# Enhancing Data Security Through VLSM Subnetting and TCP/IP Model in an ENT
## 5 Discussion
The VLSM technique allows a network administrator, for instance, to concise the subnet mask for a subnet for optimisation and conservation of network resource allocation and IP addresses, respectively. An organisation can have three different Locations where the first location accommodated 120 wired and wireless by reason of the nature of activities conducted. The second location allows for 60 devices and the third location has 30 devices. Whereas a larger subnet is used for high number of devices, the smaller subnets are utilised for a low number of devices. The subnet mask of the IP addresses is 255.255.255.252/30. The reason for utilising a /30 subnet mask is to prevent IP address wastage. The connection between two routers as presented in Figure 3 required two IP addresses, a /30-bit mask relates to 30 ones with 2 zeros to the host address. This was achieved using the hosts formula \(n^{2}-2\), where n represents the number of hosts. The \(n=2\); \(2^{2}=4\ -2=2\); the usable IP addresses between any two routers is 2. In this paper, routing protocols expedite transmitting packets amongst routers for effectual communication. Configuration showed RIPv2 as a distance-vector routing protocol which exchanges routing information between neighbouring routers, while EIGRP uses advanced routing protocol delivering faster convergence and makes efficient routing more available. The EIGRP routing protocol for message transmission can performed well in any-sized network as stated by [12] when implementing EIGRP in Packet Tracer, hence our choice to utilise EIGRP. EIGRP works in TCP/IP and OSI network models, it has an algorithm which broadcasts the specific update in the network and has autonomous capabilities. EIGRP enables fast data transmission resulting from high throughput of the network. The performance and security are compared against the routing protocols mentioned in Section 2, then presented in Table 7 as a qualitative metric [36; 37]. Data security ensures confidentiality, integrity, and availability of information by using cryptographic primitives for authentication such as message digest (MD5) in RIPv2, Secure Hash Algorithm (SHA) in OSPF, and Hash Message Authentication Codes-Secure Hash Algorithm (HMAC-SHA-256) in EIGRP. Regarding security, IPSec serves as a security protocol enabling secured and encrypted communication for data confidentiality and integrity amongst devices within the network. IPSec security protocol is a suit of protocols. One of the protocols in the suite is an AH which provides integrity packet protection for packet headers and data as well as authentication. ESP is another protocol in the IPSec suite which has evolved over time to support authentication making AH only useful when ESP is unable to authenticate some portions of packets. For suitability to our network topology, the AH tunnel mode is preferred on the condition that NAT is not envisaged. Although, AH provides integrity of the entire packet regardless of whether the mode is transport or tunnel. It is important to call out the fact that IP header fields which change unpredictably while in-transit are not integrity-protected. The reason for this is because TTL and IP checksum field values change as the packet travels. Consequently, ensuring integrity of these fields using source and destination hash comparisons is not possible. The alternative would be to track integrity each time the packet is about to leave for the next hop, and this can introduce a lot of overhead. Integrity in the IPSec relies on a keyed hash algorithm whereby the hash is generated from both the message and a secret key shared between the two endpoints. The keyed hash is added to the packet before sending it off to the recipient. The recipient generates another keyed hash and compares both hashes. If there is a match, then the recipient acknowledges that there is integrity vis-a-vis the packet. Wireless devices are secured using Wi-Fi Protected Access.