Loopback address design questions

[mikearama]

First, picture a pair of Cat6509's, attached to a pair of Cat3560's... connecting over a telco TLS circuit to a remote site.  At the remote site is another pair of 3560's, then a pair of ASA's, and one more pair of 3560's.

I've been asked to put loopback addy's on every device, which, oddly enough, has never been requested of me before.  I have a question about where to snag the IP's from in the range provided.

IE, I've been given the 10.5.64.0/24 range to IP all of these mini subnets.

So, if I use the 10.5.64.0 /29 for the pair of 6509's (having 64.1 and .2 as the HSRP vips) and the 3560's (having IP's of 64.3 and .4 respectively), then now I have to add loopbacks to the same four devices.

My gut says to take the next four /32's of 64.9 for the first 6509, and 64.10 for the second... and 64.11 and 64.12 for the 3560's.

Then I can begin my next /29 using 10.5.64.16.

Am I missing anything obvious?  Is there an easier way to separate out one IP address at a time for the purpose of loopbacks

Thanks,
mike

[Giuseppe Larosa · Accepted solution]

Hello Mike,

usually is better to pick up loopback addresses from a dedicated block or sub-block

in your case you can pick up /32 loopbacks starting from 10.5.64.224/27

for clarity I would not mix between loopback addresses and IP subnets used at each site.

You can build a table with your loopback choices for documentation purposes

loopback addresses are also used as OSPF router-id or for other routing protocols so it is handy to use the highest sub-block for them, because it remembers that are used for this.

This is just my opinion and how I usually assign loopbacks.

Using /29 at the sites may be too small as it doesn't leave space for additional devices (2 C6500 1 VIP HSRP and 2 C3560 and there is only 1  free address left with /29) that  may be added in the near future I would use a /28 subnet mask in each site.

Hope to help

Giuseppe

[Vincenzo Errante]

it's correct

in this mode you not lose the "network" and "broadcast" address but at the same time you don't overlap nothing

regards