2

Is it necessary to provide a wildcard mask in extended ACL?

For example, if I want to block 192.168.5.2 from gaining access to 192.168.7.2, can I write the command as follows?

access-list 107 deny 192.168.5.2 192.168.7.2
acess-list 107 permit any any
int fa 0/0
ip access-group in
3

You are wrong.

The correct syntax is:

access-list 107 deny ip 192.168.5.2 0.0.0.0 host 192.168.7.2
access-list 107 permit ip any any

int fa 0/0
ip access-group 107 in

0.0.0.0 is the ACL wildcard of 255.255.255.255 which is a single host (/32). 0.0.0.255 is the ACL wildcard of 255.255.255.0 which is a whole /24 subnet.

  • One thing that s confusing me is that when to use 0.0.0.0 and when to use 0.0.0.255 as wildcard mask? – Ahmad Qayyum Apr 23 at 7:25
  • 2
    0.0.0.0 when there is host. 0.0.0.255 when subnet is /24 – infra Apr 23 at 7:26
  • @AhmadQayyum check my updated answer. :-) – user56700 Apr 23 at 7:28
  • 1
    @AhmadQayyum yes exactly. – user56700 Apr 23 at 7:33
  • 1
    @Zac67 you are correct, i've changed the text. – user56700 Apr 23 at 10:39
4

ACLs use wildcards. You need to use e.g.

ip access-list 107 deny ip 192.168.5.2/32 192.168.7.2/32

The /32 is equivalent to the 0.0.0.0 wildcard = no wildcard bits. Alternatively, you can use the host indicator, so 192.168.5.2/32, 192.168.5.2 0.0.0.0, and host 192.168.5.2 are all the same. any is equivalent to 0.0.0.0 255.255.255.255 = all wildcard bits = any IP address.

Additionally, you should consider numbering your ACL entries to simplify future expansion, e.g.

ip access-list extended 107
10 deny ip 192.168.5.2/32 192.168.7.2/32
9999 permit any any
end
  • On all the routers i have available, Cisco 6509-E with Sup2T, Cisco 897, Cisco 3650/3850 etc. I do not have the command access-list extended. Only numbers are available that represent the extended, standard, protocol etc. All are running the latest Safe harbor software. – user56700 Apr 23 at 10:36
  • I'm guessing you mean ip access-list extended 107 – user56700 Apr 23 at 10:44
  • @user56700 Thx, the ip was missing. The syntax does vary a bit but with the ip bit that should work. – Zac67 Apr 23 at 17:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.