Guided buildcore6 steps~22 min9 devices

Subnetting drill on the canvas

Subnet 192.168.1.0/24 into four /26s on four router ports, put a PC in each, and prove every /26 is its own broadcast domain.

What you'll be able to do: One /24 working as four /26 networks — .0, .64, .128 and .192 — each on its own switch behind its own router port, with PCs that reach one another only through the router, and a switch MAC table that shows no frame ever crossed from one /26 into another.

Start this build in the lab 9 devices — needs any paid plan (the free canvas fits 5).

Topics: Subnets · Subnet masks · IPv4 addressing · Broadcast domains · Default gateway

What you'll build

R-Sub — a router, the router with a gateway in each of the four /26s, already on the canvas
SW-A — a switch, the switch for block A, 192.168.1.0/26
SW-B — a switch, the switch for block B, 192.168.1.64/26
SW-C — a switch, the switch for block C, 192.168.1.128/26
SW-D — a switch, the switch for block D, 192.168.1.192/26
PC-A — a pc, a host in 192.168.1.0/26, on SW-A
PC-B — a pc, a host in 192.168.1.64/26, on SW-B
PC-C — a pc, a host in 192.168.1.128/26, on SW-C
PC-D — a pc, a host in 192.168.1.192/26, on SW-D

Step by step

1. One router is already here — drop the four switches
The router, R-Sub, is already on the canvas, and that is deliberate: a router from the palette has only two Ethernet ports, Gi0/0 and Gi0/1, and its serial ports are for WAN links, not LANs. Four LANs need four Ethernet ports, so this one comes with a 2-port Ethernet expansion module fitted — Gi0/2 and Gi0/3 — which you cannot snap in from the palette. Drag the four switches on and name each one; the plan is one LAN per switch and one router port per LAN, with the letters A to D following the four address blocks in order.
On SW-A — Name the switch for block A
```
enable
configure terminal
hostname SW-A
end
```
On SW-B — Name the switch for block B
```
enable
configure terminal
hostname SW-B
end
```
On SW-C — Name the switch for block C
```
enable
configure terminal
hostname SW-C
end
```
On SW-D — Name the switch for block D
```
enable
configure terminal
hostname SW-D
end
```
Why: Four LANs need four networks, and 192.168.1.0/24 is one. Cutting it into four means borrowing host bits for the subnet: 2 bits give 2² = 4 subnets, so the prefix grows from /24 to /26. That is step 1 of the method — write the prefix and its mask side by side: /26 is 255.255.255.192. The 6 host bits left give each subnet 2⁶ = 64 addresses, 62 of them usable.
2. Wire each switch to a separate router interface
Run a copper cable from each switch's Gi0/1 uplink to its own router port: SW-A to Gi0/0, SW-B to Gi0/1, SW-C to Gi0/2, SW-D to Gi0/3 (the two module ports). Router ports leave the factory shut, so the four cables stay dark until each port is turned on with `no shutdown`.
- Cable R-Sub Gi0/0 ↔ SW-A Gi0/1
- Cable R-Sub Gi0/1 ↔ SW-B Gi0/1
- Cable R-Sub Gi0/2 ↔ SW-C Gi0/1
- Cable R-Sub Gi0/3 ↔ SW-D Gi0/1
On R-Sub — Turn on the four LAN ports
```
enable
configure terminal
interface GigabitEthernet0/0
no shutdown
exit
interface GigabitEthernet0/1
no shutdown
exit
interface GigabitEthernet0/2
no shutdown
exit
interface GigabitEthernet0/3
no shutdown
end
```
Check: run show ip interface brief on R-Sub and look for Gi0/3 unassigned YES manual up up.
Why: A router does not forward broadcasts from one interface to another, so every router port is the edge of its own broadcast domain: an ARP request sent on SW-A's LAN reaches every host plugged into SW-A and stops at Gi0/0. Four ports means four broadcast domains, and that is why each one needs a subnet of its own. `unassigned … up up` is a working cable with no network on it yet.
3. Configure the four /26 gateways on the router ports
Run the method once and the whole plan falls out. The interesting octet is the fourth, and the magic number is 256 − 192 = 64, so the four networks start every 64 addresses: .0, .64, .128 and .192. Give each router port the first usable address of its block — 192.168.1.1, .65, .129 and .193, all with mask 255.255.255.192.
On R-Sub — Address each LAN port with the first usable address of its /26
```
enable
configure terminal
interface GigabitEthernet0/0
ip address 192.168.1.1 255.255.255.192
exit
interface GigabitEthernet0/1
ip address 192.168.1.65 255.255.255.192
exit
interface GigabitEthernet0/2
ip address 192.168.1.129 255.255.255.192
exit
interface GigabitEthernet0/3
ip address 192.168.1.193 255.255.255.192
end
```
Check: run show ip route on R-Sub and look for C 192.168.1.192/26 is directly connected, Gi0/3.
Why: Step 5 of the method gives each block's edges: broadcast = network + 64 − 1. So block A runs .0 to .63 (hosts .1–.62), B runs .64 to .127 (hosts .65–.126), C runs .128 to .191 (hosts .129–.190) and D runs .192 to .255 (hosts .193–.254). `show ip route` now lists four C routes, one /26 per port — four separate networks, not one /24 spread over four cables.
4. Add a PC to each switch, inside its /26
Place four PCs, cable each one's Eth0 to Fa0/1 on its own switch, and give each an address inside the matching block: 192.168.1.10, .70, .130 and .200, all /26. Leave the gateways off for one step. PC-A reaches its own gateway at .1, but its ping to PC-B at .70 fails with `PING: transmit failed. General failure.` — even though both addresses start 192.168.1.
