2

Please help to suggest a method to exclude IP range 10.63.128.0 10.63.255.255 from 10.0.0.0/10.

I have a access list 3100 to filter the traffic with rule 10 10.0.0.0 0.63.255.255 and now I have to exclude a pool 10.63.128.0 10.63.255.255 from this acl 3100 and apply to acl 3110 in OAM service traffic classification. 

acl 3100
rule 10 10.0.0.0 0.63.255.255 ## how can I implement to exclude this 10.63.128.0/17 network rage
acl 3110
rule 10 10.63.128.0  0.0.127.255
Improve this question
3

Basically, you add an ACL entry before the larger range for the smaller range. So, in case you want to exclude (=permit) 10.64.128.0/17 from a general deny for source net 10.0.0.0/10:

10 permit ip 10.64.128.0/17 any
20 deny ip 10.0.0.0/10 any

The first ACL entry that matches is used. Most often, your entries are sorted by prefix length from longest (=most specific) to shortest (=least specific).

Improve this answer
2
  • Great!! Logic is fine, but I have to match all traffic of 10.0.0.0/10 which will pass 10.0.0.0 to 10.63.255.255 except 10.63.128.255 to 10.63.255.255. this last block of /17 subnet used for other classification in same router. Could you please review and suggest ? – Jatinder Singh Brar Jan 31 '19 at 1:48
  • Just swap permit and deny in the example. – Zac67 Jan 31 '19 at 7:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.