IP Address Management (IPAM): A CCNA-Focused Guide

June 8, 2026 10 min read Networking Deep Dives

networkingipamccnasubnettingvlsmdhcpipv6dns

Contents

IP Address Management is the unglamorous discipline that keeps a network from collapsing into a pile of address conflicts: planning your address space, allocating subnets to sites and VLANs, tracking what is assigned to what, and reclaiming space when it’s freed. The CCNA exam never asks you to log into Infoblox or NetBox — but it tests, heavily, every single building block that IPAM is built from. The largest domain on the 200-301 blueprint, IP Connectivity at 25%, is essentially “can you manage addresses,” and the IP Services domain layers DHCP and DNS on top. So the fastest way to both pass the exam and understand what a senior network engineer actually does all day is to learn the fundamentals through the lens of how address space is really managed. That is what this guide does: it teaches subnetting, VLSM, DHCP, DNS, and IPv6 the way the exam expects, then shows how those concepts scale up into the tools that run them in production.

What IPAM actually is

IPAM is one leg of a three-legged stool that the industry calls DDI — DNS, DHCP, and IPAM — the three services that together govern how devices get addresses and names:

IPAM — the authoritative record of which address blocks exist, how they’re subnetted, and what’s allocated. The “source of truth” for address space.
DHCP — the service that hands out addresses dynamically to hosts.
DNS — the service that maps human-readable names to those addresses.

A small shop runs all three out of a spreadsheet and a Cisco router. A large enterprise runs them on an integrated platform. But the underlying questions are identical at every scale: What address space do I own? How do I carve it up without waste or overlap? How do hosts get addresses? How do names resolve to them? The CCNA answers all four with fundamentals; IPAM tools just automate the bookkeeping.

The address space you manage: IPv4 and RFC 1918

An IPv4 address is 32 bits, written as four dotted octets (e.g. 192.168.10.25), split into a network portion and a host portion by the subnet mask. The old classful system (Class A/B/C) is dead for allocation purposes — modern networks are classless (CIDR), where a /n prefix states exactly how many leading bits are network. You will still see “class” referenced on the exam as legacy context, but you allocate with prefixes.

Most of what you manage internally is private address space (RFC 1918), which is not routable on the public internet and is reused freely behind NAT:

Range	CIDR	Size	Typical use
10.0.0.0 – 10.255.255.255	10.0.0.0/8	~16.7M addrs	Large enterprises, data centers
172.16.0.0 – 172.31.255.255	172.16.0.0/12	~1M addrs	Mid-size networks
192.168.0.0 – 192.168.255.255	192.168.0.0/16	65,536 addrs	Home/SMB, labs

Two more ranges worth knowing for the exam: 169.254.0.0/16 (APIPA/link-local — what a host self-assigns when DHCP fails) and 127.0.0.0/8 (loopback). The reason IPAM exists at all is that public IPv4 is exhausted and even private space must be spent carefully in a large organization — overlap between two sites that later need to merge or VPN is a genuinely painful, common failure.

Subnetting: the core CCNA skill

Subnetting is dividing a network into smaller networks by borrowing host bits to make more network bits. The exam wants you to compute, in under a minute, the network address, broadcast address, usable host range, and mask for any given address and prefix. Memorize this table — it is the single highest-leverage thing on the IP Connectivity domain:

Prefix	Subnet mask	Block size	Total addrs	Usable hosts
/24	255.255.255.0	256	256	254
/25	255.255.255.128	128	128	126
/26	255.255.255.192	64	64	62
/27	255.255.255.224	32	32	30
/28	255.255.255.240	16	16	14
/29	255.255.255.248	8	8	6
/30	255.255.255.252	4	4	2

Two rules drive every calculation. Usable hosts = 2^(host bits) − 2 (subtracting the network and broadcast addresses). And the block size = 256 − (the interesting mask octet), which tells you how far apart consecutive subnets fall.

Worked example: in what subnet does 192.168.10.100/26 live? A /26 has block size 256 − 192 = 64, so subnets start at .0, .64, .128, .192. .100 falls in the .64 block. Therefore: network 192.168.10.64, broadcast 192.168.10.127 (next block minus one), usable .65–.126, mask 255.255.255.192. That entire computation should take you fifteen seconds by exam day.

