172.21.0.0/20 = not a good plan. You should start with 172.21.0.0/16 /16=255.255.0.0 which is a class b subnet which goes with a class B subnet mask. This way you have the whole enchilada.
THEN you subnet.
This is also where it starts getting complicated. There is a misconception due to the misinterpretation of Cisco training that you need vlans AND different subnet per vlan. This is for huge enterprises but I have seen folks due this on relatively small lans. It adds cost [you have to have layer 3 switches for vlan routing/subnet routing] and imo unnecessary maintenance overhead.
Most sites can use one subnet and vlans to separate traffic. This would be the case if you had departments you wanted in their own secure vlan domains but all can access the servers/internet. Since using vlans you don't have the collision/broadcast domains concerns you would if everyone was all in the same vlan/subnet. You can do this with a layer 2 managed switch.
Now if you have multiple buildings/sites the story changes. Then you would consider providing a subnet for each building/site which you could further divide with vlans.
An example of building/site subnetting using the class b subnet/subnet mask would look like so
172.21.0.0 /24 gives you 172.21.0.0 - 172.21.0.255 *254 hosts
172.21.1.0 /24 gives you 172.21.1.0 - 172.21.1.255 *254 hosts
172.21.2.0 /23 gives you 172.21.2.0 - 172.21.3.255 *510 hosts
172.21.4.0 /22 gives you 172.21.4.0 - 172.21.7.255 *1022 hosts
As you can see from this example you need to plan the max number of hosts you expect to use. I do my planning like for a 254 hosts I do 510 and reserve the other 254 address for future growth. That means all I have to do is change from /24 to /23 and I am done in the future. I am not caught between two occupied ranges that now requires me to either renumber the entire plan or pull out another subnet from the entire range [whole enchilada] and renumber the entire site.
Edited by Wand3r3r, 17 October 2014 - 05:51 PM.