Networknetwork-coresubnet
I know that routers are used to divide the networks but i am confused to check the number of networks in the following diagram. Does the switches that are in the green color is a seperate subnetwork? or they belong to the same subnetwork of network marked in red color? please help thanks
Your "question" is actually a series of questions. For future reference, try to avoid this. :-) However, this question is a good one, and I think is an easy enough mistake to make by newcomers to the field, so I'll do my best to answer. Truth be told, your source of confusion has nothing to do with subnetting and everything to do with the show ip route output itself (and understandably so).
172 is a class B network (/16). So that means 172.16.0.0/24 is already subnetted, since clearly /24 is greater than /16.
First things first - classful addressing and routing has been dead a long time. I understand that it's still part of networking curriculums though, so do yourself a favor and forget everything classful as soon as you're done with your coursework. IMO, still forcing people to learn about these topics only serves to confuse.
Secondly, the prefix length (subnet mask) has nothing to do with the class of the address. See this answer for more information on how classful addressing actually works (and for a hint at the answer to your very last question).
Now in the image it says 172.16.0.0/24 has two subnets: 172.16.1.0 and 172.16.2.0. But to me that seems weird, because when you subnet, the subnets have to be a subnetwork of the original network, right? But clearly 172.16.1.0 and 172.16.2.0 isn't in 172.16.0.0/24 since the range would be 172.16.0.0 - 172.16.0.255.
Like I said before, this has nothing to do with subnetting and everything to do with the structure of the output of show ip route.
Way back when, when IOS first came around, there was classful addressing and routing, as you're being taught currently. The structure of the routing table back then was designed with classful routing in mind, and was hierarchical and had (and still has) many levels. When classless addressing and routing came around, the hierarchical structure of the routing table still worked, so it really hasn't changed much.
Ultimately the real answer lies in a textbook (one of my favorites) called Cisco IP Routing by Alex Zinin. Quote below, emphasis mine:
The subnet mask displayed with the parent network route is not the real subnet mask stored in the route entry but rather is the mask used for all subnets in the network. The subnet mask is not shown for each subnet only when all child routes have the same mask; that is, VLSM is not used. If more than one subnet mask is used in a major network, each subnet route is augmented with a specific route mask, and the major network is shown with the classful mask.
So in other words, show ip route output can be somewhat misleading given the right circumstances. Relating back to your output, the major network boundary or classful boundary for the 172.16.1.0/24 subnet is 172.16.0.0. Since all of your subnets of 172.16.0.0 have a /24 length, the show ip route output is really just telling you that it knows about the 172.16.0.0 classful network, and all of the subnetworks that it knows about for this major network have the same length, and that is /24.
Try adding a network to the routing table that's part of 172.16.0.0 and which has a "non-classful" length, such as a /27 or /25. What happens?
Also, one thing I don't understand is how the router knows the original network (in this case 172.16.0.0/24) when only the subnets are given. How does it figure this out?
Again, I'll urge you to read the previous answer which I'd linked, if this isn't already clear at this point. :-)
EDIT: To answer some further questions OP has in comments:
I'm confused about excercise 1 on 9tut.com/subnetting-tutorial/2. When I subnet I'm used to be given a network address like 4.0.0.0/24 and I would borrow host bits to create subnets. But in excercise 1 they figure out the major network boundary 4.0.0.0/8 and assume that all other class A networks are subnets to that major network boundary. Can you confirm this is correct? It confuses me because you told me that the classful boundary is rarely used these days, so I get the idea that this might be an old/obsolete way to think about subnetting.
It basically is an old way to look at subnetting. Determining the class of address is not needed to determine the number of subnets and hosts per subnet available. The question is worded poorly, and in the real world no one is going to be "assigned" an arbitrary prefix without a length attached to it, ie 4.0.0.0. You could easily find a different answer given the parameters of a /24 prefix length to be used for subnetting if they had given you any prefix length that was shorter than a /24, it doesn't necessarily have to be /8. It's likely that the exercise was worded in such a way to force the reader to remember the classes of addresses in order to answer it correctly.
