Unusual wildcard mask in Cisco ACL configuration

Question

I inherited some configs on a network I manage from a previous administrator.

In some of the ACLs there are some very strange wildcard masks that i've not seen before, for example:

10 permit ip any 10.160.1.0 0.31.0.255

I cannot find anywhere online where it states that this kind of ACL is valid. Is anyone able to confirm/deny this for me?

Thanks in advance

Answer 1

That is a valid wildcard mask. It will match any IP with the format 10.(160-191).1.(0-255). Whether or not this is intended, or good design, is unknown.

Wildcard masks are just "do-we-care" bitwise masks used when looking at an IP -- a value of 0 means "do-care", and 1 means "don't-care".

In this case, 0.31.0.255 translates to:

00000000 00011111 00000000 1111111

So the IP listed in the ACL (10.160.1.0) will have a binary value of

00001010 10100000 00000001 00000000

Testing an IP (10.190.1.200):

00001010 10111110 00000001 11001000 (10.190.1.200)
00001010 10100000 00000001 00000000 (10.160.1.0)
^^^^^^^^ ^^^      ^^^^^^^^          (0.31.0.255)

The carets represent the wildcard mask, showing which bits MUST match. Since they do, 10.190.1.200 would match this ACL statement.