You already know how to carve a large IP address block into smaller, equal-sized pieces. But in the real world, networks rarely have uniform needs. Your user department might need 500 addresses, the server farm might need 60, and the point-to-point links connecting your core routers only need two each. Using a single subnet size for all these is incredibly wasteful.

This is where Variable Length Subnet Masking comes in. VLSM is a strategy, not a different technology. It's the practice of subnetting a subnet, allowing you to create network segments of different sizes from a single parent block. This maximizes address efficiency, tailoring each subnet to its specific requirement.

Let's plan an IP scheme for a small office with the network block 192.168.10.0/24. The requirements are:

• Engineering: 100 hosts
• Sales: 50 hosts
• Management: 20 hosts
• Router Links: Two links, each needing 2 hosts

To accommodate 100 hosts, we need 7 host bits ($2^7 = 128$), which means a /25 mask. For 50 hosts, we need 6 host bits ($2^6 = 64$), a /26 mask. For 20 hosts, we need 5 host bits ($2^5 = 32$), a /27 mask. Finally, for point-to-point links, we need 2 host bits ($2^2 = 4$, leaving 2 usable IPs), which is a /30 mask.

Notice how we allocated the blocks sequentially without any overlap. We met every requirement while using the address space far more efficiently than if we had used a single /25 mask for every department.

Now that we have our logical subnet plan, we need to implement it on the network hardware. This is done using Virtual LANs, or VLANs. The universally accepted best practice is to maintain a one-to-one mapping between a subnet and a VLAN. Engineering gets its own VLAN and its own subnet. Sales gets its own VLAN and subnet. This keeps things clean, secure, and manageable.

This segmentation happens within a hierarchical network design. End-user devices like laptops and printers connect to access layer switches. These switches connect upstream to distribution layer switches, which aggregate traffic and handle routing between the different segments.

For VLANs to span multiple switches, the links between them must be configured as trunks. A trunk link carries traffic for multiple VLANs simultaneously. To keep track of which frame belongs to which VLAN, the 802.1Q standard adds a small tag to the Ethernet frame. This tag contains the VLAN ID.

One VLAN on a trunk is special: the native VLAN. Traffic on the native VLAN is the only traffic that travels untagged across the trunk. This creates a potential security risk. An attacker could send specially crafted, double-tagged frames to hop from their own VLAN to another, bypassing security controls. For this reason, it's a best practice to change the native VLAN from the default (VLAN 1) to an unused VLAN, and to not assign any user devices to it.

By design, devices in different VLANs cannot communicate with each other. They are in separate broadcast domains. To allow communication—say, for a user in the Sales VLAN to access a server in the Engineering VLAN—you need a Layer 3 device, a router, to forward traffic between them.

There are two primary methods for this: Router-on-a-Stick (ROAS) and Switch Virtual Interfaces (SVIs).

ROAS works well for smaller networks but has limitations. All inter-VLAN traffic has to travel up to the router and back down again, which can create a bottleneck at the single physical link. Here's a glimpse of the router configuration:

A more modern and scalable approach is using Switch Virtual Interfaces on a multilayer (Layer 3) switch. An SVI is a virtual Layer 3 interface created for a specific VLAN on that switch. The switch can route traffic between its configured SVIs at hardware speed, which is much faster than sending it to an external router.

Each SVI acts as the default gateway for the devices in its corresponding VLAN and subnet.

Let's test your understanding of these concepts.

Properly designing a segmented network is a balancing act. It improves performance by shrinking broadcast domains and enhances security by isolating traffic. But it also introduces complexity in routing and management. By mastering VLSM and the interplay between VLANs, trunks, and Layer 3 gateways, you can build networks that are efficient, scalable, and secure.