To make my question a bit clearer, I'm going to give an example. Take a look back at the picture in my original question. The IP routing table says that 172.16.0.0/24 is subnetted and has 2 subnets. It seems the IP routing table also treats 172.16.1.0/24 and 172.16.2.0/24 as subnets because they are in the range of the major classful network 172.16.0.0/16 (i.e. 172.16.0.0 - 172.16.255.255). So this is probably how the routing table looks at subnets, correct?
Yes. Again, the internal structure of the routing table really hasn't changed since the days of classful routing. Anything that's viewed as a subnet of a classful network is going to be viewed as a subnet by the router.
One last thing: if I subnet a network address, I can always get this network back by supernetting the subnets, correct? This is then the answer to my last question my original post.
No, it isn't. Determining your major network or classful network boundary has nothing to do with subnetting or supernetting. It really isn't complicated.
Here's three examples of IP addresses with varying mask lengths:
For #1:
The address is Class A because the first octet is 115, and this falls within the range of numbers that have a leading bit of 0 (0 to 127). The natural mask for Class A networks is 255.0.0.0. So the classful network boundary is 115.0.0.0/8.
For #2:
The address is Class C because the first octet is 200, and this falls within the range of numbers that have leading bits of 110 (192 to 223). The natural mask for Class C networks is 255.255.255.0. So the classful network boundary is 200.200.200.0/24.
For #3:
The address is Class B because the first octet is 188, and this falls within the range of numbers that have leading bits of 10 (128 to 191). The natural mask for Class B networks is 255.255.0.0. So the classful network boundary is 188.154.0.0/16.
This is how the router is able to determine the classful network boundary of any subnet.
First all first you should define the policy of your segmentation, starting by defining broadcast domains (ie. VLANs and related subnets) you want to have. In corporate networks, the most diffused reference is the PCI DSS: https://www.pcisecuritystandards.org/documents/PCI_DSS_v3.pdf#page11
Anyway, you probably don't need a such formal and strict approach, but still need to define what networks you want to have and how they can communicate between each others.
If I'm reading your question correctly, you want:
I can't say if you're over engineering or not without knowledge of your environment, anyway I think it can be pretty complex for most small networks. For instance, a specific network used for printers only, might be an over engineering, but let's say it will scale easily in case of a new DB/file/web/whatever server. On a side note, restricting specific users to access the printer is something I'd manage through authentication rather than with network security.
Also, by looking at your schema, the 802.1Q switch connected to your Peplink seems the only point where these networks meet, with the only exclusion of the phone (voip). If so, (excluding phones) you don't need VLANs that spread into multiple switches making stuff like STP less efficient, you just need a router/firewall.
VLANs are useful when you want an engineer connected to one of the ports of the switch on the left (public), and someone from the office in one of the 2 switches at the bottom (that seems assigned to engineering in the schema), for instance.
In other words, if I'm understanding your requirements properly, why don't you put a firewall with 5 interfaces where you drew the 802.1q switch , putting the VoIP server and the printers in the server LAN? On the firewall you can define the communication policies between these networks than.
Worth to note that VoIP traffic is usually NOT encrypted, if you're concerned about sniffing of calls from office and engineering this solution might not be the best choice.
Finally, in order to balance the WAN traffic many technologies exists to drive Public network out of a specific link; I don't know Peplink honestly, but with Cisco you can use source/policy routing for instance.
Best Answer
Considering that we do not deal with VLAN that adds a layer in the graph, but with a basic configuration (no sub interface, ...) the red area is related to a single subnetwork/network. In fact the right term is broadcast domain (and not sub/network). That is the switch (I mean L2 only switch) is not aware of IP addresses and the switch is achieved by only looking at the ethernet header (ie. a map between the destination MAC addresse and the outgoing interface).
Therefore, considering the figure you provided and the captions (core, distribution, access) that seems to define a network hierarchy, the left interface of the "core" router may has a configured IP address (eg. 192.168.1.1/24) and all computers/servers directly connected to the switches in the red area (connected to the left interface of router) will belong to the same subnet (192.168.1.0/24).