- Cable PC-A Eth0 ↔ SW-A Fa0/1
- Cable PC-B Eth0 ↔ SW-B Fa0/1
- Cable PC-C Eth0 ↔ SW-C Fa0/1
- Cable PC-D Eth0 ↔ SW-D Fa0/1
On PC-A — Name PC-A and address it inside block A
```
hostname PC-A
ipconfig Eth0 192.168.1.10 255.255.255.192
```
On PC-B — Name PC-B and address it inside block B
```
hostname PC-B
ipconfig Eth0 192.168.1.70 255.255.255.192
```
On PC-C — Name PC-C and address it inside block C
```
hostname PC-C
ipconfig Eth0 192.168.1.130 255.255.255.192
```
On PC-D — Name PC-D and address it inside block D
```
hostname PC-D
ipconfig Eth0 192.168.1.200 255.255.255.192
```
On PC-A — Ping the gateway in your own block, then a host in the next one
```
ping 192.168.1.1
ping 192.168.1.70
```
Check: run ip route show on PC-A and look for 192.168.1.0/26 dev Eth0 proto kernel scope link src 192.168.1.10.
Why: Step 4 of the method, from PC-A's side: the largest multiple of 64 that is ≤ 10 is 0, so PC-A lives in .0 to .63, and that one /26 is the only route it has. PC-B at .70 lands in the block that starts at 64, so to PC-A it is on another network: PC-A will not ARP for it on its own wire, and with no gateway it has nowhere to send the packet. Under a /24 the two would be neighbours; the /26 mask is what put a router-sized boundary between them.
5. Give each PC the router as its gateway
Point each PC at the router's address in its own block — .1, .65, .129 and .193 — then repeat the ping that failed. PC-A still never ARPs for PC-B: it hands the packet to 192.168.1.1, and R-Sub, which has a connected route for every block, sends it out of Gi0/1 to PC-B.
On PC-A — Gateway of block A
```
ip route add default via 192.168.1.1
```
On PC-B — Gateway of block B
```
ip route add default via 192.168.1.65
```
On PC-C — Gateway of block C
```
ip route add default via 192.168.1.129
```
On PC-D — Gateway of block D
```
ip route add default via 192.168.1.193
```
On PC-A — Repeat the ping that failed
```
ping 192.168.1.70
```
Check: run ip route show on PC-A and look for default via 192.168.1.1 dev Eth0.
Why: A host can only hand a frame to a neighbour it reaches with ARP, so its gateway must sit inside its own block: the router's address on that same broadcast domain. The router needs no routes typed at all — every block is a connected network on one of its ports, so a packet arriving on one port is matched against the table and sent out of another. The first echo may time out while R-Sub ARPs for PC-B; the rest come back.
6. Ping between any two PCs — and prove the four broadcast domains
Clear SW-A's MAC table, then ping from PC-A to PC-C and PC-D, trace the path to PC-C, and ping across from PC-B and PC-C as well. Every pair answers, and traceroute lists 192.168.1.1 as hop 1: each cross-block packet goes through the router. Then read SW-A's MAC table — after talking to three other networks it has learned exactly two addresses.
On SW-A — Empty the switch's MAC address table
```
enable
clear mac address-table
```
On PC-A — Reach blocks C and D, and trace the path to C
```
ping 192.168.1.130
ping 192.168.1.200
traceroute 192.168.1.130
```
On PC-B — Reach blocks C and D from block B
```
ping 192.168.1.130
ping 192.168.1.200
```
On PC-C — Reach block D from block C
```
ping 192.168.1.200
```
Check: run show mac address-table on SW-A and look for Total Mac Addresses for this criterion: 2.
Why: SW-A carried PC-A's traffic to three other networks and learned only PC-A's MAC on Fa0/1 and R-Sub's Gi0/0 on Gi0/1. No frame from PC-C or PC-D ever reached it, because a router ends each frame at its own interface and builds a new one on the far side: the IP addresses travel end to end, while an Ethernet frame lives inside one broadcast domain. Four router ports, four /26s, four broadcast domains — and one router hop between any two of them.

The theory behind it

One router, one PC, one ping — Build the smallest network that works: address a router and a PC on the same subnet and get a reply back.
Sketch your home network — Start from two PCs on a switch, add a home router and the internet, cable them up, then sort every device into endpoints and intermediate nodes.
Three hosts, one switch — Put three PCs on a single subnet through an unconfigured switch and watch it learn who lives where.
ARP and MAC learning, side by side — Watch a host's ARP cache and a switch's MAC table fill from the very first frame — and see why a host never ARPs for anything beyond its gateway.
Two LANs, one router — Put a PC on each of two different subnets and make them talk through a router.
VLSM for two sites — Carve one /24 into a /26, a /27 and a /30 sized to what each site needs, then route between them with masks that match the plan.

Build it for real

The lab walks you through these steps and ticks each one off as your network starts working.

Open in the lab

What you'll build

Step by step

1. One router is already here — drop the four switches

2. Wire each switch to a separate router interface

3. Configure the four /26 gateways on the router ports

4. Add a PC to each switch, inside its /26

5. Give each PC the router as its gateway

6. Ping between any two PCs — and prove the four broadcast domains

The theory behind it

More in Foundations

Build it for real