A Repeatable Addressing Template for Branch Offices, from 5 Sites to 500: One Block per Site, One Layout Everywhere
At a growing chain of animal clinics, clinic number twelve opens on Monday, and on the Thursday before, someone finally sits down to give it addresses. They open the spreadsheet, scroll to the bottom, take the next free blocks in whatever order they appear, pick VLAN (virtual local area network) numbers that seem sensible, and write the firewall rules from scratch, because the other eleven clinics each do things a little differently and none of them is quite the right model. Clinic twelve opens on time. It also becomes the twelfth design on the network, with its printers at .200 where clinic four keeps them at .50, its guest Wi-Fi on VLAN 30 where everyone else uses 40, and a card payment terminal sharing a network with the waiting-room television. Every site built this way adds one more layout for the support team to learn and one more place for a mistake to hide. The alternative is to decide once, on paper, what a site looks like, then give every site a block of addresses of the same size, divided the same way, so that opening site twelve, or site four hundred and twelve, comes down to picking the next number.
A few terms make the rest of this easier. An IP (Internet Protocol) address is the number a device uses to send and receive traffic, written as four numbers separated by dots, which engineers call octets. A subnet is a block of neighboring addresses that share one network, written in slash notation: a /24 holds 256 addresses, a /23 twice that, a /22 twice again, and each step down in the number doubles the block, as our visual guide to CIDR (Classless Inter-Domain Routing) notation shows. A VLAN splits one set of switches into several separate networks, so that phones, computers, and guests share the same cables without sharing traffic, and each VLAN gets a subnet of its own; our guide to VLANs and VRFs (virtual routing and forwarding, which separates whole routing tables the way VLANs separate networks) covers the machinery. Nearly every business draws its internal addresses from 10.0.0.0/8, a private range of about 16.8 million addresses that our tour of the reserved IP ranges describes, and the question here is how to divide that range so that every site looks the same.
The example throughout is Copperleaf Veterinary, a fictional chain of animal clinics that wants to avoid the clinic-twelve problem before it starts. Copperleaf runs five clinics today and plans to reach five hundred within a decade, mostly by buying independent practices, the way many veterinary chains have grown. Every clinic needs the same handful of networks: computers at the front desk and in the exam rooms, desk phones, printers, an X-ray machine and lab analyzers, security cameras, card payment terminals, Wi-Fi for staff, and guest Wi-Fi for the waiting room. The smallest clinic has two veterinarians and a dozen staff. The largest is a twenty-four-hour emergency hospital with about eighty people across three shifts. A template has to fit all of them, which raises the first decision: how big each site's block should be.
Our worked example of designing an IP plan from scratch answered that question for a fictional company called Meridian Logistics by giving each office a /16, 65,536 addresses, and matching the third octet of every subnet to its VLAN, so that 10.2.30.42 reads as the Atlanta office, corporate Wi-Fi, without a lookup. For a company with a handful of offices, nothing reads better. The catch is arithmetic. The whole of 10.0.0.0/8 holds only 256 blocks of that size, and Meridian's plan set aside sixteen of them for offices, so five hundred sites at a /16 each would need nearly twice the entire 10.0.0.0/8 range. Copperleaf has to give each site a smaller block, which makes the template's job twofold: fit everything a site needs into the smallest block that still has room to grow, and keep the layout inside that block identical everywhere.
Size the block for the largest ordinary site, and size it once. Copperleaf's emergency hospital needs room for about sixty wired computers, forty phones, a dozen printers, a rack of clinical equipment, twenty cameras, card terminals at every desk, a couple of hundred staff devices on Wi-Fi across the shifts, and a waiting room that fills with pet owners on their phones. Giving each of those its own subnet with room to grow adds up to sixteen /24s, which is a /20, or 4,096 addresses. A two-vet clinic will use a sliver of that, and the waste costs nothing, because private addresses are free and five hundred /20s come to about two million addresses, roughly 12 percent of 10.0.0.0/8. The tempting alternative is tiers, a small block for small clinics and a bigger one for hospitals, and tiers break the property that makes a template worth having. Two block sizes mean two layouts and two formulas, and a clinic that outgrows its tier has to be renumbered. Keep one size for every ordinary site, and give the true outliers, the headquarters and the data centers, their own designs in a separate part of the address space. A business with thousands of very small sites, such as a retail chain with a register and a back-office computer in each store, can run the same playbook with a smaller block, a /22 or /23 per store with smaller subnets inside, and the principle holds unchanged.
