I85PREP
⌘ K
CCNA Automation study materials
CCNA Automation study resources

A /24 That Cannot Hold the Floor

CCNA Automation · Put your knowledge to work in context.

All case studies

A /24 That Cannot Hold the Floor

Your floor closet serves 310 endpoints on VLAN 10: 120 IP phones, 150 PCs, 20 printers, 10 access points, and 10 reserved addresses. The SVI is 10.10.10.1/24 with DHCP pool 10.10.10.0/24 and a 4-hour lease. Users report new laptops receive 169.254.x.x addresses, and the help desk sees the DHCP pool at 100 percent. show ip arp on the SVI shows 780 entries, many stale. A legacy label printer is statically addressed at 10.10.10.250. The network team proposes changing the mask to /23 on the SVI and DHCP pool. However, a server VLAN at the data center uses 10.10.11.0/24 and is reachable over the WAN through a Layer 3 switch. The WAN change window is 6 weeks away, and the floor cannot be down for more than 10 minutes. VoIP QoS markings must be preserved.

1. Calculate whether 10.10.10.0/23 is usable, and explain the failure mode if it is applied.

Read the worked answer

No - 10.10.10.0/23 overlaps the data-center server VLAN.

  • /23 gives 2^9 - 2 = 510 usable hosts, which covers 310 endpoints.
  • But 10.10.10.0/23 spans 10.10.10.0–10.10.11.255. The data-center subnet 10.10.11.0/24 sits inside that range.
  • If applied, the floor SVI owns 10.10.11.0/24 locally. The WAN route to the servers becomes a connected route on the floor switch, so traffic to 10.10.11.x is ARP'd on the floor instead of routed to the data center. The DHCP pool would also hand out 10.10.11.x leases, creating duplicate addresses and ARP conflicts.
  • The symptom would be intermittent server access, not a clean failure, which is worse.

Use 10.10.12.0/23 for the new data VLAN or renumber the floor to a non-overlapping block. Validate against the full enterprise address plan before changing the mask.

2. Propose a migration that meets the 10-minute outage and preserves voice.

Read the worked answer

Migrate data users to a new VLAN, leave voice on VLAN 10.

  1. Pre-create VLAN 20, SVI 10.10.12.1/23, and a DHCP pool with a short lease (1 hour) for cutover.
  2. Configure access ports as switchport access vlan 20 and switchport voice vlan 10. Phones learn the voice VLAN via LLDP-MED/CDP and stay on 10.10.10.0/24; PCs behind the phone move to VLAN 20.
  3. Move one closet at a time during the window; shutdown/no shutdown the ports or let DHCP renew. A 10-minute outage per closet is achievable because the SVI and pool already exist.
  4. Keep 10.10.10.0/24 for phones/APs; 120 phones + 10 APs + printers fit.
  5. Preserve QoS by trusting DSCP on the phone port and keeping the voice VLAN's QoS policy.

Do not use a secondary IP as a long-term fix; it leaves the broadcast domain oversized.

3. Why does the ARP table show 780 entries, and how does that relate to the /24?

Read the worked answer

780 ARP entries on a /24 is a symptom of a flat, leaky Layer 2 domain, not normal neighbor count. A /24 cannot have 780 distinct on-link IPv4 neighbors, so the table is being populated by something else: proxy ARP, secondary addresses, duplicate IPs from a rogue DHCP server, or hosts from other subnets being bridged into VLAN 10. The default ARP timeout is 4 hours, so stale entries accumulate. Check show ip arp for duplicate MACs/IPs, show ip interface for secondary addresses, and show running-config | include proxy-arp. The fix is to restore proper subnet boundaries and enable DHCP snooping/DAI; enlarging the mask without fixing the overlap would make the broadcast domain and ARP table worse.