Subnetting is the one CCNA skill you cannot fake. Every other topic gives you partial credit for concepts; subnetting questions have exactly one right answer, and the exam expects you to find it in under a minute. The good news: subnetting is not math talent, it's a repeatable procedure. This guide teaches the block-size method, walks through VLSM planning the way you'd do it on a real network, and verifies the whole thing with real Cisco IOS XE output from our Network Fundamentals lab.
What subnetting actually does
A subnet mask splits a 32-bit IPv4 address into a network portion and a host portion. Moving the boundary right (borrowing host bits) creates more subnets with fewer hosts each. That's the entire game. Everything else - slash notation, wildcard masks, VLSM - is bookkeeping around that one idea.
Two formulas cover every question:
The block-size method
Forget binary long-hand under exam pressure. The block size is 256 minus the interesting octet of the mask, and subnet boundaries are multiples of that block size. Procedure:
- Find the interesting octet (the mask octet that isn't 255 or 0).
- Block size = 256 minus that octet's value.
- Count up from zero in block-size steps. The address lives in the block it falls inside.
- Network = block start. Broadcast = next block minus 1. Usable range = everything between.
Example: which subnet does 10.0.32.27 255.255.255.240 belong to? The interesting octet is 240, so the block size is 256 - 240 = 16. Blocks start at .0, .16, .32, .48. The address 10.0.32.27 falls in the .16 block? No - look at the fourth octet: 27 falls between 16 and 32, so the network is 10.0.32.16/28, broadcast is 10.0.32.31, and usable hosts run .17 through .30. We assigned exactly that subnet to a loopback in the lab, and you'll see IOS agree with us below.
The mask cheat table
Memorize this table cold. On the exam, recognizing that /28 means "block of 16, 14 usable hosts" without thinking is the difference between 40 seconds and 4 minutes per question.
VLSM: sizing subnets to fit
Variable Length Subnet Masking just means using different masks for different needs inside the same address space. The rule that keeps you out of trouble: allocate the largest subnets first, then fill in smaller ones behind them so nothing overlaps.
Here's the actual plan from our lab, carved from 10.0.0.0/16:
Five different masks, one address space, no overlaps. A /24 for users because user segments grow; a /30 for the router-to-router link because it will only ever hold two devices (if you gave it a /24 you'd waste 252 addresses).
What the router sees: real output
We configured that exact plan on a Cisco IOS XE router in CML and pulled the routing table. Note the line IOS prints: "variably subnetted, 9 subnets, 5 masks" - that's VLSM working:
R1# show ip route
10.0.0.0/8 is variably subnetted, 9 subnets, 5 masks
C 10.0.0.1/32 is directly connected, Loopback0
C 10.0.10.0/24 is directly connected, Ethernet0/1
L 10.0.10.1/32 is directly connected, Ethernet0/1
C 10.0.32.16/28 is directly connected, Loopback2
L 10.0.32.17/32 is directly connected, Loopback2
C 10.0.64.0/26 is directly connected, Loopback1
L 10.0.64.1/32 is directly connected, Loopback1
C 10.0.99.4/30 is directly connected, Loopback3
L 10.0.99.5/32 is directly connected, Loopback3Read the pairs: every C (connected) route is the subnet itself, and every L (local) route is the /32 for the router's own address inside it. 10.0.32.16/28 is there exactly as the block-size method predicted, with the router holding .17 (the first usable host).
Worked exam questions
Q1: A host has 172.16.45.14/27. What is its broadcast address? Block size 256 - 224 = 32. Blocks: .0, .32, .64. The 45 in the third octet? No - /27 puts the interesting octet fourth. Host .14 falls in the 0-31 block, so network 172.16.45.0/27 and broadcast 172.16.45.31.
Q2: You need 6 subnets from 192.168.1.0/24, each with at least 25 hosts. What mask? 25 hosts needs 5 host bits (2^5 - 2 = 30). That leaves 3 borrowed bits = 8 subnets. Mask /27 (255.255.255.224). Check both constraints - the exam loves masks that satisfy one but not the other.
Q3: Which subnet is 10.0.64.1 255.255.255.192 in? Block 256 - 192 = 64. Blocks .0, .64, .128. Answer: 10.0.64.0/26, usable .65 to .126, broadcast .127. Exactly our lab server segment.
FAQ
What is the fastest way to subnet in the CCNA exam?
The block-size method. Compute 256 minus the interesting octet once, then everything - network, broadcast, usable range - falls out of counting in multiples. With the /25 through /30 table memorized, most questions take under a minute. Binary conversion is for understanding, not for exam speed.
How many usable hosts are in a /26, /28, and /30?
/26 = 62 usable (block 64), /28 = 14 usable (block 16), /30 = 2 usable (block 4). The pattern: usable hosts = block size minus 2, because every subnet spends one address on the network ID and one on broadcast.
What does "variably subnetted" mean in show ip route?
It means the router knows subnets of one classful network with more than one mask - VLSM in action. IOS prints the count of subnets and distinct masks, then lists each route with its own prefix length, which is why you should always read the mask per-route rather than assuming one mask per network.
When should I use a /31 instead of a /30 on point-to-point links?
RFC 3021 allows /31s on point-to-point links (2 addresses, 0 wasted), and modern IOS XE supports them - ip address 10.0.99.0 255.255.255.254. They halve address burn on link-heavy networks. The CCNA answer is still usually /30; /31 is the real-world optimization worth knowing exists.
Is subnetting still relevant with IPv6?
The mechanics carry over - IPv6 subnetting is arguably easier (sites get a /48 or /56 and carve /64s on nibble boundaries), but the prefix-length thinking is identical. Master IPv4 blocks and IPv6 prefixes feel familiar rather than foreign.
Key takeaways
- Block size = 256 minus the interesting octet. Subnets start at multiples of the block size.
- Usable hosts = 2^host-bits minus 2. Always check both the subnet-count and host-count constraints.
- VLSM = biggest subnets first, then pack smaller ones behind. Point-to-point links get /30 (or /31), loopbacks get /32.
- Verify on the box:
show ip routetells you "variably subnetted, N subnets, M masks" and lists every boundary.
Practice this hands-on in Lab nf-04 - IPv4 Subnetting with VLSM, and see the full domain map on the Network Fundamentals guide.
