8

I inherited some configs on a network I manage from a previous administrator.

In some of the ACLs there are some very strange wildcard masks that i've not seen before, for example:

10 permit ip any 10.160.1.0 0.31.0.255

I cannot find anywhere online where it states that this kind of ACL is valid. Is anyone able to confirm/deny this for me?

Thanks in advance

  • 1
    Remember, wildcard masks can be discontiguous. – Ryan Foley Jan 12 '15 at 17:57
13

That is a valid wildcard mask. It will match any IP with the format 10.(160-191).1.(0-255). Whether or not this is intended, or good design, is unknown.

Wildcard masks are just "do-we-care" bitwise masks used when looking at an IP -- a value of 0 means "do-care", and 1 means "don't-care".

In this case, 0.31.0.255 translates to:

00000000 00011111 00000000 1111111

So the IP listed in the ACL (10.160.1.0) will have a binary value of

00001010 10100000 00000001 00000000

Testing an IP (10.190.1.200):

00001010 10111110 00000001 11001000 (10.190.1.200)
00001010 10100000 00000001 00000000 (10.160.1.0)
^^^^^^^^ ^^^      ^^^^^^^^          (0.31.0.255)

The carets represent the wildcard mask, showing which bits MUST match. Since they do, 10.190.1.200 would match this ACL statement.

| improve this answer | |
  • I understand, i'm not sure why none of the PDFs or sites I looked at seem to cover this really ... Explanation makes a lot of sense, thanks for that :) – BenSBB Jan 12 '15 at 16:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.