1.5 IPAM: build your address plan

Part 1 · FoundationsOperator⏱ ~35 min▶ Narrated video🖱 Interactive walkthrough🧪 Lab 3 (auto-checked)✓ Knowledge check

Every DNS record and DHCP lease that SpatiumDDI manages hangs off a subnet, and every subnet hangs off the address plan you build in IPAM. Build the tree well and each new VLAN costs you one form, because it picks up its DNS zone and DHCP servers from the level above. Build it badly and you pin the same settings on every subnet by hand. In this module you build Ridgeline College’s plan the way SpatiumDDI expects it.

What you’ll learn

• Tell IP spaces, blocks and subnets apart, and say which one holds addresses
• Pin DNS and DHCP settings once on a block, and read what a subnet inherits from it
• Lay out a campus with one /24 per VLAN, leaving room to grow
• Find the reverse zone SpatiumDDI creates for a new subnet, and explain why it makes one per /24

Video and walkthrough

The video builds the plan in the same order as the lab: space, block and subnet, then it finds the reverse zone SpatiumDDI created for the subnet. The walkthrough after it replays the same clicks, so you can rehearse before you touch the lab.

▶ IPAM: build your address plan · 2:23 · narrated, captions on (CC) · recorded on SpatiumDDI 1.0.0-beta.3

Chapters

1. 0:00Welcome
2. 0:17Create the IP space
3. 0:34Add the campus block
4. 0:50Pin DNS and DHCP on the block
5. 1:09Create the staff subnet
6. 1:31Explore the subnet
7. 1:46Your reverse zone is ready
8. 2:10Recap

Transcript

0:00Module 1.5: IPAM, your address plan. You'll build Ridgeline College's plan the way SpatiumDDI expects it: an IP space, an aggregate block that carries the DNS and DHCP settings, and a first subnet that inherits them.

0:17Open IPAM and create an IP space. A space is an independent address domain: subnets inside one space never overlap, but two spaces may overlap each other, much like two VRFs. Ridgeline needs just one, called Campus.

0:34Select the space and add a block: 10.20.0.0/16, the whole campus. Blocks are aggregates. They never hold addresses themselves; they give the tree its shape and carry settings down to everything beneath them.

0:50This is where Ridgeline pins its services. On the DNS tab, stop inheriting, then choose the default server group and the corp.example.edu zone. On the DHCP tab, do the same with the default DHCP group. Every subnet created under this block will inherit both.

1:09Now the first subnet: 10.20.21.0/24, named “Staff VLAN 21”, following Ridgeline's convention of one /24 per VLAN. The gateway is assigned automatically. On the DNS tab, inherit stays on, and the form shows exactly what the subnet inherits from the block.

1:31Open the new subnet. Its address table already marks the network, gateway and broadcast addresses, and the tabs across the top will hold DHCP pools, aliases, NAT and utilization trends as the network grows.

1:46Reverse lookups, from address back to name, need a reverse zone, and you don't have to make this one. When you saved the subnet, SpatiumDDI created 21.20.10.in-addr.arpa in the block's DNS group, because the subnet inherits a DNS group and zone from the block. Every /24 you add under the block gets its own reverse zone the same way.

2:10Ridgeline's address plan now has a space, a campus block with its services pinned, a staff subnet that inherits them, and the subnet's reverse zone. Next, you'll hand out addresses with DHCP.

▶ Try it yourself · 28 steps

Nice work — walkthrough complete.
Now do it for real in the lab below.

↺ Replay

← Back

Skip →

The IPAM tree

IPAM is a strict containment tree. Each level lives inside the one above it, and only subnets hold addresses, so you build it from the top down.

Each level contains the one below it; addresses attach only to subnets · Adapted from the SpatiumDDI documentation (Apache-2.0)

Level	Ridgeline’s	Holds addresses?	What it’s for
IP space	Campus	No	An independent address domain
Block	10.20.0.0/16 “Ridgeline campus”	No	Shape, and settings its children inherit
Subnet	10.20.21.0/24 “Staff VLAN 21”	Yes	A routable network with a gateway
Address	10.20.21.10 print-01 (module 1.7)	—	One IP for one device

IP spaces

An IP space is an independent address domain. Subnets inside one space can never overlap, but two spaces may overlap each other, much like two VRFs. That makes a space the right home for anything that reuses address space: a partner network, an acquired site, a lab that copies production.

• Most organizations need one or two spaces. Ridgeline needs one, Campus.
• A space can pin default DNS and DHCP groups for everything below it. Ridgeline pins nothing on the space and pins at the block instead, so a future block, such as a second campus, can use different servers.
• The VRF picker on the space’s Networking tab is an annotation that address allocation doesn’t consult. The space itself is what keeps overlapping addresses apart.
• Overlapping spaces also need their own DNS and DHCP server groups; see the IPAM tips.