Before handing out site blocks, set aside one large region of the address space for branches alone, sized for far more sites than the business expects to have. Copperleaf splits 10.0.0.0/8 into four equal quarters, each a /10 of about four million addresses, and gives one quarter to the clinics. A /10 holds exactly 1,024 blocks of /20, room for twice the five-hundred-clinic goal, and the other quarters keep headquarters, data centers, and network infrastructure apart from the cloud and from a reserve nobody touches. Dividing the top level by purpose rather than by place is the same choice Meridian made, for the same reason: sites open and close, while the categories hold still.
Copperleaf's top-level carve: four quarters of 10.0.0.0/8
10.0.0.0/8 Copperleaf, all internal addresses
├── 10.0.0.0/10 core: headquarters, data centers, network infrastructure
├── 10.64.0.0/10 clinics: 1,024 blocks of /20, one per site
├── 10.128.0.0/10 cloud
└── 10.192.0.0/10 reserved for whatever the next decade bringsInside each /20 the layout is fixed. Every purpose sits at an offset, a count of how many /24s past the start of the site's block it begins, and the offsets never change from one clinic to the next. Here is the whole template.
The clinic template: one /20, sixteen slots, the same at every site
offset size VLAN purpose usable
+0 /24 100 network equipment: firewall, switches, access points 254
+1 /24 101 local servers: imaging archive, file share 254
+2 /24 102 printers and label printers 254
+3 /24 103 desk phones 254
+4 /23 104 wired computers: front desk, exam rooms, offices 510
+6 /24 106 clinical equipment: X-ray, lab analyzers 254
+7 /24 107 cameras, door controllers, thermostats 254
+8 /22 108 staff Wi-Fi 1,022
+12 /23 112 guest Wi-Fi for the waiting room 510
+14 /24 114 card payment terminals 254
+15 /24 115 spare: the next new kind of device goes here 254Network equipment comes first, at offset 0: the firewall, the switches, and the APs (access points, the boxes that broadcast Wi-Fi). Local servers, printers, and phones each take a /24. Wired computers get a /23, 510 usable addresses, because that is the population most likely to grow. Clinical equipment and the cameras, door controllers, and thermostats each get a subnet of their own, since those devices run software their makers rarely update, and our guide to segmenting IoT (Internet of Things) devices explains why they belong behind their own firewall rules. Staff Wi-Fi takes a /22 and guest Wi-Fi a /23, the sizes our guide to sizing Wi-Fi and guest subnets recommends for a busy branch, because wireless devices outnumber the people carrying them. Card payment terminals sit alone in their own /24 so that PCI DSS (Payment Card Industry Data Security Standard), the security rulebook every business that takes cards must follow, applies to the smallest possible slice of each clinic. The last /24 stays empty on purpose, so that the next new kind of device has a home at every site on the same day. Each larger subnet also starts on an offset its size divides evenly, the /23s at 4 and 12 and the /22 at 8, and that alignment is what lets every block be written as a single prefix, a property our guide to supernetting and route summarization shows paying off for years.
A two-vet clinic with a /22 for staff Wi-Fi looks wasteful by the standards of our guide to right-sizing subnets, which warns against flat networks of a thousand devices. That warning concerns how many devices share a subnet, and the template's sizes are ceilings, so a /22 holding forty phones behaves like a network of forty phones. The same discipline continues inside each subnet. Every /24 follows the layout from our guide to DHCP (Dynamic Host Configuration Protocol), static addresses, and reservations: the gateway at .1, network equipment from .2 to .19, servers and other hand-configured devices from .20 to .59, reservations from .60 to .99, and the DHCP pool, the range the network hands out automatically, from .100 to .239. VLAN numbers follow the offsets, 100 plus the offset, so VLAN 108 is staff Wi-Fi in every clinic, and a technician who moves from clinic 9 to clinic 140 already knows where everything lives. Hostnames carry the site number in the pattern our guide to naming conventions recommends, site first, then role, then a number, so c037-fw1 is the first firewall at clinic 37 and sorts right next to c037-sw1, its first switch.
