How to Subnet with VLSM (Step by Step, No Calculator)
VLSM — Variable-Length Subnet Masking — is the exam skill that separates people who memorized a subnet chart from people who actually understand addressing. On the CCNA and CCNP you get no calculator, so you need a method that runs on arithmetic you can do in your head: one host formula, a short table of block sizes, and a single discipline — carve the biggest subnet out of the block first and work down. Do that and every network number lands on a legal boundary automatically, with no overlaps and no wasted blocks. This guide gives you the formulas, the reasoning behind the largest-first rule, and a full worked split of 192.168.1.0/24 into a 60-host LAN, a 28-host LAN, a 12-host LAN, and two point-to-point links — with every network, broadcast, and usable range computed by hand, then applied on real Cisco IOS.
Part of the Subnetting & IP Addressing learning hub
Step 1 — Memorize the two formulas, CIDR notation, and the powers of two
There are only two pieces of arithmetic in all of subnetting. The host formula: usable hosts = 2^h − 2, where h is the number of host bits and h = 32 − prefix length. You subtract 2 because in every subnet the all-zeros host address is the network number and the all-ones host address is the broadcast — neither can be assigned to an interface. The block size formula: block size = 2^h, which is also 256 − (the mask value in the interesting octet). The block size is simply how far apart consecutive networks of that prefix sit.
CIDR /n notation just counts the network bits: /26 means 26 leading 1-bits in the mask. Written out, 26 ones is 11111111.11111111.11111111.11000000 = 255.255.255.192. Everything to the right of the /n is host space. That is the whole trade-off in one line: every bit you move from host space into network space doubles the number of subnets and halves the hosts per subnet. The address block is fixed — you are only deciding how to slice it.
You cannot do this on the exam without the powers of two in your head: 1, 2, 4, 8, 16, 32, 64, 128, 256 — and their minus-two values for usable hosts: −, 0, 2, 6, 14, 30, 62, 126, 254. Pair those with the mask octet (256 − block size) and you can reconstruct the table below from memory in seconds. Note the two exceptions to the −2 rule at the bottom: a /31 (RFC 3021) and a /32.
Prefix Block Subnet mask Usable hosts (2^h - 2)
/24 256 255.255.255.0 254
/25 128 255.255.255.128 126
/26 64 255.255.255.192 62
/27 32 255.255.255.224 30
/28 16 255.255.255.240 14
/29 8 255.255.255.248 6
/30 4 255.255.255.252 2
/31 2 255.255.255.254 2 (RFC 3021, point-to-point; no -2)
/32 1 255.255.255.255 1 (host route / loopback)Step 2 — Turn each host requirement into a prefix length
Size every subnet to its requirement before you place anything. For each LAN or link, find the smallest prefix whose usable count is greater than or equal to the hosts needed. Work it from host bits: increase h until 2^h − 2 ≥ requirement, then the prefix is 32 − h.
For our example: 60 hosts — 2^5 − 2 = 30 is too small, 2^6 − 2 = 62 fits, so 6 host bits gives /26. 28 hosts — 2^5 − 2 = 30 ≥ 28, so 5 host bits gives /27. 12 hosts — 2^4 − 2 = 14 ≥ 12, so 4 host bits gives /28. Each point-to-point link needs exactly 2 usable addresses — 2^2 − 2 = 2 gives /30 (or a /31, covered in Step 5).
A word on judgment: the exam usually wants the tightest fit that satisfies the number given, so pick the smallest prefix that works. In production you would add headroom for growth — but never oversize blindly, because on the exam a subnet that is one prefix too large is scored wrong just like one that is too small. Watch the boundary cases: exactly 30 hosts fits a /27, but 31 hosts does not — you would step up to a /26.
Step 3 — Sort the subnets largest to smallest, and understand why
The one rule of VLSM: allocate the largest subnet first, then the next largest, all the way down to the smallest. Our order is /26 (60-host LAN), /27 (28-host LAN), /28 (12-host LAN), /30 link A, /30 link B.
Here is why this is not just a convention. A subnet of prefix /n must begin on an address that is a multiple of its block size — its natural boundary. Larger subnets have larger block sizes and therefore stricter alignment: a /26 must start on a multiple of 64 (.0, .64, .128, .192), while a /30 only needs a multiple of 4. When you place the most-constrained (largest) blocks first, starting at the base of the parent block, the 'next free' address after each one is always a legal boundary for every smaller block that follows, because a smaller block size always divides evenly into where a larger one ended.
