I inherited some configs on a network I manage from a previous administrator.

In some of the ACLs there are some very strange wildcard masks that i've not seen before, for example:

10 permit ip any

I cannot find anywhere online where it states that this kind of ACL is valid. Is anyone able to confirm/deny this for me?

Thanks in advance

  • 1
    Remember, wildcard masks can be discontiguous.
    – Ryan Foley
    Jan 12, 2015 at 17:57

1 Answer 1


That is a valid wildcard mask. It will match any IP with the format 10.(160-191).1.(0-255). Whether or not this is intended, or good design, is unknown.

Wildcard masks are just "do-we-care" bitwise masks used when looking at an IP -- a value of 0 means "do-care", and 1 means "don't-care".

In this case, translates to:

00000000 00011111 00000000 1111111

So the IP listed in the ACL ( will have a binary value of

00001010 10100000 00000001 00000000

Testing an IP (

00001010 10111110 00000001 11001000 (
00001010 10100000 00000001 00000000 (
^^^^^^^^ ^^^      ^^^^^^^^          (

The carets represent the wildcard mask, showing which bits MUST match. Since they do, would match this ACL statement.

  • I understand, i'm not sure why none of the PDFs or sites I looked at seem to cover this really ... Explanation makes a lot of sense, thanks for that :)
    – BenSBB
    Jan 12, 2015 at 16:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.