Skip to main content
Back to path

Welcome to a Grasp lesson

Create a free account to keep studying and create your own study path.

Lesson 21

IPAM Plan Verification

Recommended resources

Introduction

Welcome back. In our previous lessons, we've done the heavy lifting of designing a VLSM address plan and mapping it to a VLAN strategy, culminating in a comprehensive IPAM document. We even assigned a default gateway IP for each subnet, which will later be configured on a Switched Virtual Interface (SVI).

Before you ever type configure terminal on a production switch, there's one final, critical quality assurance step: auditing the plan itself. This lesson is dedicated to that process. Our learning outcome is to verify the IPAM plan for completeness and the absence of overlapping allocations.

Think of this as the final proofreading stage. A simple typo or a miscalculation in the IPAM spreadsheet can lead to routing black holes, IP address conflicts, and hours of frustrating troubleshooting on the live network. Mastering this verification step is a key discipline of a senior network professional.

We will cover:

  1. The Completeness Check: A quick audit to ensure all necessary data is present and correct.
  2. The Overlap Check: A methodical process to hunt down and eliminate any overlapping subnet allocations, which are fatal to a network design.

Part 1: The Completeness Check

First, let's ensure our documentation is complete. An incomplete IPAM is a primary source of configuration errors. Using the IPAM structure we've developed, you should be able to answer "yes" to all questions in the following checklist for every entry.

IPAM Completeness Checklist:

  • VLAN Info: Does every VLAN have a unique ID and a descriptive name?
  • Subnet Mapping: Is every VLAN mapped to exactly one IP subnet?
  • Subnet Definition: Does each subnet entry clearly state the Network Address and CIDR Prefix (e.g., 10.50.4.0/25)?
  • Address Details: Is the full range defined with the Network Address, Usable Host Range, and Broadcast Address?
  • Gateway: Is a Default Gateway IP assigned? Does it fall within the usable host range and follow the network-wide convention (e.g., always the first usable IP)?
  • Requirements: Does the allocated subnet size (/25 for 126 hosts) comfortably meet the host requirement, with room for reasonable future growth?

An IPAM document, whether in a spreadsheet or a dedicated tool, should look clean and complete, like this example schedule.

IP Schedule Table
This IP schedule is an example of organized IPAM documentation. For each device interface, it clearly lists the IP address, subnet mask, and default gateway, ensuring all necessary information for configuration is present.

Part 2: Verifying Non-Overlapping Allocations

This is the most critical verification task, especially when using VLSM. Overlapping subnets occur when the address range of one subnet shares one or more addresses with the range of another. This is a catastrophic error that makes it impossible for routers to forward traffic reliably.

For example, the subnet 10.10.0.0/23 (range 10.10.0.0 to 10.10.1.255) and the subnet 10.10.1.0/24 (range 10.10.1.0 to 10.10.1.255) overlap. A router wouldn't know which path to use for a packet destined for 10.10.1.50.

To find these overlaps manually, you need a methodical process.

Variable-Length Subnet Masks

The following document from the Cisco Community provides an excellent, detailed process for finding VLSM overlaps. It's the definitive manual method that every network engineer should know.

Please read the section titled 'Finding VLSM Overlaps' (starts around page 532). Pay close attention to the three-step process it outlines: 1. Calculate the range for each subnet. 2. List the subnets in numerical order. 3. Scan the list for overlaps. This is the exact method we will use in our exercise.

The 3-Step Verification Process

As you just read, the process is straightforward but requires careful attention to detail:

  1. Calculate the Range: For every subnet in your IPAM plan, confirm its Network Address and Broadcast Address.
  2. Sort the Subnets: Create a simple list of your subnets, ordered numerically by their Network Address.
  3. Compare Adjacent Entries: Go down the sorted list. For each subnet, check that its Broadcast Address is less than the Network Address of the very next subnet in the list.
    • If Broadcast_Address_N < Network_Address_N+1 for all N, your plan is clean.
    • If you find any instance where Broadcast_Address_N >= Network_Address_N+1, you have an overlap.

Let's see this in action.

22. CCNA Ch11 - Solve a VLSM subnetting scheme

This video provides a great visual walkthrough of creating a VLSM scheme. The final part of the video is especially relevant, as the presenter explicitly confirms that the allocated subnets do not overlap.

Watch from 09:19 to 11:34. The presenter lists out the subnets he created, showing their start and end addresses to prove there are no gaps or overlaps. This is a perfect, concise demonstration of the verification principle.

Exercise: Audit the AlphaCorp IPAM

You've been handed the "final" IPAM plan for the AlphaCorp network. Your task is to perform a full audit before it goes to the implementation team.