Reverse the order and it breaks. Put a /30 at 192.168.1.0 first, and the /26 can no longer use .0 — a /26 must start at .0, .64, .128, or .192, and .0 is now partly consumed. So the /26 jumps to .64, stranding .4 through .63: 60 addresses fragmented and wasted. Fudge it to avoid the waste and you create an overlap. Largest-first makes both problems impossible.
Step 4 — Walk the block, compute each range, advance the pointer
Set a pointer at the base of the parent block, 192.168.1.0, and process the subnets in largest-first order. For each one, do four things: (1) the network number is wherever the pointer currently sits; (2) the broadcast is network + block size − 1; (3) the first usable is network + 1 and the last usable is broadcast − 1; (4) advance the pointer to broadcast + 1 for the next subnet. All the arithmetic happens in the fourth (interesting) octet.
Walking it: the /26 has block 64 — network .0, broadcast .0 + 64 − 1 = .63, usable .1–.62, pointer moves to .64. The /27 has block 32 — network .64, broadcast .64 + 32 − 1 = .95, usable .65–.94, pointer moves to .96. The /28 has block 16 — network .96, broadcast .96 + 16 − 1 = .111, usable .97–.110, pointer moves to .112. The first /30 has block 4 — network .112, broadcast .115, usable .113–.114, pointer moves to .116. The second /30 — network .116, broadcast .119, usable .117–.118, pointer moves to .120.
Everything at .120 and above stays free for future subnets. Notice how each network number is a clean multiple of its own block size — that is the largest-first rule paying off automatically. The full allocation:
Order Purpose Need Prefix Mask Network Usable range Broadcast Next free
1 60-host LAN 60 /26 255.255.255.192 192.168.1.0 192.168.1.1 - .62 192.168.1.63 192.168.1.64
2 28-host LAN 28 /27 255.255.255.224 192.168.1.64 192.168.1.65 - .94 192.168.1.95 192.168.1.96
3 12-host LAN 12 /28 255.255.255.240 192.168.1.96 192.168.1.97 - .110 192.168.1.111 192.168.1.112
4 P2P link A 2 /30 255.255.255.252 192.168.1.112 192.168.1.113 - .114 192.168.1.115 192.168.1.116
5 P2P link B 2 /30 255.255.255.252 192.168.1.116 192.168.1.117 - .118 192.168.1.119 192.168.1.120
Free for growth: 192.168.1.120 - 192.168.1.255Step 5 — Point-to-point links: /30 or /31 (RFC 3021)
A router-to-router link only ever needs two usable addresses — one per end — so it is the place VLSM saves the most. You have two clean choices.
The /30 is the classic, universally supported answer. Block size 4, two usable addresses, with the network and broadcast burned as overhead. It is the exam-safe default: use it unless the question explicitly permits otherwise.
The /31 is the efficient answer. Under RFC 3021, a point-to-point link has no meaningful broadcast, so both addresses in a /31 are usable — the −2 does not apply. That halves the per-link cost from four addresses to two. Cisco IOS supports /31 on point-to-point interfaces, and you configure it exactly like any other address, just with mask 255.255.255.254. If we convert both links to /31 starting at .112, we free the .116–.119 range that the /30 plan consumed. Only reach for /31 when the scenario allows it — some exam blueprints and legacy gear still expect /30 for point-to-point links.
Link Prefix Mask Network Usable Broadcast
A /31 255.255.255.254 192.168.1.112 .112 and .113 none
B /31 255.255.255.254 192.168.1.114 .114 and .115 none
Both /31 links together use only .112 - .115, freeing .116 - .119 vs the /30 plan.Step 6 — Apply it in IOS and verify
Your subnetting is only right if the router accepts it and the connected routes look correct. Convention is to assign each subnet's first usable address as the gateway. Modern IOS treats the zero subnet (here 192.168.1.0/26) as fully usable — `ip subnet-zero` has been the default since IOS 12.0 — so the first block is fine to use without any special command.
Configure the gateways, then verify. `show ip interface brief` confirms each interface took the address and is up; `show ip route connected` confirms each prefix installs as a connected route with the exact mask you intended and no overlap. The commented lines show the /31 variant for the same link — identical syntax, different mask.