Every site gets a permanent number, assigned when it joins and never reused, and that number alone decides its block. Each step in the second octet covers sixteen /20 blocks, so the second octet is 64 plus the site number divided by sixteen, ignoring any remainder, and the third octet is the remainder times sixteen. Clinic 37 divides into two sixteens with five left over, which puts its block at 10.66.80.0/20. Block 0, the very first, goes to a test bench at headquarters where new equipment is set up with real addresses before it ships, which catches configuration mistakes before they reach a clinic.
From site number to block
site block addresses
0 10.64.0.0/20 test bench at headquarters
1 10.64.16.0/20 10.64.16.0 to 10.64.31.255
2 10.64.32.0/20 10.64.32.0 to 10.64.47.255
5 10.64.80.0/20 10.64.80.0 to 10.64.95.255 Copperleaf today
16 10.65.0.0/20 10.65.0.0 to 10.65.15.255
37 10.66.80.0/20 10.66.80.0 to 10.66.95.255
50 10.67.32.0/20 10.67.32.0 to 10.67.47.255
500 10.95.64.0/20 10.95.64.0 to 10.95.79.255 the ten-year goal
1,023 10.127.240.0/20 10.127.240.0 to 10.127.255.255 the last block in the rangeApplied to two clinics, the template produces two columns that differ only in where they start. Every row in the clinic 37 column is the clinic 1 row shifted by the same amount, which is what lets one set of configuration files and firewall rules serve both.
The same template at clinic 1 and clinic 37
offset purpose clinic 1 (10.64.16.0/20) clinic 37 (10.66.80.0/20)
+0 network equipment 10.64.16.0/24 10.66.80.0/24
+1 local servers 10.64.17.0/24 10.66.81.0/24
+2 printers 10.64.18.0/24 10.66.82.0/24
+3 desk phones 10.64.19.0/24 10.66.83.0/24
+4 wired computers 10.64.20.0/23 10.66.84.0/23
+6 clinical equipment 10.64.22.0/24 10.66.86.0/24
+7 cameras, building 10.64.23.0/24 10.66.87.0/24
+8 staff Wi-Fi 10.64.24.0/22 10.66.88.0/22
+12 guest Wi-Fi 10.64.28.0/23 10.66.92.0/23
+14 card terminals 10.64.30.0/24 10.66.94.0/24
+15 spare 10.64.31.0/24 10.66.95.0/24Reading an address back to its clinic takes a moment of arithmetic, which is the price of fitting five hundred sites into a quarter of the range. Take 10.66.89.140. Subtract 64 from the second octet to get 2, and multiply by sixteen to get 32. Divide the third octet, 89, by sixteen: it goes in five times with 9 left over. The site is 32 plus 5, clinic 37, and the leftover 9 falls inside the staff Wi-Fi /22, which spans offsets 8 through 11. Nobody does this more than a few times. Staff learn the blocks of the clinics they support, the IPAM (IP Address Management) system answers the rest from a search box, and the places where the layout matters most, the switch configurations and firewall rules, are generated from the site number and never need decoding at all.
The template pays off differently as the count grows. At five sites it costs an afternoon and looks like overkill, and its first dividend is that anyone who learns one clinic knows all five. By fifty, the firewall rules are where it earns its keep. "Guest Wi-Fi may reach the internet and nothing else" and "card terminals may reach the payment processor and nothing else" are written once, in terms of offsets, and stamped out for each clinic with only the block changing, so the fiftieth clinic's rules are as well tested as the first one's. Routing shrinks the same way, because each clinic announces a single /20, and from the data center or the cloud the entire clinic range collapses into one route, 10.64.0.0/10. That matters more than it sounds. AWS (Amazon Web Services) accepts at most a hundred routes over a site-to-site VPN (virtual private network) connection, a limit our supernetting guide describes, and five hundred clinics as one line fit easily where five hundred clinics as five thousand subnets never could. By five hundred, the template is what makes growth possible at all, since opening a clinic comes down to assigning the next number and letting scripts produce the subnets, the switch and firewall configurations, the DNS (Domain Name System) names, and the address records from it.
