1

We're trying to debug a connection issue, and I can't find any solid documentation one way or the other. I'm not positive of the hardware we're using, but we can assume Cisco for now, as I doubt there's much difference for this question.

Take the following example ACL entry:

1800 permit tcp 10.74.10.50/32 10.74.150.21/32 range 10000 19999

Will this work? I questioned this, as a /32 traditionally means nothing beyond the subnet ID and broadcast address are usable. I was told that subnetting works differently for ACL entries, and that the /32 here means that only the address given will be permitted.

Could someone let me know which is correct?

3

A /32 mask is often referred to as a host address, and it means a subnet with a single host. That is normal IP addressing and it works in ACLs or routing or anywhere else you use IP addresses.

One thing to mention: For Cisco IOS, ACLs are written with a "wildcard" mask, which is the one's complement of the subnet mask. So 255.255.255.0 would be written as 0.0.0.255. A /32 would be written as 0.0.0.0.

NX-OS does use the slash notation.

ASAs use the standard net mask.

2

Cisco router ACLs use wildcard masks for IPv4, not CIDR notation, like you have. A wildcard mask is the inverse of the network mask, so you are counting the number of 0 bits, instead of the number of 1 bits. For a 32-bit mask, you can use the host keyword. Numbered, extended ACLs are in the 100 to 199 and 1300 to 1999 range.

You example would be something like:

access-list 1800 permit tcp host 10.74.10.50 host 10.74.150.21 range 10000 19999

or:

access-list 1800 permit tcp 10.74.10.50 0.0.0.0 10.74.150.21 0.0.0.0 range 10000 19999

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.