how can i configure access list to permit specific ip range 192.168.1.101 to 200? because i don't want to configure 100 times for every ip address.
Thanks for your reply!
-
Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin♦ Aug 11 '17 at 3:26
Add a comment
|
To permit a range of IP addresses you need to apply the proper inverse mask. The concepts are covered in Configuring IP Access Lists.
However your range of addresses is dictated by the mask you choose. You cannot pick a range that crosses mask boundaries like you are requesting. So an ACL for a range of 100 addresses could be 0.0.0.127.
Example: permit ip 192.168.1.0 0.0.0.127
This permit statement will give you the number of addresses you require but it dictates that the available range is 192.168.1.1 - 192.168.1.127.
If you absolutely must use the range of addresses that you laid out you could permit in several smaller masked ranges. For instance -
permit ip 192.168.1.128 0.0.0.63
- will permit the range 192.168.1.128 - 192.168.1.191.
You could then -
permit ip 192.168.1.113 0.0.0.15
- this will permit the range 192.168.1.112 - 192.168.1.127
Eventually you would wind up permitting individual addresses.
Hope that helps.
If you are limited to just IP/Mask combinations, this is the least amount of entries to get exactly the IP addresses 192.168.1.101 through 192.168.1.200 (inclusive):
192.168.1.101/32
192.168.1.102/31
192.168.1.104/29
192.168.1.112/28
192.168.1.128/26
192.168.1.192/29
192.168.1.200/32
If you are using an ASA with code version 8.3+, you can create a "Range" type object, and apply the object in an ACL directly:
object network MYRANGE
range 192.168.1.100 192.168.1.200
access-list MYACL permit ip object MYRANGE any
