A2.2.4 · Network architecture
Network segmentation
By the end you can
Explain why networks are split into segments, and use subnet masks, CIDR, VLANs and access control lists to do it.
A large flat network, where every device can reach every other, is hard to secure and gets noisy. divides it into smaller segments. A bank keeps its guest Wi-Fi apart from its account systems; a home with two teenage gamers and a parent working from home can keep the heavy traffic from swamping the video call.
- Security: traffic cannot cross from one segment to another unless a rule allows it, so an infected guest device cannot reach the servers, and a breach stays contained.
- Performance: traffic (including broadcasts) stays in its own segment, so congestion is spread out. You can also upgrade only the busy segment.
- Management: each segment can have its own rules, monitoring and quality-of-service settings. Subnets also keep routing tables smaller, because routers only need a route to each subnet rather than to every device.
Two main tools do the dividing: subnetting and VLANs.
Subnets and the subnet mask#
An IPv4 address has two parts: a network part (which network am I on?) and a host part (which device on it?). The marks the split: its 1s cover the network part and its 0s cover the host part. With the mask 255.255.255.0 (24 ones), the first three numbers identify the network and the last identifies the device.
To find the network address, AND the address with the mask, bit by bit (1 AND 1 = 1, anything else = 0). Take 192.168.1.10 with 255.255.255.0:
11000000.10101000.00000001.00001010 (address)11111111.11111111.11111111.00000000 (mask)11000000.10101000.00000001.00000000 = 192.168.1.0 (network address)
Two devices with the same network address are on the same subnet and can talk directly. Devices on different subnets must go through a router. In each subnet the first address (all host bits 0) is the network itself and the last (all host bits 1) is the , used to reach everyone; the rest are for devices.
CIDR notation#
Writing out masks is clumsy, so notation writes the number of 1s after a slash: 192.168.100.0/22 means a 22-bit network part, mask 255.255.252.0. The host part has 32 − 22 = 10 bits, so the subnet holds 210 − 2 = 1,022 usable addresses (take away the network and broadcast addresses), from 192.168.100.1 to 192.168.103.254, with broadcast 192.168.103.255. Smaller prefix, bigger subnet.
Subnet mask
255.255.252.0
Network address
192.168.100.0
Broadcast address
192.168.103.255
Usable hosts
1,022
Working
- Address 11000000.10101000.01100100.00100101 (192.168.100.37)
- Mask 11111111.11111111.11111100.00000000 (the first 22 bits are 1s)
- AND 11000000.10101000.01100100.00000000 = network address 192.168.100.0
- Host bits: 32 − 22 = 10, so 2^10 − 2 = 1,022 usable addresses (the network and broadcast addresses are not given to devices).
- Usable range: 192.168.100.1 to 192.168.103.254. The address is private.
Checked against 192.168.100.0/22.
Same subnet: they can talk directly, with no router.
VLANs#
A (virtual LAN) splits one physical network into several logical ones using the switch's settings, so devices can be grouped by job rather than by where they plug in. A 24-port switch might have ports 1 to 10 in VLAN 10 (accounting) and ports 11 to 20 in VLAN 20 (sales). Accounting and sales cannot see each other's traffic, even though they share the same switch, and no extra equipment was bought. Each VLAN can have its own security and quality-of-service policy.
Controlling what crosses: ACLs#
Segments are kept apart, but some traffic has to cross (staff reaching the internet, for example). A router or firewall applies an : an ordered list of rules saying which addresses, ports and protocols are allowed or denied between segments. A2.4.1 looks at how such rules are matched.
Staff devices use 192.168.0.x and student devices use 192.168.1.x, with a mask of 255.255.255.0.
Two departments share one switch, but the administrator puts ports 1 to 10 and 11 to 20 in separate logical networks.
The router allows students to reach the internet but denies them access to the staff file server.
0 of 3 matched
Check yourself
Subnets and segmentation
Quick questions, made fresh every time and marked here. Do a few until they feel easy.
Exam practice
Paper 1-style questions
5 questions · 16 marks
Write your answer as you would in the exam, then show the mark points and tick each one your answer made. These are our own questions in the style of the exam, not past-paper questions.
1.Explain two reasons why an organisation would divide its network into segments.
[4]Explain: Give reasons: say what happens AND why, or how one thing causes another.
2.A device has the address 192.168.72.131 and the subnet mask 255.255.255.0. Calculate the network address, and state whether it can talk directly to a device at 192.168.72.5.
[3]Calculate: Work out the number, showing the working.
3.A subnet is written 10.4.8.0/21. Calculate (a) the subnet mask and (b) the number of usable host addresses.
[4]Calculate: Work out the number, showing the working.
4.Explain how VLANs contribute to network segmentation.
[3]Explain: Give reasons: say what happens AND why, or how one thing causes another.
5.Outline how an access control list (ACL) can be used between two segments.
[2]Outline: A brief account: the main points, without much detail.
In a nutshell
- Segmentation divides a network into smaller parts to improve security (contain breaches, isolate guests), performance (less congestion and broadcast traffic) and management.
- A subnet mask says which bits of an IP address are the network part (1s) and which the host part (0s). Network address = address AND mask.
- CIDR writes the mask as a prefix: /24 means 24 ones, mask 255.255.255.0. Usable hosts = 2^(32 − prefix) − 2.
- Devices on the same subnet talk directly; devices on different subnets need a router, where ACLs and firewall rules can control what crosses.
- A VLAN splits one physical network into separate logical networks by software, with no extra hardware.