Are ip:subnet combinations in ACLs different than everywhere else?

Question

We're trying to debug a connection issue, and I can't find any solid documentation one way or the other. I'm not positive of the hardware we're using, but we can assume Cisco for now, as I doubt there's much difference for this question.

Take the following example ACL entry:

1800 permit tcp 10.74.10.50/32 10.74.150.21/32 range 10000 19999

Will this work? I questioned this, as a /32 traditionally means nothing beyond the subnet ID and broadcast address are usable. I was told that subnetting works differently for ACL entries, and that the /32 here means that only the address given will be permitted.

Could someone let me know which is correct?

Answer 1

A /32 mask is often referred to as a host address, and it means a subnet with a single host. That is normal IP addressing and it works in ACLs or routing or anywhere else you use IP addresses.

One thing to mention: For Cisco IOS, ACLs are written with a "wildcard" mask, which is the one's complement of the subnet mask. So 255.255.255.0 would be written as 0.0.0.255. A /32 would be written as 0.0.0.0.

NX-OS does use the slash notation.

ASAs use the standard net mask.

Answer 2

Cisco router ACLs use wildcard masks for IPv4, not CIDR notation, like you have. A wildcard mask is the inverse of the network mask, so you are counting the number of 0 bits, instead of the number of 1 bits. For a 32-bit mask, you can use the host keyword. Numbered, extended ACLs are in the 100 to 199 and 1300 to 1999 range.

You example would be something like:

access-list 1800 permit tcp host 10.74.10.50 host 10.74.150.21 range 10000 19999

or:

access-list 1800 permit tcp 10.74.10.50 0.0.0.0 10.74.150.21 0.0.0.0 range 10000 19999