1. Introduction: Why VLANs and Subnetting Matter

In modern enterprise networks, managing scale, performance, and security efficiently is crucial. To do this, network architects and IT administrators must configure VLANs and configure subnetting to segment the network into logical domains. This ensures better control, minimizes broadcast traffic, and improves overall security posture.

This guide will walk you through the step-by-step process of setting up VLANs and subnets, using 172.x.x.x private IP ranges to illustrate real-world enterprise examples. We’ll also touch on 10.x.x.x networks for larger-scale deployments.

---

2. Key Concepts: VLANs & Subnetting Basics

What is a VLAN?

A Virtual Local Area Network (VLAN) is a logical grouping of devices on separate physical LANs that behave as if they are on the same network. VLANs are implemented on switches to:

• Reduce broadcast domains
• Increase network performance
• Improve security by isolating traffic between departments

Each VLAN is identified by a unique VLAN ID (from 1 to 4094).

What is Subnetting?

Subnetting divides a larger IP network into smaller sub-networks (subnets). This process improves:

• IP address utilization
• Network organization
• Routing efficiency and scalability

By applying subnet masks, you define how many hosts can exist within each subnet.

---

3. Choosing Your IP Ranges: 172.x.x.x vs 10.x.x.x

Enterprises often use:

• 172.16.0.0 – 172.31.255.255 (/12 range) – Ideal for mid-sized enterprise networks needing structure.
• 10.0.0.0 – 10.255.255.255 (/8 range) – Ideal for massive internal networks requiring many subnets.

For this guide, we’ll use 172.16.0.0/16 to model our VLANs and subnets.

---

4. Step-by-Step: How To Configure VLANs

Step 1: Plan Your VLANs

Suppose we have the following departments:

Department	VLAN ID	Subnet
Finance	10	172.16.10.0/24
HR	20	172.16.20.0/24
Engineering	30	172.16.30.0/24

Step 2: Create VLANs on the Switch

Using a Cisco-like CLI interface:

bashCopyEditenable
configure terminal

vlan 10
 name Finance
vlan 20
 name HR
vlan 30
 name Engineering

exit

Step 3: Assign Access Ports

Assign ports to the correct VLAN based on physical connection or function:

bashCopyEditinterface range GigabitEthernet0/1 - 10
 switchport mode access
 switchport access vlan 10
exit

interface range GigabitEthernet0/11 - 20
 switchport mode access
 switchport access vlan 20
exit

interface range GigabitEthernet0/21 - 30
 switchport mode access
 switchport access vlan 30
exit

Step 4: Configure Trunk Ports

Trunk ports allow multiple VLANs to pass between switches and routers:

bashCopyEditinterface GigabitEthernet0/48
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30
exit

---

5. How To Configure Subnetting

Step 1: Choose a Subnet Scheme

Using 172.16.0.0/16, break it into /24 subnets:

• 172.16.10.0/24 → VLAN 10
• 172.16.20.0/24 → VLAN 20
• 172.16.30.0/24 → VLAN 30

Each /24 subnet supports 254 hosts (ideal for most departments).

Optional Larger Subnets with /23 or /22

• /23 = 510 hosts
• /22 = 1022 hosts

If using 10.x.x.x, you can carve much larger address blocks.

Step 2: Configure Interface IPs for Routing

To allow devices in different VLANs to communicate, configure a router-on-a-stick setup:

bashCopyEditinterface GigabitEthernet0/1
 no shutdown

interface GigabitEthernet0/1.10
 encapsulation dot1Q 10
 ip address 172.16.10.1 255.255.255.0

interface GigabitEthernet0/1.20
 encapsulation dot1Q 20
 ip address 172.16.20.1 255.255.255.0

interface GigabitEthernet0/1.30
 encapsulation dot1Q 30
 ip address 172.16.30.1 255.255.255.0

Alternatively, on Layer 3 switches:

bashCopyEditinterface vlan 10
 ip address 172.16.10.1 255.255.255.0
 no shutdown

interface vlan 20
 ip address 172.16.20.1 255.255.255.0
 no shutdown

interface vlan 30
 ip address 172.16.30.1 255.255.255.0
 no shutdown

ip routing

---

6. Best Practices for VLAN and Subnet Deployment

Separate Voice and Data VLANs

Use dedicated VLANs for VoIP systems (e.g., VLAN 40: 172.16.40.0/24).

Reserve VLANs for Infrastructure

Designate a VLAN for management (e.g., VLAN 99: 172.16.99.0/24).

Use Private IP Address Ranges Wisely

• Use 172.16.x.x for departmental segmentation
• Use 10.x.x.x if you need massive internal routing with thousands of devices

Control Inter-VLAN Communication

Use ACLs (Access Control Lists) or firewalls to restrict communication between sensitive VLANs:

bashCopyEditaccess-list 100 deny ip 172.16.10.0 0.0.0.255 172.16.20.0 0.0.0.255
access-list 100 permit ip any any

interface vlan 10
 ip access-group 100 in

---

7. Troubleshooting VLAN and Subnet Issues

Common Issues and Fixes

Issue	Fix
Hosts can’t communicate	Verify VLAN assignment and subnet mask
Devices can’t reach router	Check trunk port config and interface status
Broadcast storm or loops	Use STP (Spanning Tree Protocol)
IP conflicts or DHCP issues	Assign static ranges or use scoped DHCP pools

---

8. Real-World Scenario: 3-Site Enterprise

Your company has three physical locations connected via VPN:

• HQ: VLANs 10-40 (172.16.10.0/22)
• Branch 1: VLANs 50-60 (172.16.50.0/24)
• Branch 2: VLANs 70-80 (10.10.70.0/24)

Each site uses a consistent VLAN-ID/IP mapping. You route inter-site traffic through a central firewall or MPLS.

---

9. Final Thoughts: Building a Scalable, Segmented Network

To configure VLANs and configure subnetting correctly is to empower your enterprise network with the tools it needs to scale, stay secure, and operate efficiently. Logical segmentation is not only a best practice—it’s a necessity in today’s hybrid, cloud-enabled environments.

Use tools like:

• Network topology diagrams
• IP planning spreadsheets
• VLAN documentation templates

…to ensure long-term maintainability.

---

10. Summary Checklist

✅ Define your VLAN and subnet scheme
✅ Assign appropriate IP ranges using 172 or 10 ranges
✅ Configure switches, trunk ports, and router interfaces
✅ Test inter-VLAN routing and security policies
✅ Document everything

---

Need help designing your enterprise VLAN and subnet plan? Reach out to your network team or consult a certified network engineer. With good planning and structured deployment, your network will be ready for anything.