Am I suppose to make a ACL entry like access-list Ex extended permit tcp <ip of subnet> <subnet mask> <ip of subnet that contains server> <subnet>


access-list Ex extended permit tcp <ip of subnet> <subnet mask> <ip of server> <subnet>
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Feb 21, 2018 at 16:36

2 Answers 2


For a single server to be permitted you need the latter, the former permits the entire subnet.

Note that you don't use the subnet mask (unless you mean the entire subnet) but that ACLs use wildcards, ie. address bits that are to be ignored. So, a single server is <ip of server>/32 while <server subnet>/24 matches all IP addresses within a /24 range (whether this incidentally is your subnet range or not).

  • Even though I am doing this on a firewall, I use the wildcard?
    – neoncolors
    Oct 14, 2017 at 15:01
  • @neoncolors May I know whether it is for Cisco ASA FIrewall?
    – Hung Tran
    Oct 15, 2017 at 8:59

I'm going to assume the following:

internet -> Router/Firewall -> Webserver/Service(

access-list internetTOwebserver permit tcp any host eq www

This would allow internet traffic to reach the Webserver on port 80 if the access list was applied to the outside interface of the router/firewall.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.