A note on the edges: /31 (RFC 3021) is valid for point-to-point links — both addresses are usable, no waste on a two-host WAN link — and /32 is a single host route (often a loopback). Cisco IOS supports /31 on point-to-point interfaces.

VLSM: allocating space without waste

Fixed-size subnetting wastes enormous space — a point-to-point link does not need 254 hosts. Variable Length Subnet Masking (VLSM) lets you carve a block into right-sized pieces by applying different masks to different subnets. The one rule that makes VLSM work cleanly: allocate largest-first. Sort your requirements by host count descending, then assign each the smallest subnet that fits, walking up the address space.

Carve 192.168.10.0/24 for a small site:

Segment	Hosts needed	Subnet	Mask	Range	Broadcast
LAN A (users)	100	192.168.10.0/25	/25	.1–.126	.127
LAN B (voice)	50	192.168.10.128/26	/26	.129–.190	.191
LAN C (servers)	25	192.168.10.192/27	/27	.193–.222	.223
LAN D (mgmt)	10	192.168.10.224/28	/28	.225–.238	.239
WAN link 1	2	192.168.10.240/30	/30	.241–.242	.243
WAN link 2	2	192.168.10.244/30	/30	.245–.246	.247

192.168.10.0/24 carved with VLSM
.0        .128      .192   .224  .240 .244 .248       .255
|  LAN A   |  LAN B  | LAN C| LAN D| W1 | W2 | (free)   |
|  /25     |  /26    | /27  | /28  |/30 |/30 |          |
| 126 host | 62 host |30 hst|14 hst| 2  | 2  | .248-.255|

Notice that .248–.255 remains free for future growth — that headroom is deliberate. Had you allocated smallest-first or used fixed /27s everywhere, you’d have fragmented the space and run out. This “allocate largest-first, leave summarizable gaps” instinct is exactly what an IPAM tool enforces automatically, and exactly what the exam tests by hand.

DHCP: dynamic allocation and the DORA process

Static addressing every host doesn’t scale; DHCP leases addresses automatically. The exam wants the DORA exchange cold:

CLIENT                         SERVER
  | --- DHCPDISCOVER (broadcast) --> |   "anyone got an address?"
  | <-- DHCPOFFER ------------------ |   "you can have 192.168.10.50"
  | --- DHCPREQUEST (broadcast) ---> |   "I'll take it"
  | <-- DHCPACK -------------------- |   "it's yours, here's the lease"

A Cisco router or L3 switch makes a perfectly good DHCP server. Reserve the static range first, then define a pool:

ip dhcp excluded-address 192.168.10.1 192.168.10.10
!
ip dhcp pool LAN_A
 network 192.168.10.0 255.255.255.128
 default-router 192.168.10.1
 dns-server 192.168.10.5
 domain-name corp.example.com
 lease 7

The exam’s favorite DHCP gotcha is cross-subnet relay. DHCPDISCOVER is a broadcast, and routers don’t forward broadcasts — so a client on a remote subnet can’t reach a central DHCP server by default. The fix is ip helper-address on the client-facing interface, which converts the broadcast into a unicast aimed at the server:

interface GigabitEthernet0/1
 ip address 10.20.30.1 255.255.255.0
 ip helper-address 192.168.10.5

Verify with show ip dhcp binding (active leases), show ip dhcp pool (utilization), and show ip interface brief. Knowing that ip helper-address lives on the remote client subnet’s gateway, not next to the server, is a classic exam discriminator.

DNS: names to addresses

DNS is the other half of IP Services. For CCNA you need the common record types and how a query resolves (a host asks a recursive resolver, which walks the authoritative hierarchy iteratively):

A — name → IPv4 address.
AAAA — name → IPv6 address.
CNAME — an alias pointing one name at another.
PTR — reverse lookup, IP → name (lives in the reverse zone).

The IPAM connection is direct: forward and reverse DNS records should stay in lockstep with your address allocations, which is precisely why integrated DDI platforms manage all three together — allocate an address in IPAM and the A and PTR records are created automatically, eliminating the stale-record drift that plagues manual setups.

