2

Is it necessary to provide a wildcard mask in extended ACL?

For example, if I want to block 192.168.5.2 from gaining access to 192.168.7.2, can I write the command as follows?

access-list 107 deny 192.168.5.2 192.168.7.2
acess-list 107 permit any any
int fa 0/0
ip access-group in

2 Answers 2

3

You are wrong.

The correct syntax is:

access-list 107 deny ip 192.168.5.2 0.0.0.0 host 192.168.7.2
access-list 107 permit ip any any

int fa 0/0
ip access-group 107 in

0.0.0.0 is the ACL wildcard of 255.255.255.255 which is a single host (/32). 0.0.0.255 is the ACL wildcard of 255.255.255.0 which is a whole /24 subnet.

7
  • One thing that s confusing me is that when to use 0.0.0.0 and when to use 0.0.0.255 as wildcard mask? Apr 23, 2019 at 7:25
  • 2
    0.0.0.0 when there is host. 0.0.0.255 when subnet is /24
    – infra
    Apr 23, 2019 at 7:26
  • @AhmadQayyum check my updated answer. :-)
    – Cow
    Apr 23, 2019 at 7:28
  • 1
    @AhmadQayyum yes exactly.
    – Cow
    Apr 23, 2019 at 7:33
  • 1
    @Zac67 you are correct, i've changed the text.
    – Cow
    Apr 23, 2019 at 10:39
4

ACLs use wildcards. You need to use e.g.

ip access-list 107 deny ip 192.168.5.2/32 192.168.7.2/32

The /32 is equivalent to the 0.0.0.0 wildcard = no wildcard bits. Alternatively, you can use the host indicator, so 192.168.5.2/32, 192.168.5.2 0.0.0.0, and host 192.168.5.2 are all the same. any is equivalent to 0.0.0.0 255.255.255.255 = all wildcard bits = any IP address.

Additionally, you should consider numbering your ACL entries to simplify future expansion, e.g.

ip access-list extended 107
10 deny ip 192.168.5.2/32 192.168.7.2/32
9999 permit any any
end
3
  • On all the routers i have available, Cisco 6509-E with Sup2T, Cisco 897, Cisco 3650/3850 etc. I do not have the command access-list extended. Only numbers are available that represent the extended, standard, protocol etc. All are running the latest Safe harbor software.
    – Cow
    Apr 23, 2019 at 10:36
  • I'm guessing you mean ip access-list extended 107
    – Cow
    Apr 23, 2019 at 10:44
  • @user56700 Thx, the ip was missing. The syntax does vary a bit but with the ip bit that should work.
    – Zac67
    Apr 23, 2019 at 17:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.