I. For each of the following networks, determine
(a) the network address
(b) the broadcast address
(c) the number of useable addresses on the segment.

(1) managment vlan: 172.20.1.0/27
(2) internal machines: 172.20.1.32/27
(3) external-facing machines: 172.20.1.64/27
(4) internal wireless clients: 172.20.1.128/26
(5) VPN connections: 172.20.1.192/26

II. Why would I choose to segment the network this way?  That is, what
overall route(s) does the router have to advertise to make all of
these subnets accessible?

III. The VPN machines should be able to access any other machines, but
the dot11 clients should be treated like external machines for the
most part -- they access the "external-facing machines" only, not
internal machines.  How would I reorganise the allocation to minimize
the number of summary routes I need to have internally for that
subnet?

[btw - the current state of my network will be thus:

172.20.1.0/27   -- mgmt 
172.20.1.32/27  -- internal machines
172.20.1.64/27  -- external-facing machines
172.20.1.96/27  -- VPN endpoints [can get to 172.20.1.0/25]
172.20.1.128/26 -- 802.11 pool
172.20.1.192/29 -- windows isolated vlan (no default router)

]