1

For example:

router(config)#ip access-list extended 101
router(config-ext-nacl)#10 per icmp any host 192.168.1.10

From second command line, how to write a command permit icmp any host range 192.168.1.10-20? Do i have have to repeat the command line for 10 lines?

Improve this question
2
  • 1
    ACLs are implemented in hardware (ternary content-addressable memory TCAM), so you can't use any ranges, only bit patterns as JFL has excellently explained.
    – Zac67 ♦
    Aug 6, 2020 at 11:22
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Dec 17, 2020 at 19:53

1 Answer 1

Reset to default
4

ACL use either hosts or networks, not ranges.

Networks are bounded by power of 2 values. Your range doesn't correspond to a single network.

The best you can do is split your range into 4 valid networks:

192.168.1.10/31 for IP 10 & 11
192.168.1.12/30 for IP 12 to 15
192.168.1.16/30 for IP 16 to 19
192.168.1.20/32 for IP 20

So you don't have to use 10 lines but 4 is the minimum.

Alternatively you should organize your hosts differently so your ACL match a network.

192.168.1.0/28 match IP 1 to 15 (well 0 to 15 actually, but assuming you use 192.168.1.0/24, 0 is the network address and cannot be assigned to an host).

192.168.1.16/28 match IP 16 to 31.

Improve this answer
1
  • Thanks very much JFL!!. This answer help me a lot to understand ACL.
    – Tony Lee
    Aug 7, 2020 at 2:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.