Learning objectives
- Interpret CIDR ranges
- Recognize overlapping-address failures
- Separate subnetting from access control
The mental model
An address identifies a network interface, while a prefix describes a range of addresses that can be routed together. CIDR notation expresses that prefix length: a larger prefix length describes a smaller address block. Subnetting is therefore an allocation and routing tool, not just arithmetic for a certification exam. It affects whether systems consider a destination local, which router receives traffic, and whether two connected environments overlap. Private addresses can be reused in separate networks, but that convenience becomes a problem when those networks must communicate. A customer architecture should include an addressing plan alongside its application diagram, particularly during acquisitions, multi-cloud expansion, and VPN integration.
How it works
IPv4 addresses contain 32 bits. A /24 prefix fixes the first 24 bits and leaves 8 bits for addresses within the block, giving 256 total addresses; usable host counts depend on the network context and platform reservations. A /16 contains more addresses than a /24. IPv6 uses 128-bit addresses and different operational conventions, so avoid blindly applying IPv4 host-count assumptions. Routers select a matching route, typically preferring the most specific matching prefix before applying relevant route-selection rules.
On a local link, hosts use link-layer resolution mechanisms appropriate to the address family; traffic to a remote network goes through a gateway. A subnet boundary alone is not an access-control policy. Security requires explicit filtering or policy enforcement between allowed and disallowed flows. When joining cloud and branch networks, inventory every relevant prefix and detect overlap before deployment. Check destination, source, gateway, return route, and platform-reserved addresses. A diagram that only labels boxes as private cloud hides the information needed to troubleshoot. Include prefixes and trust boundaries, but avoid placing sensitive production addressing details in public documents.
Applied example · hypothetical
Hypothetical example: a startup acquires a company whose cloud network uses the same private address range as its office. Both networks work independently, but connecting them causes requests to select the wrong local or remote route. The application teams initially blame authentication because users cannot reach login. A prefix inventory reveals the collision. The durable plan allocates distinct ranges, while a carefully scoped translation arrangement may bridge a transition. The business relevance is predictable integration: addressing choices can block an acquisition's operational benefits even when every individual application is healthy.
In a customer engagement
For a Cloudflare enterprise connectivity discussion, ask for the private prefixes and intended traffic flows before selecting a connector or routing model. Confirm whether networks overlap and whether customer policy permits translation or renumbering. Product fit depends on topology and constraints. A correct prefix inventory saves time that would otherwise be spent debugging an ambiguous destination after deployment.
Interview relevance
Interviewers may ask CIDR questions to see whether you can reason about routing, not merely calculate addresses. Explain /24 versus /16, then connect overlap to a real integration risk. State that segmentation policy is separate from subnetting and that cloud platforms may reserve addresses within allocated blocks.
Common mistakes
- Assuming a subnet automatically enforces security
- Treating /24 as larger than /16
- Ignoring platform address reservations
Key terminology
CIDR — Classless Inter-Domain Routing notation that describes an address prefix and its length.
Subnet — A logically defined address range within a larger network.
Longest-prefix match — Selecting the most specific matching destination prefix in a routing table.
Explain it without the page
- What prefixes would you collect before connecting two companies?
- Why can two healthy networks fail when joined?
Further reading
Sources explain the underlying concepts; examples and practice answers are original course material. Recheck current limits and plan eligibility before a real proposal.
Reason about an IPv4 prefix
10.20.4.0/24
network bits = 24
host bits = 32 - 24 = 8
address values = 2^8 = 256This is address-space arithmetic, not a promise of 256 usable hosts. Platform reservations, subnet conventions and IPv6 differ.