Blocks

A block is an aggregate, such as 10.20.0.0/16 for the whole campus. It never holds addresses itself. It gives the tree its shape and carries settings down to everything beneath it: the DNS server group, the primary zone, the DHCP server group, custom fields and tags.

• Blocks nest: a /16 can sit inside a /8, and a child block must fit entirely inside its parent.
• Sibling blocks in the same space can’t overlap.
• A block’s utilization is rolled up from the subnets beneath it.

Getting Started calls blocks optional, but the New Subnet form needs one. In a space without blocks, it tells you “No blocks in this space. Create a block first.”

Subnets

A subnet is a routable network with a gateway, and the only level that holds addresses. It’s also where DHCP scopes attach (module 1.6). Two subnets in one space can’t overlap, whichever block they sit under, and a subnet must fit inside its block.

When you create a subnet, SpatiumDDI fills in the basics:

• Gateway. Leave the field blank (“Auto-assigned if blank”) and the first usable address, 10.20.21.1, becomes the gateway: a reserved row with the hostname gateway. You can move it, or delete it on a transit link that has none.
• Placeholder rows. The network (10.20.21.0) and broadcast (10.20.21.255) addresses appear in the address table as rows you can’t edit or allocate. /31 and /32 subnets get none (RFC 3021), and Skip network / broadcast / gateway records (loopback, P2P) leaves all three out.
• Network role. Data, Voice and the other roles are metadata for filters and voice-VLAN checks. They don’t change how DNS or DHCP behave.

Between the rows, the address table draws green free-range rows that show each unallocated range and how many addresses it holds; click one to allocate from it (module 1.7). The Hide network/broadcast and Hide free ranges boxes above the table change only what you see, not what’s allocated.

The subnet’s tabs fill up as the network grows: IP Addresses, DHCP Pools, Aliases, Address Sets and Trend (utilization over time). A NAT tab joins them when the NAT mappings feature is turned on in Features & Integrations; a new install has it off.

Caution

Check the CIDR before you click Create. You can grow a subnet later, but you can’t shrink it or move it: a mistyped subnet has to be deleted and created again.

Inheritance: pin once on the block

The DNS and DHCP tabs of a block or subnet each have an Inherit from parent box, ticked by default. When it’s ticked, the object uses whatever the nearest ancestor pins. When you untick it, you pin the value on this object. DNS and DHCP inherit independently, so a subnet can inherit DNS and still use its own DHCP group.

Ridgeline unticks both boxes on the block and pins its services there. Staff VLAN 21 keeps both boxes ticked, and its DNS tab shows what it inherits:

Setting	Where it’s set	What Staff VLAN 21 uses
DNS server group	Block 10.20.0.0/16	default
Primary DNS zone	Block 10.20.0.0/16	corp.example.edu
DHCP server group	Block 10.20.0.0/16	default
Reverse zone	Created when the subnet is saved, in the inherited DNS group	21.20.10.in-addr.arpa

Every future VLAN subnet under the block gets the same three bindings, plus its own reverse zone, with no extra work. A quick test of your design: could someone create the next subnet knowing only its CIDR and its name? At Ridgeline, yes.

How SpatiumDDI resolves an inherited value

When SpatiumDDI needs a subnet’s effective DNS or DHCP settings, it starts at the subnet, walks up through the parent blocks, and stops at the first level whose Inherit from parent box is unticked; the space is the root of the chain. DNS and DHCP walk separately, and the subnet’s DDNS settings follow the same pattern with their own inherit flag. Because the value is looked up rather than copied, a subnet you add under the block next year inherits whatever the block pins then.

Plan before you click

A written plan beats improvising in the create form. Ridgeline’s rule is one /24 per VLAN, numbered 10.20.<VLAN>.0/24, so Staff VLAN 21 is 10.20.21.0/24.

• The address names the VLAN. Anyone who reads 10.20.21.37 in a log knows it’s on VLAN 21. The third octet stops at 255, so the convention covers VLAN IDs up to 255; plan another block for higher IDs.
• Leave room to grow. Resize only grows a subnet, and the larger CIDR must contain the old one, fit inside the block and overlap nothing. The smallest step up for 10.20.21.0/24 is 10.20.20.0/23, which takes VLAN 20’s slot. Decide early which VLANs might outgrow a /24, and keep their neighbors free.
• Give every subnet the same internal layout, so operators know where to look:

Range	Ridgeline uses it for	Module
.1	The gateway, reserved automatically	1.5
.1–.9	Network infrastructure, excluded from DHCP	1.6
.10–.99	Fixed addresses: print-01 (.10), cam-01 (.20), lab PCs (.30–.39)	1.7, 1.8
.100–.199	The DHCP dynamic pool for staff laptops	1.6
.200–.254	Unassigned, left for growth	—

For larger designs, the Subnet Planner (in the sidebar, under IPAM) lets you draft a whole tree and apply it in one transaction.

