You inherited 192.168.1.0/24 everywhere — it overlaps every client VPN, it has no room to grow, and the VLAN IDs mean nothing. You need to renumber. But every device, DHCP reservation, firewall rule and hardcoded config points at the old scheme, and you cannot take the network down to swap it. The trick is to run both address schemes at once, move onto the new one gradually, and retire the old one last.
Renumbering looks terrifying because the address is referenced everywhere: DHCP scopes, firewall rules, static routes, ACLs, hardcoded device configs, the VPN peers that expect that subnet. A big-bang change — flip the router to the new scheme and hope — breaks all of those at once, in the middle of the working day.
The surgical approach is to make the router speak both schemes at the same time with a secondary address on each interface, so old and new hosts coexist and route to each other. Then you migrate hosts onto the new subnet a group at a time (a short DHCP lease does most of the work), update every rule and peer to accept both ranges, and only when nothing answers on the old scheme do you remove it. At no point is there a cut-over instant.
01
The router holds a secondary address in the new range while the old one still answers, so hosts can move one at a time without a flag day.
02
Additive first, migrate in the middle, subtract last — each step with a known undo.
| Step | Do | Rollback |
|---|---|---|
| 1 · Inventory | Find every reference to the old scheme: DHCP reservations, firewall/ACL rules, static routes, VPN peers, hardcoded device IPs. | Paper only. |
| 2 · Dual-home the gateway | Add the new subnet as a secondary address and a parallel DHCP scope. Old keeps working. | Remove the secondary address. |
| 3 · Widen the rules | Update firewall/ACL/route/VPN to accept both old and new ranges. | Revert the rule edits. |
| 4 · Migrate hosts | Shorten the lease; move DHCP clients to the new scope group by group. Re-address statics deliberately. | Point the group back at the old scope. |
| 5 · Verify empty | Confirm nothing still answers on the old subnet (ARP/lease/traffic). | — |
| 6 · Remove the old | Drop the old secondary address, scope, and the now-redundant “both” rules. | Re-add the old secondary (kept in the export). |
# new subnet as a SECOND address on the same VLAN interface /ip address add address=10.20.10.1/24 interface=v10-staff /ip pool add name=p-staff-new ranges=10.20.10.50-10.20.10.254 /ip dhcp-server add name=d-staff-new interface=v10-staff address-pool=p-staff-new \ disabled=no # widen firewall/NAT to match both ranges during the transition /ip firewall address-list add list=STAFF address=192.168.1.0/24 /ip firewall address-list add list=STAFF address=10.20.10.0/24
DHCP hands out the new address automatically; everything else is manual. Static-IP devices (printers, cameras, PLCs), DHCP reservations keyed to the old subnet, ACLs and VPN phase-2 selectors that name the old range — each must be updated by hand, and each is a potential outage if missed. The permit-both window (step 3) is what buys you time to find them without breaking anything. Do not remove the old scheme (step 6) until step 5 proves it is genuinely empty.
03
| Before you start | Why |
|---|---|
| Config export + OOB access | Whole-project rollback and a way back in if you lose the management path. |
| Inventory of statics + rule references | These are the migration casualties — find them before step 4. |
| Short DHCP lease during the cut | Hosts re-lease onto the new scheme in minutes; set it back after. |
| Prove the old subnet empty before removal | No ARP, no leases, no traffic — then and only then remove it. |
Takeaways
Renumbering a live network is routine surgery when it is done additively. I run the new scheme alongside the old, migrate hosts on a short lease, and retire the old addressing only once nothing depends on it.
Book a Discovery Call →