A few addresses belong to each clinic without living in its block. The router at each site needs a loopback address, a permanent address on the router itself that management tools and routing software use as its name, and a VPN tunnel back to the data center needs a tiny subnet of its own. Keep those in the infrastructure part of the core range, numbered by the same site number, so that inside a /22 set aside for loopbacks, clinic 37's is 10.1.0.37 and clinic 500's is 10.1.1.244. Our guides to point-to-point links and to VPN and overlay network addressing cover how big those little subnets should be. If Copperleaf later builds a separate management network for emergencies, the kind our guide to out-of-band management describes, its per-site blocks follow the site number too. Should regional hubs ever want summaries of their own, give each region a run of site numbers that starts on a multiple of 256: sites 0 through 255 fill 10.64.0.0/12 exactly, so a region that owns those numbers is a single route at its hub.
Templates meet exceptions, and the rule for handling them is to keep each exception outside the template. A clinic that truly outgrows its /20, which at these sizes would take a small hospital, gets a second block from an overflow area reserved at the top of the clinic range and becomes two routes, a known and documented exception, while the layout inside its original block stays as it was. An acquired practice usually arrives running 192.168.1.0/24, the default on nearly every small-office router, and joins the chain by taking the next site number and moving into its block, a project our guides to merging networks after an acquisition and to renumbering without downtime walk through. A closed clinic retires its number and leaves its block empty for a year or so before anyone reuses it, because firewall rules, monitoring entries, and DNS records that mention the old block take time to die out. Never renumber surviving sites to close the gaps, since an empty block costs nothing and a renumbering costs weeks. When the template itself has to change, give it a version number, put the new purpose in the spare /24, and roll it out to every clinic at once, which is the reason the spare exists.
On IPv6 (Internet Protocol version 6, the newer addressing system with vastly more room), the same template gets easier and more readable, because space stops being scarce. Each site receives a /48 or a /56, each purpose inside it a /64, and there is room to write the site number and the VLAN number straight into the address as digits. With a /36 allocation, Copperleaf could give clinic 37 the block 2001:db8:a037::/48 and its staff Wi-Fi 2001:db8:a037:108::/64, so the site and the VLAN appear in the address the same way they appear in the hostname, and using only the digits 0 through 9 in the site slot still leaves room for a thousand clinics. (The 2001:db8 prefix is reserved for examples like this one.) Our guide to IPv6 address planning explains the generous, widely spaced layouts that make this possible.
A template only holds if every new site is built from it, and that is easiest when the template lives in the same place as the addresses. In IPCraft, the clinic range is a container subnet, a block that exists to hold other blocks and stays out of the usage statistics, and each clinic's /20 sits inside it as a container of its own, tagged with a location named for the clinic, with its eleven subnets beneath it carrying their VLAN numbers. When the next clinic comes along, the add-child-subnet dialog on the clinic range lists the next free /20, and the CSV (comma-separated values) import builds the rest. Keep the twelve rows for one clinic as a spreadsheet, change the addresses and the location name, and import it, and IPCraft files each subnet under its parent automatically and creates the VLANs and the location by name if they don't exist yet; our guide to CSV import and export lists the columns. Larger rollouts can do the same through the API (application programming interface), which our post on automating IP allocation shows with scripts. After that, searching for 10.66.89.140 shows the clinic 37 staff Wi-Fi subnet in one step, and our concepts guide covers containers, locations, and VLANs in more detail.
Back at Copperleaf, clinic 412 opens on a Monday a few years from now. On the Thursday before, someone types 412 into a script. The block, 10.89.192.0/20, comes from the formula, the eleven subnets and their VLANs come from the template, the firewall rules come from the same file that built the other four hundred and eleven, and the records land in the IPAM before the switch is out of its box. Clinic 412 looks exactly like clinic 1, down to the printers waiting at .60, and the person who set it up spent the afternoon on something other than inventing a network.