1

I have three service group, WWW, SMTP and FTP. I wanted to isolate using wildcard mask and divide them in logical subnet.

Example: We have 192.168.100.0/24 subnet, In short i want to give 50% IPs to WWW and 25% - SMTP and rest 25% FTP

www - 128 host
smtp - 64 host
ftp - 64 host 

UPDATE

My ACL will be like this.

access-list 101 permit tcp any 192.168.100.0 0.0.0.127 eq www
access-list 101 permit tcp any 192.168.100.128 0.0.0.63 eq smtp
access-list 101 permit tcp any 192.168.100.192 0.0.0.63 eq ftp

But i want to use object-group and there you can't use wildcard so how do i adjust above mask in object-group with subnetmask?

is following is correct in respect of wildcard masking?`

object-group network WWW-ACL
   192.168.100.0 255.255.255.128
object-group network SMTP-ACL
   192.168.100.128 255.255.255.192
object-group network FTP-ACL
   192.168.100.191 255.255.255.192 

Define them in ACL

access-list 101 permit tcp any object-group WWW-ACL eq www
access-list 101 permit tcp any object-group SMTP-ACL eq www
access-list 101 permit tcp any object-group FTP-ACL eq www
1

A wildcard mask is just the inverse (change the 0 bits to 1, and vice versa) of a regular mask:

  • Wildcard mask 0.0.0.127 is regular mask 255.255.255.128
  • Wildcard mask 0.0.0.63 is regular mask 255.255.255.192

Edit:

What I think you want is object groups like:

object-group network WWW-ACL
   192.168.100.0 255.255.255.128
object-group network SMTP-ACL
   192.168.100.128 255.255.255.192
object-group network FTP-ACL
   192.168.100.192 255.255.255.192 
  • In my case third subnet will be 192.168.100.191 255.255.255.0 can you specify base on my question – Satish Oct 3 '16 at 21:38
  • Not from what you have for access-list 101 permit tcp any 192.168.100.192 0.0.0.255 eq ftp. The 0.0.0.255 wildcard mask translates to 255.255.255.0. – Ron Maupin Oct 3 '16 at 21:45
  • what should i use can you put in your answer, i need specific answer to not myself confused :( – Satish Oct 3 '16 at 21:49
  • Also, in your object groups, the last two actually translate to the same range, and the last one does't match what you have in the wildcard masks. You have me confused about what you really want. – Ron Maupin Oct 3 '16 at 21:50
  • I have /24 subnet and i want to divide them in 3 service, 50% - WWW and 25% SMTP and 25% FTP. base on that i calculate mask i may be wrong there that is why i post question to find out how to do that? – Satish Oct 3 '16 at 21:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.