Cloud Networking
Intermediate 14 min read Cloud Networking

Subnets and CIDR Planning

IP math, subnet sizing and non-overlap discipline

CIDR math decides how many addresses a subnet holds and whether networks overlap. A good plan leaves headroom, maps tiers and zones predictably, and never collides with on-prem or peers.

CIDRsubnetprefixIP planningoverlapaddress space
Prerequisites: VPC Basics
Before we start

What you will learn

  • Convert between prefix lengths and address counts
  • Carve hierarchy-sized subnets without waste or overlap
  • Design for peering and VPN without address collisions
In 60 seconds

A CIDR like 10.24.0.0/16 has 65,536 addresses. Subnets are slices: /24 = 256, /20 = 4096. Planning multiplies a private space so every tier, zone and future VPC has room and no two ranges overlap.

Introduction

What is this?

CIDR notation is <network>/<prefix>, where prefix is the number of masked bits; address count = 2^(32-prefix). Planning means: allocate per-VPC blocks from a company-wide range, carve per-tier and per-AZ subnets with headroom, reserve ranges for peering/VPN/on-prem, and forbid overlaps — two networks sharing addresses break routing silently.

Motivation

Why do you need it?

  • Overlaps are catastrophic and subtle: routes disappear, sessions black-hole.
  • Tier math drives quota: a /24 subnet can't host a 500-node autoscaling group.
  • Peering/VPN only works with distinct address spaces.
  • Headroom saving: growing a subnet later is harder than sizing it right the first time.
Think about it

Mental model

Imagine

Zoning a city with street numbers

Think of

CIDR planning

You map city blocks (VPC CIDRs) and building numbers (subnets) with clear zones. Two blocks both called 'block 11' make delivery impossible, exactly like IP overlap.

Mechanics

How it works

  • Start from a private RFC1918 space you own for the estate (e.g. 10.0.0.0/8).
  • Split into /16 per environment (dev 10.1.0.0/16, prod 10.2.0.0/16) with headroom.
  • Within an environment, split /20 per tier and /24 per AZ+function.
  • Record every assignment in an IPAM/registry so future engineers don't collide.
  • Reserve a block for peering and on-prem ranges that must never be reused.

Hierarchical subnet allocation.

Estate 10.0.0.0/8
Prod 10.1.0.0/16
App tier 10.1.20.0/20
Per-AZ subnets
IPAM registry
Hands-on

Examples

Compute subnet sizes with python's ipaddress

Compute subnet sizes with python's ipaddress
import ipaddress
for prefix in (20, 24, 26):
    n = ipaddress.IPv4Network(f'10.1.20.0/{prefix}')
    print(f'{prefix} -> {n.num_addresses} addresses')
 
# Carve a /16 into 4 non-overlapping /18s
for sub in ipaddress.IPv4Network('10.1.0.0/16').subnets(new_prefix=18):
    print(sub)

Subnet math is mechanical: address count is 2^(32-prefix) and subnets() carves clean, non-overlapping slices.

Real world

In production

  • An org documents a /8 split: /16 per environment, /20 per tier, /24 per AZ, enforced by an IPAM tool.
  • A hybrid estate reserves 10.128.0.0/16 for on-prem so cloud CIDRs never collide with the data center.
  • A platform team pre-assigns peering ranges so future VPC mesh has addresses available.
Guidelines

Best practices

  • Follow a hierarchy: estate → environment → tier → AZ, in multiples of 2.
  • Document every assignment; an undocumented collision is a production incident waiting.
  • Reserve peering/VPN ranges explicitly.
  • Recheck overlap in CI: parse CIDRs and fail on intersections.
Watch out

Common mistakes

  • Copy-pasting 10.0.1.0/24 into multiple environments and 'fixing it in prod later'.
  • Sizing subnets to the current fleet, not the headroom.
  • Overlapping with on-prem VPN space, silently breaking hybrid routes.
  • Not recording assignments — the registry is the network's memory.
Root cause analysis

Common issues

Error
VPN tunnel up but no traffic crosses
Root cause

Overlapping CIDRs between cloud and on-prem

Fix

Redeploy the conflicting subnet to a free range and re-advertise the routes.

Error
Autoscaling group can't reach max size
Root cause

Subnet too small for the intended instance count

Fix

Create a larger subnet (or secondary CIDR) and point the ASG at it.

When things break

Debugging tips

  • Traffic black-holed across VPN/peering? Check both sides' CIDRs for overlap first.
  • New subnet can't launch enough instances? Count addresses for the prefix.
  • Use python ipaddress or a calculator to double-check arithmetic before committing.
Interviews

Interview checkpoint

Practice

Hands-on lab

Design a CIDR Tree for a Multi-Environment Estate
30 min · intermediate
In progress
Objectives
  • Allocate an estate-range CIDR plan with headroom
  • Carve environment, tier and AZ subnets without overlap
  • Prove disjointness programmatically

Design a CIDR Tree for a Multi-Environment Estate

30 min · intermediate

0/4 steps
0%
sandbox · Linux sandbox
$
Try these commands
Test yourself

Quick quiz

0/2
1

How many addresses does a /24 subnet have?

2

Two peered VPCs with the same CIDR can route traffic to each other automatically.

Go deeper

Official documentation

AWS — VPC with public/private subnets
docs
Azure — Virtual network planning
docs