need help in designing VLANS for 20 dept

Unanswered Question
Jun 7th, 2009
User Badges:

I have 1000 nodes for which i am planning a Campus wide network , with 1 Layer three switch, some 15 L2 switches . I have some 20 different departments and need different ip schemes for all of them. I need this with security enabled so that the departments resources are safe. Please do suggest me how can i go for it . . .

Do suggest what IP scheme i can allot , if one dept is having 60 users and another is having 490 users .

Thanks in Advance,


  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
jimmysands73_2 Sun, 06/07/2009 - 07:18
User Badges:
  • Silver, 250 points or more


Your a network engineer and your asking a semester II subnetting question...anyways.

I suggest Cisco Press or Lammles book.

But for now, you have 20 different departments, but one dept has 60 users and another is having 490, what about the other 18 departments?

Giuseppe Larosa Sun, 06/07/2009 - 11:54
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

Hello Sai Krishna,

first of all you need a classless routing protocol like RIPV2, EIGRP or OSPF so that you can use different subnet masks as needed without wasting ip addresses.

Then you need to create an address plan that fits all your needs and leave space to grow.

Likely you will be using private ip addresses as described in RFC 1918.

For example you can use:

first you divide this space in /23 subnets that are good to host 490 users


for vlans with 60 users it is wise to leave space for additional hosts if needed in the future so I would use a /25 for them

let's take further subnetting this with a /25 means moving to the right of two bits and gives four subnets:

this can accomodate 4 subnets/departments.

I wouldn't use subnets bigger then a /23 because otherwise the broadcast overhead becomes very great.

Having a multilayer switch you can also think to put the 490 users in two vlans/subnets.

About the security this depends on the security levels you want to build:

complete segregation of departments can be achieved with VRF lite (actullay different routing tables for each department).

Some level of control can be achieved by using ACLs applied on the SVI logical vlans interfaces on the L3 switch.

Hope to help


hasmurizal Wed, 07/01/2009 - 00:54
User Badges:


i do aggree with Giuseppe, because most of the time, companies might setup servers/system at several places. either full switch setup, with one core switch, or multi smaller routers as each department gateway and one big core router/core switch for main routing&switching.

my suggestion is to get a cisco vendor which can tailor made your company needs. you only need to prepare your requirement list, and company pays for it. less headache...

Leo Laohoo Wed, 07/01/2009 - 15:10
User Badges:
  • Super Gold, 25000 points or more
  • Hall of Fame,

    The Hall of Fame designation is a lifetime achievement award based on significant overall achievements in the community. 

  • Cisco Designated VIP,

    2017 LAN, Wireless


There are three ways to complete a project: cheap, right and fast. CHOOSE TWO.

Firstly, you need someone to verify your network architecture. From the sound of your description, you're first biggest hurdle would be to get 20 different heads together and talk about what they have, what they want, and what your project will achieve.

You'll undoubtedly come across a number of department saying that they have a home-grown 286 machine that may require a 10Gb link (ha ha ha!).

Next, your budget. How much (laughable) it will be, you then need to choose the appropriate appliance: switches, routers, Firewalls, etc.

Hope this helps.

Joseph W. Doherty Thu, 07/02/2009 - 10:52
User Badges:
  • Super Bronze, 10000 points or more

Divide your physical subnets such that there are none larger than /25 or /24, allocate those subnets, for each department, out of its own /20 address block. Assign unique VLAN to each physical subnet.

You might also want to split dept. user subnets from dept. server subnets and common resource subnets.


With a L3 switch for routing, no real need to worry about placing logically related hosts in the same VLAN. Allocating physical subnets out of a dept. address block, will ease defined ACLs, if needed, between logical groups (i.e. depts.).

So, for your dept. with 60 users vs. 490 users, both would be defined from their own /20 block for ACL purposes, but the 60 users would be in one /25 or /24 subnet and VLAN while the 490 would use several.


This Discussion