Unit 2: Addresses and subnets · Lesson 5 of 7 · 20 min
Planning a cloud network
Carve a cloud network into public, app and data subnets and check the plan before anyone builds it.
mission
- You are
- The analyst reviewing a new cloud project.
- Situation
- A team is about to create a cloud network (a VPC) of 10.30.0.0/22 with a public subnet for 200 load balancer addresses, an app subnet for 200 servers and a data subnet for 60 databases.
- Goal
- Produce a subnet plan that fits, leaves room to grow and keeps the data tier away from the internet.
- Hand in
- The data subnet's range and what is left unused.
A cloud network as a floor plan
Size the whole network
Start with the envelope: how many addresses the project has in total.
ipcalc -nb 10.30.0.0/22 | grep -E 'Network|HostMin|HostMax|Hosts'
Network: 10.30.0.0/22
HostMin: 10.30.0.1
HostMax: 10.30.3.254
Hosts/Net: 1022 Class A, Private Internet
you should see 1,024 addresses from 10.30.0.0 to 10.30.3.255.
Split it
Give ipcalc the three sizes and let it place them.
ipcalc -nb -s 200 200 60 10.30.0.0/22 | grep -E 'Requested|^Network|Unused' -A1 | grep -vE '^--|HostMin|Netmask'
Network: 10.30.0.0/22
1. Requested size: 200 hosts
Network: 10.30.0.0/24
2. Requested size: 200 hosts
Network: 10.30.1.0/24
3. Requested size: 60 hosts
Network: 10.30.2.0/26
Unused:
10.30.2.64/26
you should see Public 10.30.0.0/24, app 10.30.1.0/24, data 10.30.2.0/26, and the rest unused.
defender tip Cloud providers reserve a few addresses in every subnet (AWS keeps 5), so a /26 gives 59 usable hosts there, not 62. Check the provider's rule before you size tightly.
List all the free space
The free space is more than one block. Write all of it into the plan so the next team takes from it in order.
ipcalc -nb -s 200 200 60 10.30.0.0/22 | sed -n '/Unused/,$p'
Unused:
10.30.2.64/26
10.30.2.128/25
10.30.3.0/24
you should see 448 addresses left for growth.
Route tables decide exposure
data subnet route table 0.0.0.0/0 -> internet gateway
Any database with a public IP is reachable from anywhere.
data subnet route table 10.30.0.0/22 -> local no default route
The data tier can only talk inside the VPC.
Check for overlaps
Overlapping ranges break routing the day two networks are connected by VPN or peering.
python3 -c "import ipaddress as i; a = i.ip_network('10.30.0.0/22'); print(a.overlaps(i.ip_network('10.30.2.0/24')), a.overlaps(i.ip_network('10.31.0.0/22')))"
True False
you should see 10.30.2.0/24 overlaps the plan. 10.31.0.0/22 is safe to use for a second network.
defender tip Keep one shared register of every range in use, on premises and in every cloud account.
What a defender takes away
- 1Plan a cloud network before anyone builds it. Renumbering later is painful.
- 2Public, app and data tiers get separate subnets with separate routes.
- 3Write the unused ranges into the plan too.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.