For the setup to work, the 16 IPs below must be identified as "interesting" for VPN encryption and these IPs can be identified via per host or subnet. If it's to be identified via host, they have to use /32 for the prefix length i.e 10.55.32.80/32 --- this is the same as 10.55.32.80 mask 255.255.255.255. Using this method, you have to configure all 16 IPs, one by one. If it's to be identified via subnet, you have the choice of prefix length as long as long as all the 16 IPs are covered i.e 10.55.32.0/24 (10.55.32.0 mask 255.255.255.0), 10.55.32.0/25 (10.55.32.0 mask 255.255.255.128), etc... The benefit in using a subnet is you only have to define 1 subnet instead of defining all the 16 host IPs. But, caution has to be taken in order not to overlap w/ any existing IPs in use or possible concern of wasting allocated IPs. All IPs are assigned to PCs with WIndows OS This is the Q that my colleague send to me....the fact is my forgot how the colculation. Could anyone pls help me.