I'm trying to find out if there is a "clean" way to do this.

I need to setup a ACL on a FWSM that effects devices over multiple subnets.

The structure looks like this: 10.10.1-254.1-15

I could do:

object-group network example

but i'm hoping there a way to do this without having to add each subnet?

1 Answer 1


Certainly! I believe inverse masks were created to be dis-contiguous rather than a normal subnet mask that must be contiguous.

An ACL such as the following should do the trick on an IOS device.

Ip access-list [standard/extended] SUBNET_240
permit ip

I am not familar with the FWSM but you should be able to create a similar ACL on an ASA.

I also just logged in to my ASA 5512 and I was able to create a network object with a dis-contiguous mask (but not inverse).

  • 1
    I was way over thinking this haha. I'm guessing in the object-group the following would work -> network-object ?
    – evolvd
    Commented Nov 13, 2013 at 23:20
  • 1
    That is exactly what you need sir, please rate my answer if you found it helpful Commented Nov 13, 2013 at 23:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.