how can i configure access list to permit specific ip range to 200? because i don't want to configure 100 times for every ip address.

Thanks for your reply!

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 11 '17 at 3:26

To permit a range of IP addresses you need to apply the proper inverse mask. The concepts are covered in Configuring IP Access Lists.

However your range of addresses is dictated by the mask you choose. You cannot pick a range that crosses mask boundaries like you are requesting. So an ACL for a range of 100 addresses could be

Example: permit ip

This permit statement will give you the number of addresses you require but it dictates that the available range is -

If you absolutely must use the range of addresses that you laid out you could permit in several smaller masked ranges. For instance -

permit ip

  • will permit the range -

You could then -

permit ip

  • this will permit the range -

Eventually you would wind up permitting individual addresses.

Hope that helps.


If you are limited to just IP/Mask combinations, this is the least amount of entries to get exactly the IP addresses through (inclusive):

If you are using an ASA with code version 8.3+, you can create a "Range" type object, and apply the object in an ACL directly:

object network MYRANGE

access-list MYACL permit ip object MYRANGE any

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.