We currently have a few servers, around 30-40 workstations and 16 phones. Each device has a static IP address.

As an example the standard settings for a new workstation is;

IP: 192.168.1.XXX

As I am slowly exploring new server OS's and virtualisation etc. I am getting close to wanting a wider range of IP addresses.

What I would like to do is seperate the devices by IP as follows:

Servers        192.168.1.XXX
Workstations   192.168.2.XXX
Printers       192.168.3.XXX
Phones         192.168.4.XXX
VM's           192.168.5.XXX

Is this a bad idea, or is this a common way of doing things?

My biggest concern is the phones and subnet masks. The phones are managed by our provider although I have access to the server that runs them.

Would I need to change the subnet mask to on all devices? Or only those that change? For example, the phones don't need to connect to any other devices other than other phones and the phone server. So if I have the phones on 192.168.1.XXX with a subnet mask of and then moved everything I had complete ownership/control of to 192.168.X.XXX with a new subnet mask of

Would that work?


You can't really put your phones on 192.168.1.x/ and everything else on 192.168.x.x/, because you have overlapping network definitions, then. I mean... it might work, at least in some cases (for some network stacks, etc), but it's not the "right" way to do it.

Traditionally, there are problems with really large subnets in Windows workstation environments, because of the amount of broadcast traffic they transmit. Although I think that's really more related to the actual number of Windows PCs, than to the subnet. Maybe a Windows expert can shed more light on this area.

My advice would be to keep your subnets small, but use several of them if necessary. And try to separate them physically. It's annoying (although certainly not impossible) to have multiple subnets over the same physical wire--especially when more than one tries to use DHCP.

I would probably consider a configuration something like this:

Workstations/Phones    192.168.1.xxx (presumably they use DHCP)
Servers/VMs            192.168.2.xxx (they're probably all in the server closet, so can be on a separate physical subnet)
Printers               192.168.3.xxx (These probably all have static IPs)
Public                 193.168.4.xxx

Public here would be used if you have a wireless network, or ethernet jacks in a conference room that visiters can use--you want these to be isolated physically, so you can run a more strict firewall here, and keep strangers from sniffing your ethernet traffic, or using less restricting firewall settings to get into your server, or downloading porn, or whatever other mischief they might find to do.

The main advantage to keeping your workstations and servers on separate subnets really has more to do with security. That way you can put up a firewall between the two, and keep random "passers by" on your workstation network plugging in their home laptop, iPad, or whatever, and endangering the privacy/security of your servers.

If your printers use DHCP, you may want them on the same network as the workstations... Or you could set up two physical ethernet segments (or even three)--one for workstations, one for phones, one for printers. I'm not sure what the advantage would be here. And many VoIP phones act as a one-port ethernet switch, to allow the phone and PC to connect where only one ethernet jack is present. If you use this feature, you'll need your phones and workstations on the same physical LAN anyway. (And if you don't use this, you need to account for people who might choose to plug a PC into their phone's ethernet port--whether out of convenience, ignorance, or malice).

The reason I put servers and VMs on the same network is because they're likely in the same physical room. But you could potentially split them.

So in a nutshell... to me, the main reason to subnet (before running out of address space) is for security, not for extra addresses. That doesn't mean it's the only valid school of thought.

| improve this answer | |
  • Thanks for the in depth response. Would I need to change the subnet mask for any device that doesn't use a subnet higher than 192.168.1.XXX. For example, if I left the phones and workstations on 1.XXX and moved the servers to 2.XXX, would I need to alter the phones/workstations subnet masks? – dannymcc Jun 23 '11 at 21:40
  • You would need to change the network address to 192.168.2.x instead of 192.168.1.x. The subnet mask would remain the same, For any devices that are using DHCP, you can control all of that on the DHCP server. In fact--this might be a reason to leave your servers (which I'll guess don't use DHCP) at 192.168.1.x, and move everything else--so you have less manual mangling to do in IP configurations on each machine. :) – Flimzy Jun 23 '11 at 22:04

Soooo much easier to use DHCP for everything but the servers, servers should always be static. Use DHCP to assign to with subnet mask (aka /21). The servers would all get 192.168.0.x addresses. The DG would be or similar...

| improve this answer | |
  • This is a little over my head to be honest! We can't have DHCP for the workstations as a third party unix system requires static IP's for them. – dannymcc Jun 23 '11 at 21:58
  • 1
    Would still be easier to use DHCP and setup reservations for the workstations. That's really rare that a system would require static IPs like that, are you absolutely sure it's necessary? – Chris S Jun 23 '11 at 22:36
  • @dannymcc Does the 3rd party system actually require an absence of DHCP or does it require that your workstation addresses don't change? Any DHCP server worth its salt will let you assign permanent reservations. – Gerald Combs Jun 23 '11 at 22:37
  • As far as I am aware it simply requires workstations to have static addresses. The phones must have DHCP running because they auto-assign themselves an IP above 1.2XX. – dannymcc Jun 24 '11 at 10:13

I see the thinking behind your wanting to address each "class" of device by device type as it makes it easier to remember that all the servers are .1.x, all the workstations are .2.x, and so on but follow what Chris S suggests which allows you to "classify" the ip addresses by device type but maintains a single layer 3 subnet for all devices in order to avoid having to route between different subnets.

As for what Flimzy suggested in his answer, it's the number of hosts on each subnet that determines the volume of broadcast traffic, not the size of the subnet. It's true that a larger subnet has the potential to be a larger broadcast domain by virtue of the fact that you can assign more hosts to a larger subnet, but the fact of the matter is that if I have 50 hosts then the size of the subnet is irrelevant, I have 50 hosts worth of broadcast traffic whether the size of my subnet supports 50 hosts or 500.

| improve this answer | |

Since you are using a private address range, I assume you are behind a NAT firewall/router. Most SOHO routers use a netmask of and can not be changed. If you can configure your router to use, then your idea will work, but not otherwise.

As for whether it is common; no, most people just use DHCP to auto assign addresses rather than try to track static assignments by hand.

| improve this answer | |

Short answer: You could probably get what you're describing with the phones to work. (no promises, but it sounds okayish).

Longer answer:

If your goal is to preserve the large flat network you have now, go for the wider subnet mask ( I don't recommend that, but it should work for now. Separating the systems into IP groups by function is good, and it will help you later when you decide that flat no longer works for you. Leaving the phones with a different subnet mask isn't good practice, and if it breaks, it will break in ways that will confuse you and people trying to help you greatly.

If your goal is to start to advance in network structure, including later transitioning to a more segmented network, you'll want the skinnier(?) subnet mask ( and to add a router to route between subnets. Note that this should work even if you only have one broadcast domain (network segment / switch), but it won't cut down on broadcast traffic.

The next step is the segmenting mentioned above. That'll be where you invest in smarter switches or additional switches.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.