In the standard IP access list that we looked at in the previous example, you learned how to define a rule that would permit or deny access to a single host. In reality, you will probably wish to permit or deny access to a range of hosts rather than just one. Perhaps you’ll want to control access for all of the hosts on a subnet, or maybe just a subset of hosts. Either way, the ability to control access for a group of hosts is accomplished using what is known as a wildcard mask.
A wildcard mask is different than a subnet mask. Defining a wildcard mask is really no more difficult, but the approach is somewhat different. The purpose of the wildcard mask is to specify which group of addresses an access list entry should apply to. For example, imagine that we wanted to create a standard IP access list that would deny inbound access on interface E0 to all hosts on network 192.168.20.0/24. The access list entry would be:
RouterA(config)#access-list 40 deny 192.168.20.0 0.0.0.255
I know that the wildcard mask looks a little confusing. In this case, the wildcard mask is 0.0.0.255. The binary 0s in the mask tell the router that the associated bits in the source address much match exactly. Since the first 3 octets in the wildcard mask are set to binary 0, the router knows that the first three octets must match 192.168.20. The binary 1s in the mask tell the router to match any possible value. Since the last octet in the wildcard mask is all binary 1s, the router knows that any value in the last octet is a match. So, any source address beginning with 192.168.20 would match the access list, and in this case, be denied.
In the same way, consider the example below. It tells the router to permit traffic from hosts with any address that starts with 10.10. Since the last two octets are masked, any source address starting with 10.10 will be a match. In this case, all hosts from 10.10.0.1 to 10.10.255.254 would be permitted access.
RouterA(config)#access-list 40 deny 10.10.0.0 0.0.255.255
Recall that a single host can be specified in an access list using either the host command, or a wildcard mask of all 0s. The wildcard mask of all 0s means “match all octets exactly”. In the example below, only host 192.168.1.100 would be denied access.
RouterA(config)#access-list 40 deny 192.168.1.100 0.0.0.0 Read the rest of this entry »