Instructions:

  1. First, perform the Completeness Check using the checklist from Part 1.
  2. Next, apply the 3-Step Verification Process to check for overlapping allocations.
  3. If you find an overlap, identify the two VLANs/subnets that are in conflict.
  4. Propose a correction to the IPAM that resolves the conflict while still meeting all host requirements.

AlphaCorp Final IPAM Draft:

VLAN ID VLAN Name Req. Hosts Subnet (CIDR) Network Addr Gateway IP Usable Range Broadcast Addr
10 HQ_CORP_USERS 450 10.50.0.0/23 10.50.0.0 10.50.0.1 10.50.0.1 - 10.50.1.254 10.50.1.255
20 SALES 200 10.50.2.0/24 10.50.2.0 10.50.2.1 10.50.2.1 - 10.50.2.254 10.50.2.255
30 SERVERS 50 10.50.3.0/26 10.50.3.0 10.50.3.1 10.50.3.1 - 10.50.3.62 10.50.3.63
40 VOICE 100 10.50.4.0/25 10.50.4.0 10.50.4.1 10.50.4.1 - 10.50.4.126 10.50.4.127
99 MGMT 25 10.50.4.96/27 10.50.4.96 10.50.4.97 10.50.4.97 - 10.50.4.126 10.50.4.127
70 WIFI_GUEST 250 10.50.5.0/24 10.50.5.0 10.50.5.1 10.50.5.1 - 10.50.5.254 10.50.5.255
Solution

  1. Completeness Check: The plan is complete. All columns are filled, VLAN IDs are unique, and subnet sizes meet the requirements.

  2. Overlap Check (3-Step Process):

    • Step 1 & 2 (Calculate & Sort): The table is already sorted by Network Address. The ranges are provided.
    • Step 3 (Compare):
      • HQ_CORP (10.50.1.255) is less than SALES (10.50.2.0). OK.
      • SALES (10.50.2.255) is less than SERVERS (10.50.3.0). OK.
      • SERVERS (10.50.3.63) is less than VOICE (10.50.4.0). OK.
      • VOICE (10.50.4.127) is NOT less than MGMT (10.50.4.96). OVERLAP DETECTED.
      • The MGMT subnet (10.50.4.96/27, range ...96 to ...127) is fully contained within the VOICE subnet (10.50.4.0/25, range ...0 to ...127).

  3. Conflicting Subnets: VLAN 40 (VOICE) and VLAN 99 (MGMT).

  4. Proposed Fix: The MGMT subnet must be moved. The VOICE subnet ends at 10.50.4.127. The next available address is 10.50.4.128. We can place the MGMT subnet there.

    • New MGMT Subnet: 10.50.4.128/27.
    • New Range: Network 10.50.4.128, Gateway 10.50.4.129, Broadcast 10.50.4.159.
    • This new range does not conflict with the next subnet (10.50.5.0/24).

Using Tools to Accelerate Verification

While knowing the manual method is crucial for understanding and passing certification exams, in your day-to-day work, you'll leverage tools. Professional IPAM software like Netbox or Infoblox prevents these overlaps by design. They won't let you allocate a prefix that conflicts with an existing one.

Even without a full IPAM system, you can use online calculators to speed up your checks.

Subnet Calculator (IPv4) - CIDR, Split & Next Available

This online subnet calculator has a very useful feature for verifying your work. You can paste in a list of subnets you've already allocated and have it find the next available space, automatically checking for overlaps.

Scroll down to section '3) Find next available subnet'. Note the description: '"Available" means: inside your parent prefix...and not overlapping any used subnet you paste.' This is exactly the check we just did manually. You can copy/paste your list of used subnets from a spreadsheet directly into the 'Used subnets' box to validate your plan.

This kind of tool is perfect for double-checking your manual VLSM plan or for quickly finding a valid space for a new subnet without having to perform the 3-step process by hand every time.

Conclusion

You've now learned the critical quality assurance process for any IP addressing plan. This final audit separates a draft from a deployment-ready design.

Key Takeaways:

  • Verification is non-negotiable: Always audit your IPAM for completeness and overlaps before implementation.
  • Completeness: Ensure every VLAN and subnet has all necessary details documented correctly, especially the gateway IP.
  • Overlap Detection: The 3-step process (Calculate Range, Sort, Compare) is the definitive manual method for finding allocation errors in a VLSM plan.
  • The Rule: A plan is valid only if the broadcast address of every subnet is less than the network address of the next subnet in a sorted list.
  • Leverage Tools: In practice, use IPAM software or online calculators to automate overlap detection and accelerate your workflow.

Next Steps

Our IPAM plan is now designed, documented, and verified. It is rock solid. In our next lesson, we will do a deeper dive into the mechanics of inter-VLAN routing. We've talked about SVIs as gateways, but we will now trace the complete packet flow from a host in one VLAN to a host in another, examining how the Layer 3 switch uses its routing table to make it all happen. This will bring your addressing plan to life.