Reverse zones

Reverse lookups, from an address back to a name, need a reverse zone. Its name is the network’s octets reversed under in-addr.arpa: 21.20.10.in-addr.arpa covers only 10.20.21.0/24, while 20.10.in-addr.arpa covers all of 10.20.0.0/16. Reverse zones split cleanly only on octet boundaries (/8, /16 and /24).

You don’t create Ridgeline’s reverse zones by hand. When you save a subnet that has an effective DNS group, its own or one inherited from a block or space, SpatiumDDI creates the matching reverse zone in that group and links it to the subnet. Staff VLAN 21 inherits default from the block, so saving it creates 21.20.10.in-addr.arpa. In the same save, SpatiumDDI publishes the gateway’s PTR record: 10.20.21.1 → gateway.corp.example.edu. The rules behind it:

• One zone per /24 the subnet spans. A /24 gets its own zone, a /25 shares its /24’s zone with its neighbors, and a /23 gets two. SpatiumDDI never creates one enclosing zone such as 20.10.in-addr.arpa, because that would make it answer for addresses outside the subnet. Growing a subnet with Resize… adds the zones for the new range. Subnets of /16 or wider get one zone per /16 (or /8) they contain.
• The most specific zone gets each PTR. For each address, SpatiumDDI writes the PTR record into the most specific reverse zone in the subnet’s DNS group that covers it. A zone you create yourself works too, but a hand-made 20.10.in-addr.arpa gets no PTR records from a subnet that has its own 21.20.10.in-addr.arpa.
• The zone goes where the subnet goes. Moving a subnet to Trash takes its reverse zones with it, unless another subnet still uses one (module 2.4).
• The opt-out is API-only. To create a subnet without a reverse zone, set skip_reverse_zone when you create it through the API. SpatiumDDI stores the choice on the subnet, so later allocations don’t create the zone either.

Don't wait for a reverse-zone prompt

DNS features §4 says the UI asks “Auto-create reverse zone for …?” when you create a subnet. In 1.0.0-beta.3 nothing asks, and the New Subnet form has no opt-out: the zone appears as soon as you save. To check, open DNS → the group → Zones.

Source: Verified in the Academy lab, 1.0.0-beta.3

Upgrading from 2026.09.04-1?

A subnet that inherits its DNS gets its own reverse zone on its next allocation or Sync DNS (#1149), even where a zone you made by hand, such as 20.10.in-addr.arpa, already covers it. From then on its PTR records go into the new, more specific zone, so run Sync → DNS on the subnet and review what it proposes.

Hands-on lab

Hands-on lab 3 · about 20 min

Build Ridgeline's address plan

You will:

• Create the Campus IP space
• Create the 10.20.0.0/16 block with the default DNS group, the corp.example.edu zone and the default DHCP group pinned
• Create Staff VLAN 21 under the block, inheriting all three
• Find the reverse zone 21.20.10.in-addr.arpa that SpatiumDDI created for the subnet, and check that BIND9 serves it

Before you start: Lab 2 is done: the zone corp.example.edu exists in the DNS group default.

1. Open IPAM and click New IP Space (the + in the tree header). Enter the Name Campus and the Description “Ridgeline College campus network”, then click Create.

2. Select Campus and click Add block. In New IP Block, enter the Network (CIDR) 10.20.0.0/16 and the Name Ridgeline campus.

3. Open the DNS tab and untick Inherit from parent. Choose the DNS Server Group default and the Primary Zone corp.example.edu..

4. Open the DHCP tab, untick Inherit from parent and choose the DHCP Server Group default. Click Create Block.

5. Select 10.20.0.0/16 in the tree and click New Subnet. Enter the Network (CIDR) 10.20.21.0/24 and the Name Staff VLAN 21, leave Gateway blank, and set Network role to Data.

6. Open the DNS tab and leave Inherit from parent ticked. It reads “Inheriting from parent: 1 group(s), zone: corp.example.edu.” Click Create.

7. Open 10.20.21.0/24 in the tree. Check that the address table already has rows for the network, the gateway (10.20.21.1) and the broadcast address. The gateway row’s DNS column reads forward DNS skipped: the gateway gets a PTR record but no A record (module 1.7).

8. Go to DNS, open the default group and its Zones tab, and find 21.20.10.in-addr.arpa. SpatiumDDI created it when you saved the subnet; you don’t add a reverse zone yourself.

