1. Copyright 2000 C. Dodge Access Control List Wildcards (Inverse Mask) Computer Networking II

2. Access List Statement - Format 4 Standard Access List –access-list # permit/deny source IP wildcard # - 1-99 (inverse mask) permit/deny - switch the packet or drop it source IP - source IP address to which the packet should be compared. Can also use ANY wildcard (inverse mask)- see next slides

3. Wildcards (Inverse Mask) 4 Allows you to indicate a host, subnet, network or range of IP addresses 4 The two binary values in the wildcard have different meanings: –0 = Must Match Exactly –1 = Ignore

4. ACL Examples 4 Standard Access List Format –access-list # permit/deny source IP wildcard 4 Sample: A(config)#access-list 5 deny 172.22.5.2 0.0.0.0 A(config)#access-list 5 deny 172.22.5.3 0.0.0.0 A(config)#access-list 5 permit any So what does this access list do?

5. What this access list does: deny 172.22.5.2 0.0.0.0 Action Source IP Wildcard to beAddressMatch the source IP taken Exactly If a packet from 172.22.5.2 comes to this router it will be discarded. According to the next line a packet from host 172.22.5.3 will also be discarded A(config)#access-list 5 deny 172.22.5.3 0.0.0.0 A(config)#access-list 5 permit any This last line lets all other traffic through

6. ACL Examples Sample: A(config)#access-list 5 deny 172.22.5.2 0.0.0.0 A(config)#access-list 5 deny 172.22.5.3 0.0.0.0 A(config)#access-list 5 permit any What happens if you now type in the following: A(config)#access-list 5 deny 172.22.5.4 0.0.0.0?

7. ACL Examples Results of new access-list statement: A(config)#access-list 5 deny 172.22.5.2 0.0.0.0 A(config)#access-list 5 deny 172.22.5.3 0.0.0.0 A(config)#access-list 5 permit any A(config)#access-list 5 deny 172.22.5.4 0.0.0.0 Why does the last line have no affect? How could you correct this situation?

8. Wildcard Examples Source IP Wildcard 4 195.34.5.120.0.0.0 4 Result: Match all four octets 4 Only 195.34.5.12 is a match 4 Could also use host 195.34.5.12 in place of the wildcard. Host indicates an exact match is needed.

9. Wildcard Examples Source IP Wildcard 172.16.10.00.0.0.255 Result: Match the first three octets exactly (inverse mask values of 0 = match exactly) but ignore the last octet (255=all 1’s in binary) 172.16.10.0 thru 172.16.10.255 is a match so any value between these two values is permitted. Any packet from subnet 172.16.10.0 is permitted.

10. Wildcard Examples Source IP Wildcard 172.16.10.00.0.31.255 Concentrate on the third octet 31 in binary is 00011111 must matchdon’t care 10 in binary is 00001010 So the first three bits must be 0’s and the last 5 bits do not matter. So acceptable values are 172.16.0.0 through 172.16.31.255

11. So acceptable values are 172.16.0.0 through 172.16.31.255 A value of 172.16.32.0 would not match because 32 in binary = 00100000 and this does not match the first three digits. 31 in binary is 00011111 must matchdon’t care 10 in binary is 00001010

12. Change the 10 to 64 Source IP Wildcard 172.16.64.00.0.31.255 Concentrate on the third octet 31 in binary is 00011111 must matchdon’t care 64 in binary is 01000000 So the first three bits must be 010 and the last 5 bits do not matter. So acceptable values are?

13. Change the 10 to 64 Source IP Wildcard 172.16.64.00.0.31.255 Concentrate on the third octet 31 in binary is 00011111 must matchdon’t care 64 in binary is 01000000 Acceptable values are 01000000 = 64 through 01011111 = 95

14. Try this one Source IP Wildcard 10.0.0.0 0.0.255.255 The first two octets must match so all IP addresses that start with 10.0 are matches. The range is 10.0.0.0 through 10.0.255.255

15. Summary: Wildcards 4 Are used to indicate a host, subnet, network or range of IP addresses 4 1 = Ignore (a 1 looks like an I in Ignore) 4 0 = Must match exactly