Calculate IPv4 boundaries, allocate unequal networks, and challenge unsafe route summaries with reproducible evidence.
55 min 180 XPSkills: Subnet arithmetic, VLSM allocation, Route summarisation
Brief
At Halcyon Clinics, a network change assigns an imaging workstation 192.0.2.127/26. The change owner calls it the last usable address and attaches a successful configuration save as proof. The workstation cannot communicate reliably: the address is the subnet-directed broadcast, not a host address. A syntactically accepted configuration is not evidence of correct addressing.
You will reconstruct boundaries before approving host assignments, divide address space according to actual capacity, and distinguish a routing shortcut from a security boundary. Keep the parent allocation, requirements, calculations, and approved configuration together: an auditor needs to reconcile authorised scope with deployed routes and filtering rules, not merely see that a change ticket closed.
A prefix determines an address set; a firewall policy determines permitted traffic. Subnet arithmetic supports segmentation but does not enforce it.
Find boundaries with the block size method
An IPv4 prefix /p leaves h = 32 - p host bits. A /26 mask is 255.255.255.192: the changing octet has block size 256 - 192 = 64. Networks in a /24 therefore start at .0, .64, .128 and .192. For 192.0.2.109/26, round the final octet down to a multiple of 64: floor(109/64) × 64 = 64. The network is 192.0.2.64, the next network is .128, and the broadcast is one less, .127.
In an ordinary multiaccess subnet, all-zero host bits identify the network and all-one host bits identify its broadcast. The first usable address here is 192.0.2.65, the last is 192.0.2.126, and 2^6 - 2 = 62 addresses are usable. The same method works across octets: /20 has mask 255.255.240.0 and third-octet blocks of 16. Address 172.20.37.9/20 belongs to 172.20.32.0/20, ending at broadcast 172.20.47.255; usable endpoints are 172.20.32.1 and 172.20.47.254.
For address-integrity controls, compare the address inventory and interface prefix against these computed endpoints. Preserve the input address, prefix, calculation and actual interface export. Ask whether any assigned endpoint equals a reserved boundary; a configuration-save receipt alone cannot answer that question.
Block boundaries include reserved endpoints, so a 64-address block supplies 62 ordinary host addresses.
Choose a prefix and split a /24
For N required usable IPv4 addresses on an ordinary subnet, find the smallest integer h satisfying 2^h - 2 ≥ N, then choose / (32 - h). For 50 required addresses, five bits supply only 30 usable addresses; six supply 62, so /26 is the smallest sufficient allocation. Count gateways, virtual addresses and other consumers in N. If 50 means workstations only, add infrastructure and any explicit growth allowance before doing the calculation; do not silently equate workstations with total demand.
Borrowing two host bits splits 192.0.2.0/24 into four /26 networks: 192.0.2.0/26, 192.0.2.64/26, 192.0.2.128/26 and 192.0.2.192/26. Their broadcast addresses are .63, .127, .191 and .255. The split produces 4 × 62 = 248 usable addresses rather than the parent's 254, because each ordinary child reserves its own pair of endpoints. Modern subnetting permits both the first and last child subnet; do not subtract two from the number of subnets.
Capacity approval should retain a dated demand table and any growth assumptions alongside the allocation. An auditor can then test whether the selected prefix meets the approved total and whether every child is contained in its parent. Separate networks still need enforced inter-network policy and connectivity tests to substantiate a segmentation control.
Allocate VLSM largest-first without overlaps
Variable-length subnet masking (VLSM) assigns different prefixes to different needs. Within 198.51.100.0/24, suppose imaging needs 100 usable addresses, staff needs 50, and telemetry needs 20; these totals already include infrastructure. The minimum sizes are /25 (126 usable), /26 (62 usable), and /27 (30 usable). Allocate largest-first from the lowest free aligned address: imaging 198.51.100.0/25, staff 198.51.100.128/26, telemetry 198.51.100.192/27. Their broadcasts are .127, .191 and .223 respectively.
This leaves 198.51.100.224/27 unallocated. A proposed staff block starting at .160/26 is not a network boundary: /26 starts are multiples of 64, so that address actually lies within .128/26. Record explicit start and end intervals, ensure each lies within the parent, and check that no two intervals intersect. Largest-first reduces fragmentation in this constrained plan; it does not waive alignment or automatically solve allocations around existing occupied ranges.
A reproducible allocation manifest supports change control and ownership accountability. Link each child to its service owner, retain the unallocated interval, and compare the manifest with routing and address-assignment exports after deployment. The audit question is whether a supposedly unused range is genuinely unused, not whether a diagram has enough blank space.
Aligned largest-first placement meets unequal demands while preserving one explicit free block.
Summarise routes without inventing scope
An exact single-prefix summary requires contiguous, correctly aligned blocks that fill the parent. Routes 10.24.8.0/24 and 10.24.9.0/24 collapse to 10.24.8.0/23, spanning 10.24.8.0 through 10.24.9.255. By contrast, 10.24.9.0/24 and 10.24.10.0/24 cannot form an exact /23: the smallest covering prefix is 10.24.8.0/22, which also includes the unlisted .8 and .11 networks. Compare the longest common leading bits, then explicitly inspect every extra address covered. Aggregation is a routing decision, not permission to extend an allow rule.