9. In a terminal, check that BIND9 serves the zone and the gateway’s PTR record. Expect a single SOA line, then gateway.corp.example.edu.; if an answer is empty, wait a few seconds and run it again.

   dig @127.0.0.1 -p 1053 21.20.10.in-addr.arpa SOA +short
   dig @127.0.0.1 -p 1053 +short -x 10.20.21.1

✅ Check your work from the course folder:./lab/check.sh 3Copy

I finished this lab and the checks pass

Knowledge check

Knowledge check · 6 questions

IPAM: build your address plan

1. Ridgeline takes on a partner network that also uses 10.20.0.0/16. How do you record both without a conflict?

Put both in Campus, each under its own blockGive one of the two subnets a different nameYou can't: every CIDR must be unique platform-widePut the partner's ranges in their own IP space

An IP space is a separate address domain, like a VRF. Subnets can't overlap within a space but may overlap across spaces. Overlapping spaces also need their own DNS and DHCP server groups: one group can't hold two identically named reverse zones or serve the same prefix twice.

2. What's the block 10.20.0.0/16 "Ridgeline campus" for?

It's where you allocate the campus's individual host addressesIt groups the per-VLAN subnets and holds the DNS and DHCP settings they inheritIt's the DHCP scope that serves the whole campus networkIt's a label for the tree's layout and has no effect on any of the subnets below it

Ridgeline pins the default DNS group, the zone corp.example.edu and the default DHCP group on this block. Blocks give the tree its shape and own inherited settings. You can't assign IPs to a block directly; addresses live in subnets. Pinning the groups and zone once on the block means no 10.20.<VLAN>.0/24 subnet under it needs its own pinning.

3. You create 10.20.21.0/24 "Staff VLAN 21" under the block and leave the DNS and DHCP tabs on Inherit from parent. Which settings does the subnet use?

None, until you pin groups on the subnet itselfThe first DNS and DHCP groups created on the platformThe block's DNS group, zone and DHCP groupWhatever the IP space pins, skipping the block

Bindings inherit subnet → block → space: an unset value means inherit, and resolution walks up to the first ancestor that sets one. DNS and DHCP inherit independently, so a subnet can inherit DNS while pinning a different DHCP group.

4. Staff VLAN 21 is created with Inherit from parent left ticked, so its DNS group and zone both come from the campus block. Which reverse zone does SpatiumDDI create for it automatically?

21.20.10.in-addr.arpa, as soon as the subnet is saved20.10.in-addr.arpa, because the block's zone covers the whole /16None: SpatiumDDI creates reverse zones only for subnets that pin their own DNS zone, so you create one yourself10.in-addr.arpa, the first time an address in the subnet is allocated

A subnet that inherits its DNS gets its reverse zone when it's saved, in the inherited DNS group. SpatiumDDI makes one zone per /24 the subnet spans, never one enclosing zone such as 20.10.in-addr.arpa that would also claim addresses outside the subnet. So 10.20.21.0/24 gets 21.20.10.in-addr.arpa, and the gateway's PTR record is published into it in the same save. The only opt-out is skip_reverse_zone in the API.

5. In a brand-new space, the New Subnet form warns "No blocks in this space. Create a block first." What does that tell you?

The IP space is damaged and needs restoring from TrashYou need a DHCP scope before you can create a subnetSubnets live under blocks, so create 10.20.0.0/16 firstThe IPAM feature module is switched off for this space

Block is a required field on the subnet form, and the subnet must fit inside that block. Build the tree top-down: space → block → subnet.

6. Select all the true statements about IP blocks.

Select all that apply.

You can assign individual IPs directly to a blockA child block must fit entirely inside its parent blockTwo sibling blocks in the same space may overlapBlocks can be nested, for example a /16 inside a /8

Blocks nest, and a child must be fully contained in its parent. Sibling blocks in the same space can't overlap. Blocks exist for grouping and inheritance: addresses are allocated in subnets, never directly in a block.

Check answers

Go deeper

• IPAM features: the hierarchy (§1), gateway auto-assignment and inheritance (§11), and the rules the API enforces (§16)
• Getting Started, steps 4 and 6–8: the official Ridgeline walk-through, including the automatic reverse zone (it sets the primary zone on the subnet; the course inherits it from the block)
• DNS features §4: zones, reverse zones, one zone per /24, and how zones bind to subnets
• GitHub issues #1149 (inheriting subnets get their reverse zone), #1150 (the gateway PTR at creation) and #1840 (one zone per /24)
• Data model: the IPAM tables and how they relate
• Tips and tricks: IPAM: inheritance, overlapping spaces and the gateway row

Finished 1.5 IPAM address plan?

Mark it complete to track your progress (stored only in this browser).

Mark complete