1

For example:

router(config)#ip access-list extended 101
router(config-ext-nacl)#10 per icmp any host 192.168.1.10

From second command line, how to write a command permit icmp any host range 192.168.1.10-20? Do i have have to repeat the command line for 10 lines?

  • 1
    ACLs are implemented in hardware (ternary content-addressable memory TCAM), so you can't use any ranges, only bit patterns as JFL has excellently explained. – Zac67 Aug 6 at 11:22
4

ACL use either hosts or networks, not ranges.

Networks are bounded by power of 2 values. Your range doesn't correspond to a single network.

The best you can do is split your range into 4 valid networks:

192.168.1.10/31 for IP 10 & 11
192.168.1.12/30 for IP 12 to 15
192.168.1.16/30 for IP 16 to 19
192.168.1.20/32 for IP 20

So you don't have to use 10 lines but 4 is the minimum.

Alternatively you should organize your hosts differently so your ACL match a network.

192.168.1.0/28 match IP 1 to 15 (well 0 to 15 actually, but assuming you use 192.168.1.0/24, 0 is the network address and cannot be assigned to an host).

192.168.1.16/28 match IP 16 to 31.

| improve this answer | |
  • Thanks very much JFL!!. This answer help me a lot to understand ACL. – Tony Lee Aug 7 at 2:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.