2

I'm having some issues with some access list configuration regarding a topology. The lab requirements are:

  • Deny any host with even-numbered IP addresses from the BM_R1 LAN from accessing hosts on the BM_R3 LAN.
  • Hosts with odd-numbered IP addresses on the BM_R1 LAN should be able to ping any other destination.

The two networks to which the access list refers are 172.16.1.128/25 (R3 LAN) and 172.16.1.160 (R1 LAN). I've tried changing the wildcard bits to 0.0.0.254 for even IP addresses on both. I've also tried placing them on either R1 or R3, but it did not work. What am I doing wrong?

Improve this question
5
  • 1
    amusing.. try wildcard mask 0.0.0.1
    – JFL
    Apr 14, 2016 at 11:28
  • please do not deride me.i'm kind of new to networking.0.0.0.1? i thought it should be 0.0.0.254.could you please explain?
    – Sargeras
    Apr 14, 2016 at 11:31
  • 1
    No offense. I found the question amusing (not you) even if it has no practical use in the real world. Regarding the mask, why do you think it should be 0.0.0.254? All even numbers, when converted in binary will end with 0 , and all odd numbers, in binary, will end with 1. So you want to inspect only the last bit to filter even or odd numbers. Then the mask will be either 255.255.255.254 or 0.0.0.1.
    – JFL
    Apr 14, 2016 at 11:48
  • for christs sake, it just doesn't work.the configuration I did was access-list 20 deny 172.16.1.2 0.0.0.1 permit any After that, i deleted the list and did the same with 255.255.255.254 instead of 0.0.0.1. it just doesnt work
    – Sargeras
    Apr 14, 2016 at 11:55
  • This is basic thing. refer ciscotips.wordpress.com/2008/10/27/… for details
    – HackerGK
    Apr 14, 2016 at 12:00

1 Answer 1

Reset to default
1

When creating ACLs in a Cisco router, you use wildcard masks. Where you have a bit set to 0 in the wildcard mask, that bit must exactly match in the address. Remember that addresses and masks, including wildcard masks, are really just 32-bit numbers. This only works for IPv4; IPv6 uses CIDR notation.

For example:

ip access-list 10 deny 192.168.2.0 0.0.1.255   ! denies anything between 192.168.2.0 and 192.168.3.255
ip access-list 10 deny 192.168.2.0 0.0.1.254   ! denies only even addresses between 192.168.2.0 and 192.168.3.255
ip access-list 10 deny 192.168.2.1 0.0.1.254   ! denies only odd addresses between 192.168.2.0 and 192.168.3.255

This is something that used to be taught in Cisco classes, but it's not actually very useful in the real world. If you must use non-contiguous wildcard masks, you should probably rethink the network design.

Improve this answer
16
  • Ron Maupin, thanks for your reply. Regarding my certain network I did access-list 20 deny 172.16.1.1 0.0.0.254 access-list 20 permit any but it did not work.
    – Sargeras
    Apr 14, 2016 at 11:58
  • It may be how you applied the ACL. Standard ACLs should normally be applied out, closest to the destination, while extended ACLs should normally be applied in, closest to the source. Also, "it did not work," is not very descriptive of the problem.
    – Ron Maupin ♦
    Apr 14, 2016 at 12:04
  • hold on., so if want to stop an even-numbered host on R1 Lan from talking to a R3 Lan, we will apply the ACL on R3, right?
    – Sargeras
    Apr 14, 2016 at 12:08
  • That depends. For a standard ACL, if you want to completely stop it from reaching R3, you apply it out on the R1 interface to R3, but if you want to prevent it from getting to the network on a single interface on R3, you apply it out on that interface on R3. For an extended ACL, you would apply it in on the interface of R1 where the network come into R1.
    – Ron Maupin ♦
    Apr 14, 2016 at 12:12
  • will it work by creating the list like this: conf t, ip access-list standard 20 and then the statements?
    – Sargeras
    Apr 14, 2016 at 12:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.