VLSM Subnetting Explained: How to Subnet by Host Requirements

Carving a network into equal-size subnets wastes addresses. A point-to-point link with two routers does not need the same block you hand a 60-user LAN, yet fixed-length subnetting gives every segment the same mask. VLSM, variable-length subnet masking, fixes that: you size each subnet to the hosts it actually needs and pack them into one network with no gaps.

This guide shows how to subnet by host requirements, then works a full VLSM design end to end: choosing each mask, allocating in the right order, checking for overlap, adding a subnet later, and confirming the result in a Cisco routing table. It assumes you can already subnet by network requirements; VLSM is the next step on the CCNA 200-301 path. Every subnet in the 10.0.0.0 design below was worked out by hand and then configured on a GNS3 lab router running real Cisco IOS 15.2(4)S3, so the overlap errors and routing tables are what IOS actually printed.

Configured October 2026 on Cisco IOS 15.2(4)S3.

Subnet by host requirements

When the requirement is “this segment needs N hosts,” pick the smallest mask where 2 to the power of the host bits, minus 2, is at least N. The minus 2 removes the network and broadcast addresses. Borrow the fewest host bits that still satisfy the requirement, which leaves the most space for everything else.

What VLSM is, and what it is not

VLSM means using more than one subnet mask within the same classful network. Splitting 192.168.10.0/24 into a /25, a /26, a /27 and a /30 is VLSM. Using different masks on different networks is just ordinary classless addressing, not VLSM. There is no IOS command that turns VLSM on; it happens automatically when you assign different masks to interfaces inside one network.

The catch that trips people up is routing-protocol support. A protocol can only carry VLSM if it advertises the mask with every route. Classful RIPv1 does not, so it cannot.

Allocate the largest subnet first

The one rule that prevents most VLSM mistakes: allocate the subnet with the most hosts first, then the next largest, down to the /30 links last. A large subnet needs a large contiguous block aligned to its mask boundary. If you hand out small subnets first, you can chop up the address space so no aligned block is left for the big one. Place the biggest rooms first; the closets fit in the space that remains. Cisco’s own VLSM worked example allocates in the same largest-first order.

A VLSM design worked end to end

Take 10.0.0.0/24 and four segments: LAN-A needs 100 hosts, LAN-B needs 60, LAN-C needs 20, and a WAN link needs 2. Sort them largest to smallest, choose each mask from the host-requirement rule, then allocate from 10.0.0.0 upward, each subnet starting right after the previous one’s broadcast.

LAN-A (100 hosts) takes a /25, which starts at 10.0.0.0 and ends at 10.0.0.127. LAN-B (60) takes a /26 starting at the next free address, 10.0.0.128. LAN-C (20) takes a /27 at 10.0.0.192. The WAN link (2) takes a /30 at 10.0.0.224. The full allocation looks like this:

Four segments fit inside a single /24 with room to spare, and neither usable address on the WAN link goes to waste. Fixed-length subnetting would have forced every segment onto a /25 and run out of space after two.

Check for overlapping subnets

Two subnets overlap when one’s address range falls inside another’s. The check is three steps: compute each subnet ID, compute its broadcast (subnet ID plus 2 to the power of the host bits, minus 1), then confirm the next subnet’s ID is greater than the previous broadcast. In the design above, each broadcast (.127, .191, .223, .227) is lower than the next subnet ID (.128, .192, .224), so nothing overlaps.

The classic mistake: placing LAN-C at 10.0.0.96/27 instead of 10.0.0.192/27. That /27 spans 10.0.0.96 to 10.0.0.127, which sits inside LAN-A’s 10.0.0.0/25 range (10.0.0.0 to 10.0.0.127). The two overlap, and IOS refuses the second address outright. On the lab router, with LAN-A already on Loopback1, it named the interface it collided with:

R1(config)# interface Loopback9

R1(config-if)# ip address 10.0.0.97 255.255.255.224
% 10.0.0.96 overlaps with Loopback1

Two more attempts on the same spare interface show the other answers you can get. An address inside LAN-C’s range collides with Loopback3, but if the address you type happens to be the subnet ID itself, IOS complains about the mask instead, because a network address can’t be assigned to an interface:

R1(config-if)# ip address 10.0.0.200 255.255.255.248
Bad mask /29 for address 10.0.0.200

R1(config-if)# ip address 10.0.0.201 255.255.255.248
% 10.0.0.200 overlaps with Loopback3

In all three cases the interface was left with no address, so nothing half-configured lingers. The check only covers interfaces on the same router, though. A plan that hands overlapping subnets to two different routers is accepted on both, so always check a new subnet’s range against every subnet already assigned anywhere in the design.