R1# configure terminal
R1(config)# interface GigabitEthernet0/0
R1(config-if)# description 60-host LAN (gateway = first usable)
R1(config-if)# ip address 192.168.1.1 255.255.255.192
R1(config-if)# no shutdown
R1(config-if)# exit
R1(config)# interface GigabitEthernet0/1
R1(config-if)# description 28-host LAN
R1(config-if)# ip address 192.168.1.65 255.255.255.224
R1(config-if)# no shutdown
R1(config-if)# exit
R1(config)# interface GigabitEthernet0/2
R1(config-if)# description P2P link A to R2 (/30)
R1(config-if)# ip address 192.168.1.113 255.255.255.252
R1(config-if)# no shutdown
R1(config-if)# end
! Same link as a /31 (RFC 3021) instead of a /30:
R1(config)# interface GigabitEthernet0/2
R1(config-if)# ip address 192.168.1.112 255.255.255.254
R1(config-if)# end
R1# show ip interface brief
R1# show ip route connectedCommon problems (and the fix)
Overlapping subnets from not going largest-first (or from not advancing the pointer). The cause is either allocating small blocks before large ones, or reusing an address that the previous subnet already consumed. Fix: sort requirements from largest to smallest, and mechanically set every new network number to previous broadcast + 1. If two subnets ever share even one address, you have overlapped.
Forgetting the −2 for network and broadcast. Writing 'a /27 holds 32 hosts' is the classic slip — it holds 30, because 2 of the 32 addresses are the network and broadcast. Fix: usable hosts = 2^h − 2 for every prefix from /24 through /30. The only exceptions are the /31 (RFC 3021 gives 2 usable, no subtraction) and the /32 (a single host route).
Off-by-one on the block size or broadcast. The broadcast is network + block size − 1, not network + block size — miss the − 1 and you overrun into the next subnet. Fix: block size = 256 − mask octet, and always subtract one for the broadcast. For a /26 (block 64) starting at .64, the broadcast is .127, not .128.
Undersizing at a boundary. Choosing a prefix whose usable count exactly equals the requirement leaves zero room, and choosing one because 2^h (before the −2) looks big enough leaves you two short. Fix: always compare the requirement against 2^h − 2, and step up one prefix if you are at the exact boundary and expect any growth. 31 hosts does not fit a /27 — it needs a /26.
Network numbers that are not on a boundary. Writing something like 192.168.1.100/26 is invalid — a /26 network must land on a multiple of 64. Fix: round the interesting octet down to the nearest multiple of the block size. A /26 network ends in .0, .64, .128, or .192; a /28 ends in a multiple of 16. If your network number is not a multiple of its block size, it is not a legal subnet.
Frequently asked questions
Why do I subtract 2 for usable hosts, and why is a /31 the exception?
Every subnet reserves two addresses that can never sit on a host: the all-zeros network number and the all-ones broadcast, so usable hosts equals 2^(host bits) minus 2. The /31 is the exception because RFC 3021 defines it for point-to-point links that have no broadcast, so both of its two addresses are usable and it yields exactly two hosts. That is why a /30 gives 2 usable hosts (4 minus 2) while a /31 also gives 2 in half the space.
What's the actual difference between VLSM and CIDR?
VLSM is subnetting: you take one allocated block and divide it internally, using a different prefix length per subnet so each fits its host count. CIDR is the broader idea of ignoring classful boundaries entirely, most visible in route summarization where many networks are advertised as one shorter prefix. They use identical prefix math; VLSM sizes subnets going down, CIDR aggregates them going up.
What actually goes wrong if I don't allocate largest-subnet-first?
If you place a small subnet first, the next larger subnet may need a network number that has already been consumed, forcing it onto an address that is not a multiple of its own block size, which produces an illegal or overlapping subnet. Largest-first guarantees each subnet starts on a boundary aligned to its block size, so ranges never collide. You can subnet in another order only if you manually confirm every network number is a multiple of its block size.
Can I actually use the very first and very last subnet (subnet zero)?
Yes on any modern network, because ip subnet-zero has been the default on Cisco IOS since release 12.0, making both the all-zeros subnet and the all-ones subnet usable. The old prohibition dates to classful routing and only bites on very old gear or if someone configured no ip subnet-zero. Do not confuse the subnet-zero rule, which is about whole subnets, with the minus-2 rule, which is about host addresses inside each subnet.
I put a /30 on my link but OSPF advertises the loopback as a /32 — why?
By default OSPF advertises a loopback interface as a host route (/32) regardless of the mask you configured, because it treats loopbacks as stub host addresses. To make OSPF advertise the loopback with its real subnet mask, set ip ospf network point-to-point on that interface. This is expected behavior rather than a subnetting error, and it affects only loopbacks, not your /30 transit links.
Practice this on graded Cisco labs
Reading is step one — build Subnetting & IP Addressing on real Cisco IOS and grade your own config, or try a free sample lab first.