don't do it, you are asking to break things.

The DHCP server needs to be in the same segment as the hosts it serves because a broadcast packet is used when a client queries for an address. Broadcast packets are not routed by their very nature.

Making the space larger increases your potential collision domain. That means more hosts that potentially can't talk at the same time if you have cheap switch hardware. Increasing the address domain may have performance impacts if your network has chatty broadcast services since all hosts receive broadcast packets even in a switched network.

Note: Depending on what address space you currently use is going to determine if the new addresses will be above or below your current range.

  • In your /24, if the existing 3rd octet is odd, then then the /23 space will be below the address space you are in now. Yes x.x.zero.x is a valid range. If you are in x.x.1.x and want to use x.x.2.x then you need to expand even further into a /22 which will also include x.x.3.x.
  • In your /24, if the existing 3rd octet is even, then then the /23 space will be above the address space you are in now.
  • You will want to make sure that any new space included is not in use in another segment of your network before making the change.

Going larger means that your existing gateway will still be in the the masked address space. If you ever had to go smaller, you would need to define a new gateway in the new network space and then update all of the hosts with their correct gateway and mask information.

Prior to the change: I would prepare the DHCP assigned machines by getting them into a more frequent address update timing -- 30-60 minutes.

If your DHCP lease is a day or more you'll want to make this change that much ahead of when you plan to do the cut-over. This way when you make the change the end hosts will get their update sooner and allow you to begin confirming everything is working for those hosts. After everything is confirmed working you can extend the lease time back to where it was.

You don't need to do this if you plan on manually clearing the leases and rebooting all of them, but the whole idea of DHCP is to have the DHCP function provide the update, and its possible that you will miss something. Let DHCP do its thing. This way if you have statically assigned DHCP addresses they will get updated properly.

Time of change

  • Update your router(s) to recognize the new space on the interface.
  • core servers - test
  • update DHCP Server - That Netmask is what propagates to the hosts. Then wait until all the hosts should have the new netmask before you do testing. You can look at the DHCP lease entries to see when they were last provided.
  • While you are waiting for DCHP to do its thing for all of those hosts, you can configure the all of the manual hosts and devices.
6
  • Fantastic answer. It may be worth emphasizing that there will be network outages for devices as they move onto the new scheme.
    – Daniel K
    Aug 3, 2021 at 7:18
  • @DanielK I don't think growing into unused address space will cause an huge outage for the existing devices. There may me a slight outage while the gateway resets the interface to apply the new settings which is why its the first step. Nothing is moving from a gateway address perspective for any of the devices. NETMASK is applied to the device sending the packet and is combined with the Destination IP to determine if the packet should be sent to the gateway or to be looked up in the local ARP table or if an ARP needs to be generated to find the local host. Aug 5, 2021 at 5:06
  • The one thing I didn't include as out of scope for the question is a best practice of starting your IP addressing on powers of 2 boundaries for easier future expansion, since that way existing devices would be more likely to stay at the bottom of their respective blocks, but even at some of the larger companies (call centers) I've worked at, the architecture was such that /22 block was sufficient to handle all of the hosts in a building, or even other dependencies on if your architecture is building centric or function centric. Aug 5, 2021 at 5:34
  • I was just thinking that ARP will not work between devices that have different netmasks.
    – Daniel K
    Aug 5, 2021 at 14:34
  • @DanielK They work on different layers. ARP is Layer 2, IP and therefor NETMASK is Layer 3. ARP's will traverse switches(Layer 2) but not gateways or routers(Layer 3). Nemask is for defining the scope of a Layer 3 network. en.wikipedia.org/wiki/Address_Resolution_Protocol Aug 5, 2021 at 15:32
0

I've had experience doing this a few times (no judging) but to point out a few points:

  • I totally prefer to not expand a /24 to a /23, and have two separate /24 instead. Most of the time this is the working approach.
  • As mentioned already - DNS is completely out of scope and there is nothing that needs changing there.
  • Assuming the gateway for the current devices does not change, most of the time devices in the current /24 only need to be updated to a /23 if they need to communicate with devices on the expanded part of the /23 segment. This is important to note because this means that you don't have to do a big-bang migration with downtime to the new subnet. If this is the case, you can update the DHCP server configuration and not worry too much about when exactly this is going to propagate to the devices.
  • Seriously recommend rebooting each device you change - you don't want to find out that your runtime configuration was not properly reflected in the persistent configuration.

To summarize for your use case, assuming you are expanding to accommodate the new VoIP phones:

  • Most likely you don't have to expand to /23 and stick to another /24 for the phones.
  • There should be no need to change the DNS
  • If you decide to change to a /23, you may not have to update the current devices in the /24 immediately, unless there is some requirement for them to talk to the phones (in my experience, there is no such need).
1
  • On your third point, I find that while yes you can leave those hosts in the /24 without making changes to them, that it is better for long term maintainability that you change all of the hosts during the maintenance window and then never need backtrack to update/fix things prior to deployment of future services. Doing it this way is doing half the job. Aug 8, 2021 at 7:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .