Twelve Access Points and One Flat Network
A secondary school has two blocks 180 m apart. Block A holds two computer labs with 60 PCs, the administration office and the server room; Block B holds 14 classrooms. Twelve wireless access points, installed over five years, all connect to one 24-port switch in Block A. Everything sits on 192.168.1.0/24, with the DHCP pool set to 192.168.1.100-192.168.1.199. Symptoms: at about 09:40, when two classes stream video, teachers in Block B lose the web-based staff attendance system; a guest SSID shares the staff SSID password and key, so students join the staff network; the attendance and file server received 192.168.1.111 by DHCP, and after a power cut it came up as 192.168.1.113, so every mapped drive failed; the canteen AP served 40 devices at break and stopped responding. The school has RM15,000 and a two-day holiday window.
1. Re-plan the IPv4 addressing by placing the labs, administration, staff Wi-Fi, guest Wi-Fi and servers on separate subnets inside 192.168.1.0/24. Give the network address, prefix, usable range and broadcast address for each, and justify the sizes.
Read the worked answer
| VLAN | Subnet | Usable range | Broadcast | Hosts available |
|---|---|---|---|---|
| Labs (60 PCs + printers) | 192.168.1.0/26 | .1 - .62 | .63 | 62 |
| Administration | 192.168.1.64/27 | .65 - .94 | .95 | 30 |
| Staff Wi-Fi | 192.168.1.96/27 | .97 - .126 | .127 | 30 |
| Guest Wi-Fi | 192.168.1.128/27 | .129 - .158 | .159 | 30 |
| Servers | 192.168.1.160/27 | .161 - .190 | .191 | 30 |
| Spare / future | 192.168.1.192/26 | .193 - .254 | .255 | 62 |
Justification. A /26 gives 62 usable addresses, enough for the 60 lab PCs with room for a printer and a spare; a /25 would waste half the space. Each /27 gives 30 hosts, which covers 40 staff devices only if staff Wi-Fi is paired with the spare range later - a point to state in the plan, because 30 addresses will be exhausted if every teacher brings a laptop and a phone. Guest is deliberately small and the spare /26 is held back for exactly that growth.
Addressing rules: reserve .1 in every subnet for the router or layer-3 switch, .2-.10 for switches and APs, and serve the rest by DHCP per VLAN. The server VLAN has no DHCP pool at all; addresses there are static or reserved.
2. Rank four actions for the RM15,000 budget and two-day window, and justify the order using impact and dependency.
Read the worked answer
1. Configure VLANs on the switch and separate DHCP scopes (cost: staff time only). This addresses the 09:40 outage at its root - one broadcast domain shared by 60 lab PCs, 12 APs and the canteen crowd. It must come first because every later step (separate SSIDs, server VLAN, per-VLAN addressing) depends on the VLAN structure existing. Highest impact per ringgit.
2. Put the server on a static address or a DHCP reservation. Trivial cost, fixes the mapped-drive failures after the power cut, and must be done during the same window so drive mappings in the labs can be verified before staff return. It cannot be done meaningfully before the server VLAN exists.
3. Split the guest SSID, give it its own password, and enable client isolation and bandwidth limiting. A shared password with the staff network is both a security hole and a capacity problem; isolating guest traffic stops 40 canteen devices consuming staff airtime and DHCP leases. Low cost, high risk reduction, and depends on step 1.
4. Add a wired uplink between the blocks (fibre if ducting exists, otherwise a point-to-point wireless bridge) and two extra APs in Block B. This is the expensive item and should be bought last, because if the VLAN work already removes the contention the school may only need the uplink. A 180 m inter-building link also carries a power and lightning-protection cost that a two-day window may not fit; stage it rather than rush it.
Deferred: replacing all 12 APs. The evidence does not yet show faulty hardware - one overloaded AP and one shared broadcast domain explain the symptoms.
3. Explain why reducing broadcast domain size helps this school, and why a faster internet subscription would not have fixed the 09:40 attendance failure.
Read the worked answer
Why smaller broadcast domains help. Every device on a broadcast domain receives every broadcast and ARP frame on it. With 60 lab PCs, 12 APs, staff laptops and 40 canteen devices in one /24, each video stream also floods ARP and DHCP traffic to all of them, and the single DHCP pool of 100 addresses is shared by everyone - once students fill it, a teacher's laptop cannot obtain a lease at all. Splitting into VLANs confines broadcasts to their own segment and gives each group its own pool, so guest devices can exhaust theirs without touching staff addressing.
The 09:40 timing fits this: break time plus two video classes is precisely when the shared pool and the shared airtime peak.
Why a faster internet plan would not help. The attendance system is hosted on the school's own server in Block A. Traffic from a Block B classroom to that server never leaves the building; it traverses the switch, the inter-block link and the wireless network. Upgrading the WAN link changes nothing on that path. The failure is local congestion and address exhaustion - symptoms that appear when the LAN is busiest - so the diagnostic question is 'where does this traffic go?', not 'how much bandwidth do we buy?'. Buying bandwidth would also leave the shared guest password and the DHCP-dependent server untouched.