The ordinary 2^h - 2 formula has important exceptions. On an IPv4 point-to-point link using RFC 3021, a /31 supplies two endpoint addresses: 203.0.113.10/31 uses both .10 and .11, with no separate network or broadcast reservation on that link. Confirm support at both ends. A /32 identifies one address, commonly a host route or loopback address; it is not a zero-host LAN and has no distinct subnet broadcast endpoint. Do not apply these exceptions to an ordinary shared subnet.
Keep component routes, the proposed aggregate, covered intervals, and ownership approval as evidence for route-change review. Test both intended reachability and unintended exposure, especially when an aggregate crosses trust boundaries. For a /31 exception, preserve link topology and endpoint support evidence; for a /32 route, identify the exact destination and next hop rather than claiming a surrounding host pool.
Tasks
Answers are graded on the server: the answer key never reaches your browser.
Task 1: The broadcast workstation
Scenario sim+60 XP
Read the brief and answer both questions.
Incident brief
A workstation is configured as 192.0.2.109/26. The change owner says its subnet starts at .96 because that is the nearest familiar boundary, and proposes reserving .127 for a gateway. Recalculate from the actual mask before approving the address register.
Term bank, not all of these are right
192.0.2.64192.0.2.96192.0.2.126192.0.2.127
1.1What is this workstation's network address? (IPv4 address)
1.2What is the last usable host address in its subnet? (IPv4 address)
Task 2: Fifty means fifty usable
Scenario sim+60 XP
Read the brief and answer both questions.
Incident brief
A service requires exactly 50 usable addresses, including its gateway and all infrastructure; no growth reserve is requested. A planner proposes /27 because '32 addresses is plenty after compression' and claims splitting a /24 into /26 children gives each child 64 usable addresses. Treat these as ordinary IPv4 subnets, not point-to-point links.
Term bank, not all of these are right
/26/276264
2.1What is the smallest sufficient subnet, expressed as a prefix length? (a number)
2.2How many usable addresses does each /26 child provide? (a number)
Task 3: A summary is not an exception waiver
Scenario sim+60 XP
Read the brief and answer both questions.
Incident brief
A router advertises only 10.24.8.0/24 and 10.24.9.0/24. An operator requests the single exact aggregate, but labels a broader /22 'equivalent'. The same operator marks a separate RFC 3021 point-to-point /31 link as having zero usable endpoints by applying the ordinary LAN formula.
Term bank, not all of these are right
10.24.8.0/2310.24.8.0/2220
3.1What single aggregate covers exactly the two advertised networks? (CIDR notation)
3.2How many usable endpoint addresses does the stated /31 link have? (a number)
Labs
80 bonus XP
Hands-on work. You edit the artefact, the server runs the checks: the expectations and the reference solution never reach your browser.
Halcyon Clinics must allocate imaging, staff and telemetry networks inside one /24. The service owner calls the telemetry broadcast address its 'last host' and asks you to copy it into the assignment manifest. Recalculate rather than copying the label.
Use the smallest sufficient ordinary subnet for each demand, allocating largest-first at the lowest available aligned address. Fill every field with exact numeric values or dotted-decimal addresses and CIDRs as appropriate. Demands include gateways and all infrastructure; there is no additional reserve. Record telemetry's full host boundaries and the exact free block left over.
Approved address demand and placement rule
parent: 198.51.100.0/24
imaging_required_usable: 100
staff_required_usable: 50
telemetry_required_usable: 20
placement: largest-first, lowest available aligned address
owner_note: telemetry broadcast is its last assignable host
1
2
3
4
5
6
7
8
9
10
11
12
13
14
Checks
Largest demand has its minimal aligned block and capacity
Staff follows without overlap and meets capacity
Telemetry uses its minimal remaining aligned block
Telemetry network and broadcast are exact
Telemetry first and last usable hosts exclude reserved endpoints
Remaining address space is recorded as one exact CIDR
Six claims accompany a route and address change. The owner insists that fewer route entries always mean safer segmentation, and that the same usable-host formula applies everywhere.
Judge each claim independently using exactly the stated topology and address demand. Reject false claims with the most specific supplied reason; accept correct claims even when another line in the same change is wrong.
Verdicts are accept or reject. Every rejection needs one reason code from: reserved-endpoint | insufficient-capacity | unaligned-network | overbroad-summary.
Independent claims submitted for approval
NS-1 | Ordinary subnet: 192.0.2.64/26 provides 62 usable addresses.
NS-2 | Ordinary subnet: 192.0.2.127 is assignable inside 192.0.2.64/26.
NS-3 | A demand of 50 usable addresses including infrastructure fits in an ordinary /27.
NS-4 | 198.51.100.160/26 is a canonical network boundary.
NS-5 | 10.24.8.0/22 covers exactly 10.24.9.0/24 and 10.24.10.0/24, with no extra addresses.
NS-6 | On a supported RFC 3021 point-to-point link, 203.0.113.10/31 supplies two usable endpoint addresses.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
Checks
Every line in the fixture carries a verdict
Accept and reject land on the right lines
Each rejection cites a valid reason code
Next on your path · Networking Fundamentals
IPv6 Essentials
Read IPv6 addresses, distinguish scope and configuration mechanisms, and close dual-stack control gaps.
