Is it necessary to provide a wildcard mask in extended ACL?

For example, if I want to block from gaining access to, can I write the command as follows?

access-list 107 deny
acess-list 107 permit any any
int fa 0/0
ip access-group in

You are wrong.

The correct syntax is:

access-list 107 deny ip host
access-list 107 permit ip any any

int fa 0/0
ip access-group 107 in is the ACL wildcard of which is a single host (/32). is the ACL wildcard of which is a whole /24 subnet.

| improve this answer | |
  • One thing that s confusing me is that when to use and when to use as wildcard mask? – Ahmad Qayyum Apr 23 '19 at 7:25
  • 2 when there is host. when subnet is /24 – infra Apr 23 '19 at 7:26
  • @AhmadQayyum check my updated answer. :-) – user56700 Apr 23 '19 at 7:28
  • 1
    @AhmadQayyum yes exactly. – user56700 Apr 23 '19 at 7:33
  • 1
    @Zac67 you are correct, i've changed the text. – user56700 Apr 23 '19 at 10:39

ACLs use wildcards. You need to use e.g.

ip access-list 107 deny ip

The /32 is equivalent to the wildcard = no wildcard bits. Alternatively, you can use the host indicator, so,, and host are all the same. any is equivalent to = all wildcard bits = any IP address.

Additionally, you should consider numbering your ACL entries to simplify future expansion, e.g.

ip access-list extended 107
10 deny ip
9999 permit any any
| improve this answer | |
  • On all the routers i have available, Cisco 6509-E with Sup2T, Cisco 897, Cisco 3650/3850 etc. I do not have the command access-list extended. Only numbers are available that represent the extended, standard, protocol etc. All are running the latest Safe harbor software. – user56700 Apr 23 '19 at 10:36
  • I'm guessing you mean ip access-list extended 107 – user56700 Apr 23 '19 at 10:44
  • @user56700 Thx, the ip was missing. The syntax does vary a bit but with the ip bit that should work. – Zac67 Apr 23 '19 at 17:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.