how can i configure access list to permit specific ip range 192.168.1.101 to 200? because i don't want to configure 100 times for every ip address.
Thanks for your reply!
Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.Sign up to join this community
To permit a range of IP addresses you need to apply the proper inverse mask. The concepts are covered in Configuring IP Access Lists.
However your range of addresses is dictated by the mask you choose. You cannot pick a range that crosses mask boundaries like you are requesting. So an ACL for a range of 100 addresses could be 0.0.0.127.
Example: permit ip 192.168.1.0 0.0.0.127
This permit statement will give you the number of addresses you require but it dictates that the available range is 192.168.1.1 - 192.168.1.127.
If you absolutely must use the range of addresses that you laid out you could permit in several smaller masked ranges. For instance -
permit ip 192.168.1.128 0.0.0.63
You could then -
permit ip 192.168.1.113 0.0.0.15
Eventually you would wind up permitting individual addresses.
Hope that helps.
If you are limited to just IP/Mask combinations, this is the least amount of entries to get exactly the IP addresses 192.168.1.101 through 192.168.1.200 (inclusive):
192.168.1.101/32 192.168.1.102/31 192.168.1.104/29 192.168.1.112/28 192.168.1.128/26 192.168.1.192/29 192.168.1.200/32
If you are using an ASA with code version 8.3+, you can create a "Range" type object, and apply the object in an ACL directly:
object network MYRANGE range 192.168.1.100 192.168.1.200 access-list MYACL permit ip object MYRANGE any