Address Space and Lifecycle
Site summary blocks, bootstrap ranges, final-address transitions, and reserved network space for Site A and Site B.
The address plan separates sites first, then divides each site summary into
purpose-built VLAN subnets. Bootstrap ranges are temporary recovery networks;
all target endpoints move to final 10.10.x or 10.20.x addresses before their
site migration is complete.
Allocation Hierarchy
| Scope | Prefix | Status and use |
|---|---|---|
| Site A | 10.10.0.0/16 | Final Site A summary; active target design |
| Site B | 10.20.0.0/16 | Final Site B summary; campaign parked |
| WireGuard transit | 10.255.0.0/24 | Reserved for the future routed inter-site tunnel |
| Site A bootstrap | 192.168.0.0/23 | Live upstream/recovery network during the Site A campaign |
| Site B bootstrap | 192.168.16.0/24 | Existing Site B bootstrap network |
Site Summaries Must Not Overlap
Never stretch Layer 2 between sites. Site A and Site B keep independent address space and route only approved traffic through WireGuard.
Site A Address Lifecycle
Site A is moving from a flat UCG-backed bootstrap network to the final OPNsense-backed VLANs. XG6 p4 services one management or IPMI endpoint at a time; the three target XG10 switches never attach to the bootstrap network.
| Endpoint | Bootstrap management | Bootstrap IPMI | Final management | Final IPMI |
|---|---|---|---|---|
sa-edge-01 | 192.168.1.10/23 | 192.168.0.10/23 | 10.10.20.10/24 | 10.10.10.10/24 |
sa-cmp-01 | 192.168.1.11/23 | - | 10.10.20.11/24 | - |
sa-cmp-02 | 192.168.1.12/23 | - | 10.10.20.12/24 | - |
sa-stor-01 | 192.168.1.20/23 | 192.168.0.20/23 | 10.10.20.20/24 | 10.10.10.20/24 |
The WAN Changes Last
Starting with target-LAN commissioning, 192.168.0.0/23 remains upstream of
OPNsense while downstream endpoints use final 10.10.x networks. Phase A8
changes only the WAN feed from UCG to the ONT; it does not readdress the LAN.
The target switches receive final VLAN 10 addresses during Phase A3. Services, BMCs, and Proxmox management move during Phase A5; clients move during Phase A7. The full transition by interface and phase is in IP Tables.
Site B Bootstrap Boundary
Site B retains 192.168.16.0/24 behind the USG Pro until a separate migration
campaign begins. Its final addresses remain reserved under 10.20.0.0/16; the
active Site A campaign does not change them.
| Function | Bootstrap rule |
|---|---|
| Gateway | 192.168.16.1 |
| Host management | Uses the final host octet, such as .20 for sb-cmp-01 |
| IPMI | Uses the host management octet plus 100 during bootstrap |
| Final target | Management moves to VLAN 20; IPMI moves to VLAN 10 |
Reserved and Retired Space
| Range or VLAN | State |
|---|---|
10.10.253.0/24 / VLAN 253 | Reserved and unused at Site A; VLAN 253 remains a Site B-only UniFi WAN transit |
| VLAN 4040 | Retired Site A Layer 3 transit proposal; do not configure |
10.10.65.0/24 / VLAN 65 | Reserved at Site A and not carried until an approved workload exists |
| VLAN 999 | Site A native sink with no IP subnet |
From a Prefix to an Endpoint
Use one canonical reference at each level:
- VLAN Reference selects the segment and its routing state.
- Address Allocation Rules selects the role band and stable host octet.
- IP Tables supplies the exact host or service address.
- WireGuard Routing defines future reachability between the two site summaries.
Routing and Firewall Policy Matrix
Exact Site A zone outcomes, narrow required permits, mandatory denies, service objects, and the evidence required before a firewall rule is accepted.
Address Allocation Rules
Default role bands, stable physical-host octets, host-interface addressing policy, and documented exceptions for pinned services and VIPs.