6

I'm trying to find out if there is a "clean" way to do this.

I need to setup a ACL on a FWSM that effects devices over multiple subnets.

The structure looks like this: 10.10.1-254.1-15

I could do:

object-group network example
 network-object 10.10.1.0 255.255.255.240
 ..
 ..
 network-object 10.10.254.0 255.255.255.240

but i'm hoping there a way to do this without having to add each subnet?

6

Certainly! I believe inverse masks were created to be dis-contiguous rather than a normal subnet mask that must be contiguous.

An ACL such as the following should do the trick on an IOS device.

Ip access-list [standard/extended] SUBNET_240
permit ip 10.10.0.0 0.0.255.15

I am not familar with the FWSM but you should be able to create a similar ACL on an ASA.

I also just logged in to my ASA 5512 and I was able to create a network object with a dis-contiguous mask (but not inverse).

192.168.0.0 255.255.0.240

  • 1
    I was way over thinking this haha. I'm guessing in the object-group the following would work -> network-object 10.10.0.0 255.255.0.240 ? – evolvd Nov 13 '13 at 23:20
  • 1
    That is exactly what you need sir, please rate my answer if you found it helpful – John Kennedy Nov 13 '13 at 23:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.