IPv6: the addressing CCNA now demands

IPv6 is a full domain expectation now, and IPAM changes character with a 128-bit address. You manage prefixes, not individual hosts — the space is so vast that conservation stops mattering and clean hierarchy starts mattering more. Know these:

Global unicast (GUA) — 2000::/3, publicly routable, the IPv6 equivalent of a public IPv4.
Link-local — fe80::/10, auto-configured on every interface, valid only on that link (used by routing protocols and neighbor discovery).
Unique local (ULA) — fc00::/7, the rough IPv6 analog of RFC 1918 private space.
Abbreviation rules — drop leading zeros in each hextet, and replace one run of consecutive all-zero hextets with ::. So 2001:0db8:0000:0000:0000:0000:0000:0001 becomes 2001:db8::1.

Two host-addressing mechanisms the exam contrasts:

SLAAC (Stateless Address Autoconfiguration) — the host learns the /64 prefix from a router advertisement and generates its own interface ID, often via EUI-64: split the 48-bit MAC, insert fffe in the middle, and flip the 7th bit (the U/L bit). No server needed.
DHCPv6 — stateful assignment from a server, like IPv4 DHCP, when you want central control and tracking.

The IPAM takeaway: with IPv6 you stop counting hosts and start designing a prefix hierarchy (a /48 per site, /64 per subnet is the standard), because the discipline shifts from rationing scarce addresses to keeping an enormous space navigable and summarizable.

How IPAM is done in practice

CCNA teaches the math; production turns it into tooling. There is a clear maturity ladder, and choosing the right rung is mostly about scale and budget.

Approach	Examples	Strengths	Watch-outs
Spreadsheet	Excel, Google Sheets	Free, zero setup	Goes stale instantly; no conflict detection; doesn’t scale past one person
Open-source IPAM	phpIPAM, NetBox	Free, real tracking, APIs, automation	Needs Linux/DB skills to run; you self-support
Standalone commercial	SolarWinds IPAM, ManageEngine OpUtils	Discovery, alerting, easier deploy	Low-four-figure+ licensing
Full DDI platform	Infoblox, BlueCat, EfficientIP	Authoritative DNS+DHCP+IPAM integrated	Enterprise pricing ($12k–14k+/yr); pro-services deploy

Two tools dominate the conversation. NetBox has become the de-facto open-source “source of truth,” modeling not just addresses but the relationships between VRFs, VLANs, prefixes, and interfaces — it documents the network as data, which is why automation pipelines build on it. Infoblox leads the enterprise DDI market (though its mindshare has slipped recently as NetBox and others rise), bundling authoritative DNS and DHCP with IPAM so allocations, leases, and records never drift apart. The honest framing: a spreadsheet is fine until your second engineer or your second site, phpIPAM/NetBox is the right answer for most organizations, and full DDI is what you buy when DNS/DHCP/IPAM consistency is mission-critical and you can fund it.

The single most important practice, regardless of tier, is the one VLSM already hinted at: allocate hierarchically and summarizably. Give each site a contiguous block, align subnets to VLANs (see network segmentation with VLANs), reserve growth room, and document every assignment in one authoritative place. A tidy, summarized address plan keeps routing tables small and merges painless; a sprawl of ad-hoc subnets does the opposite.

Verdict

IPAM is where CCNA theory meets the job. The exam won’t quiz you on NetBox screens, but it will absolutely demand that you subnet and VLSM under time pressure, recite the DORA process, configure a Cisco DHCP pool and know that ip helper-address belongs on the remote client subnet, distinguish A/AAAA/CNAME/PTR records, and read an IPv6 global-unicast or link-local address and explain SLAAC versus DHCPv6. Master those fundamentals and you’ve simultaneously earned the 25% IP Connectivity domain and learned what every IPAM tool is actually doing under the hood. Then, in the real world, stop managing addresses in a spreadsheet the moment a second person needs to: reach for phpIPAM or NetBox as your source of truth, step up to Infoblox-class DDI when DNS/DHCP/IPAM consistency becomes critical, and above all allocate your space hierarchically and largest-first so it stays summarizable as you grow. The math is the foundation; the tooling is just disciplined bookkeeping on top of it.