Cisco
IP Access-List Wildcard Masks
So simple it will make you sick!
Copyright ©
1999 Boson Software
by john@boson.com
We all know the rules and seen the literature on how to
do wild card masks:
The 32 bit wildcard mask consists of 1’s and 0’s
1 = ignore
this bit
0 = check this bit
Yada, yada, yada………
|
BUT
MOST OF THE TIME WE WANT TO DO ONE OF THESE THREE THINGS: |
|
1.
MATCH A HOST |
|
2.
MATCH AN ENTIRE SUBNET |
|
3.
MATCH A RANGE |
|
Here
are the easy ways to do that |
|
1.
How to match an individual host |
|
All
wildcard mask bits are zero’s |
|
For
Standard Access-list |
|
Access-list
1 permit 157.89.8.9 0.0.0.0 |
|
Access-list
1 permit 157.89.8.9 (standard
access lists assume a 0.0.0.0 mask) |
|
For
Extended Access-lists |
|
Access-list
101 permit ip 157.89.8.9 0.0.0.0 any |
|
Access-list
101 permit ip host 157.89.8.9 any |
|
2.
How to match an Entire Subnet |
|
Wildcard
mask = 255.255.255.255 – subnet mask |
|
Example
1 Given
3.2.4.0 subnet mask 255.255.255.0
255.255.255.255 -
subnet mask 255.255.255.
0 Wildcard
mask 0.
0. 0.255 Answer: Access-list
1 permit 3.2.4.0 0.0.0.255 |
|
Example
2 Given
111.2.4.112 subnet mask 255.255.255.224
255.255.255.255 -
subnet mask 255.255.255.224 Wildcard
mask 0.
0. 0. 31 Answer: Access-list
1 permit 111.2.4.112 0.0.0.31 |
|
Example
3 Given
3.2.128.0 subnet mask 255.255.192.0
255.255.255.255 -
subnet mask 255.255.192.
0 Wildcard
mask 0.
0. 63.255 Answer: Access-list
1 permit 3.2.128.0 0.0.63.255 |
|
Example
4 Given
203.2.4.128 subnet mask 255.255.255.240
255.255.255.255 -
subnet mask 255.255.255.240 Wildcard
mask 0.
0. 0. 15 Answer: Access-list
1 permit 203.2.4.128 0.0.0.15 |
|
THAT
IT………….. COOL! |
3.
How to Match a range
(Works
when the range is an entire subnet)
Match
the range
157. 89. 16.0 – 157. 89. 31.255
To
Find Wildcard Mask, Take the HIGHER minus the Lower:
157. 89. 31.255
-157. 89. 16. 0
wildcard
0. 0. 15.255
access-list
1 permit 157.89.16.0 0.0.15.255
Warning:
Each non-zero value must be ONE LESS than a power of 2
(i.e. one of these:0,1,3,7,15,31,63,127,255)
Match
the range
157. 89. 16. 32 – 157. 89. 31. 63
To
Find Wildcard Mask, Take the HIGHER minus the Lower:
157. 89. 31. 63
-157. 89. 16. 32
wildcard
0. 0. 15. 31
access-list
1 permit 157.89.16.32 0.0.15.31
Warning:
Each non-zero value must be ONE LESS than a power of 2
(i.e. one of these:0,1,3,7,15,31,63,127,255)
|
4.
Matching everyone is easy: |
|
|
|
Access-list
1 permit any |
|
Or
|
|
Access-list
1 permit 0.0.0.0 255.255.255.255 |
Questions, comments? Email the Webmaster.
Copyright 1999 Boson Software, Inc. All rights reserved
See our full
disclaimer.