What would be best practice in terms of creating a network to satisfy three separate businesses located in one building?

The building in question has three floors, each floor has 25 workstations and 2 printers.

The building itself has only one external IP address. My current plan is a backbone from router which has 4 interfaces going to a switch on each floor located in the server room on each floor, a firewall would separate the router and switch ensuring that each business cant access another businesses devices.

Could I assign each interface on the router as follows:

  1. Ground floor:
  2. First floor:
  3. Second floor:

Range for devices on ground floor:

Range for devices on first floor:

Range for devices on first floor:

Is this the correct way of going about this?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Dec 14, 2019 at 18:33

2 Answers 2


Your plan seems sound (from a high level view). You can use almost any addressing scheme that makes sense to you, as long as you can summarize each business' block of IPs. If a business spans more than one floor, your scheme will not work.

Instead of assigning ranges by floor, assign a unique block for each business. That will make firewalling much easier.


You can make use of Vlans and separate each business that way.

I would recommend not to use the router but instead use a Layer3 switch for better performance routing of the packets between the floor.

Leave the router for the main connection to the ISP. The router can do the nat/pat translations.

The switches placed on each floor need only be access (Layer2) switches only. The businesses can span all floors that way and secure from each other.

For example:

Vlan 999 for switch/router/wireless/etc management, it's SVI can be created on the core switch and have an ACL in place to deny/allow access as required.

Vlan X for Business 1, it's SVI on the core switch once again has an ACL as required.

Vlan Y for Business 2, It's SVI on the core switch also has another ACL.

Vlan Z for the printers, the SVI on the core switch will allow all required business to print to the few printers.

Vlan W for the wireless clients, that could be a bit more interesting, will you have one SSID for the whole building and guests or will it be multiple SSIDs with one per business?

And more Vlans as per your design :-)

Let us know how you go with your planning.

For a bit more complex business segregation you could also use vrf-lite, but that's a bit more complex though it still requires vlans on the switches and their respective SVIs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.