Add a subnet to an existing design

Requirements change, and VLSM is built for it. Suppose LAN-D appears later and needs 10 hosts. Ten hosts needs a /28, which gives 14 usable addresses. Find the lowest /28 that does not overlap anything already used. The /28 blocks fall on multiples of 16, and everything below .192 is already taken by LAN-A (.0 to .127) and LAN-B (.128 to .191), so the search starts at .192: 10.0.0.192 and 10.0.0.208 sit inside LAN-C’s /27 (10.0.0.192 to 10.0.0.223), and 10.0.0.224 holds the WAN /30. The first /28 that is fully free is therefore 10.0.0.240.

LAN-D slots into the gap between the WAN link and the end of the /24 without disturbing any existing subnet. That is the whole point of planning largest-first: the leftover space stays usable.

Confirm VLSM in the routing table

We put the five subnets on a lab router: LAN-A to LAN-D on four loopbacks, each holding the first usable address of its subnet, and the WAN /30 on Gi0/0 toward a second router running single-area OSPF. The loopbacks use ip ospf network point-to-point so OSPF advertises their real masks instead of /32 host routes. show ip route then groups everything under the classful parent and prints a header line that counts them (route code legend trimmed):

R1# show ip route

Gateway of last resort is not set

      10.0.0.0/8 is variably subnetted, 10 subnets, 6 masks
C        10.0.0.0/25 is directly connected, Loopback1
L        10.0.0.1/32 is directly connected, Loopback1
C        10.0.0.128/26 is directly connected, Loopback2
L        10.0.0.129/32 is directly connected, Loopback2
C        10.0.0.192/27 is directly connected, Loopback3
L        10.0.0.193/32 is directly connected, Loopback3
C        10.0.0.224/30 is directly connected, GigabitEthernet0/0
L        10.0.0.225/32 is directly connected, GigabitEthernet0/0
C        10.0.0.240/28 is directly connected, Loopback4
L        10.0.0.241/32 is directly connected, Loopback4

Count the header against the lines below it before you trust a rule of thumb. The router reports ten subnets, not five, because IOS adds a local /32 route (the L lines) for every interface address, and those count too. It reports six masks for the same reason: /25, /26, /27, /28 and /30 for the five subnets, plus /32 for the local routes. By the same arithmetic, the line would have read “8 subnets, 5 masks” before LAN-D was added. That is also why “variably subnetted” on its own does not prove VLSM on IOS 15 and later: on another lab router, a single /24 on one loopback printed 192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks, purely because of its local /32. The proof is in the C and O lines of one network using more than one prefix length, here /25, /26, /27, /28 and /30 (the routing table guide walks through every code). If the network shows up elsewhere summarized back to /8, look for RIPv1, or for automatic summarization, which classic IOS also turns on by default for RIPv2 (and for EIGRP before 15.0(1)M) until you add no auto-summary.

The second router shows the routing protocol carried every mask. OSPF is classless, so R2 learned each LAN with its own prefix length (legend trimmed again):

R2# show ip route ospf

Gateway of last resort is not set

      10.0.0.0/8 is variably subnetted, 6 subnets, 6 masks
O        10.0.0.0/25 [110/2] via 10.0.0.225, 00:00:20, GigabitEthernet0/0
O        10.0.0.128/26 [110/2] via 10.0.0.225, 00:00:20, GigabitEthernet0/0
O        10.0.0.192/27 [110/2] via 10.0.0.225, 00:00:20, GigabitEthernet0/0
O        10.0.0.240/28 [110/2] via 10.0.0.225, 00:00:20, GigabitEthernet0/0

R2’s header says six subnets and six masks although the filtered view lists four routes. The header always describes every 10.0.0.0/8 entry in the table, so it also counts R2’s own connected /30 and its local /32, which the ospf filter hides.

Practice VLSM

VLSM is a calculation skill, so drill it. Use the trainer for the underlying network and broadcast math, then the quiz for the VLSM-specific decisions: mask choice by host count, allocation order, overlap, and protocol support.

The questions below check the VLSM judgement calls, each with a worked explanation.

VLSM quick-reference card

Keep this beside you while you practice. It is the whole method in six lines.

With VLSM in hand, addressing stops being a source of wasted space and overlap errors, and you are ready for the routing topics that assume a clean, efficient address plan. For every mask, host count, and wildcard on one page, keep the subnetting cheat sheet within reach.