How to design a VLAN and subnet scheme

Split the network by what needs separating, size each subnet to what it holds, then check the plan against the handful of faults that cause real outages.

A VLAN is a separate broadcast domain on shared switching hardware. Devices in different VLANs cannot reach each other without something routing between them, which is the point.

Deciding how many

Separate by what genuinely needs separating rather than by org chart.

• Voice — phones benefit from separation for quality-of-service handling.
• Wireless guests — the classic case, since guest devices should reach the internet and nothing else.
• Cameras, door controllers, building systems — devices that are rarely patched and should not be able to reach anything interesting.
• Management — switch and firewall interfaces, reachable only from where administration happens.
• Servers, where the traffic pattern differs from user machines.

A VLAN per department in a single office usually adds complexity without adding safety, since the routing between them tends to permit everything anyway.

Sizing the subnets

Size each to what it holds, plus headroom. Guest wireless needs far more addresses than the device count suggests, because phones come and go and leases linger. A /24 is a habit rather than a rule; twelve printers do not need 254 addresses.

Very large broadcast domains have costs of their own — broadcast traffic reaches every host — so a single flat /16 is not the simple answer it looks like.

The conventions worth adopting

Match the VLAN ID to the subnet where you can: VLAN 10 on 10.0.10.0/24, VLAN 20 on 10.0.20.0/24. It costs nothing at design time and saves a great deal when reading a configuration at two in the morning.

Put the gateway at the first usable address, or the last, and never mix the two. Which one matters far less than consistency.

Keep DHCP pools in a predictable part of the subnet — the upper half is common — leaving the lower part for static assignments.

The mistakes that actually cause outages

A DHCP pool that includes the gateway. The scope eventually leases the router's address to a laptop and the subnet loses its default route. The symptom is "the internet is down for some people", which points nowhere near the cause.

Overlapping subnets. Hosts get addresses that appear local and are not reachable, and the fault is intermittent.

A duplicate VLAN ID, where two designs claim one broadcast domain.

Leaving user traffic on VLAN 1, which is the default and usually the native VLAN on trunks.

Frequently asked questions

How many VLANs does a small office need?

Often three or four: users, voice, guest wireless and management. More than that adds configuration to maintain without adding separation that anybody enforces.

Should the VLAN ID match the third octet of the subnet?

It is a convention worth adopting — VLAN 20 on 10.0.20.0/24. It makes configurations readable and costs nothing to set up.

Why should the DHCP pool avoid the gateway?

Because the scope will eventually lease the router's own address to a host, and the subnet loses its default route. It is the commonest way a working network is broken by a change.

Is a bigger subnet safer than running out?

Up to a point. Very large broadcast domains carry more broadcast traffic to every host, so a flat /16 has its own costs. Size to the requirement with headroom rather than to the maximum.