Access Control Lists (ACL) uses a wildcard mask to find the individual host, network, or IP address to permit or deny access. These are mainly used in access lists and routing protocols. It is 32 bit long. Two-bit positions are used in wildcard masks, they are 0 and 1. If the bit position indicates 0 which means the address of ACL must be matched with the packets IP address which is examined. In other words, if the bit is 0 then the corresponding part of the IP address is matched, and if the bit is 1 the corresponding part will get ignored.
All the bits of the wildcard mask must be zero means that to execute certain commands entire IP address must be needed to be matched with the destination. All the bits of wildcard mask ones mean they do not need to get matched they get matched to each other.
HOW TO SPECIFY A SINGLE HOST USING ACL WILDCARD MASK
To represent the single host the wildcard mask used is172.16.0.12 0.0.0.0
To represent the octet four zeroes are used. If zeroes get matched hen the address is present. The host is the keyword used to represent the address:
TO SPECIFY ENTIRE NETWORK USING ACL WILDCARD MASK
Here use a wildcard mask of 255 (all the bits in that octet are 1) to specify the entire network of ACL. The example used to specify the network 172.16.0.0/16 is:
In the example shown the value of the first two octets needs to get matched and the last two can be or cannot be get matched. So if the values are matched then the value can match with the IP address of the 172.16.0.0/16 network.
TO SPECIFY A RANGE OF IP ADDRESSES IN A NETWORK USING ACL WILDCARD MASK.
To specify a range of IP addresses using a wildcard mask only use the 1 bit for the subnetted bits. For example, two classes B and C having network 172.16.0.0 and (172.16.0.0/24) respectively. Class B get subnetted to class C. Binary representation is shown below:
IP address – 10101100.00010000.00000000.00000000
Subnet Mask – 11111111.11111111.11111111.00000000
Wildcard mask can be represented I binary form as 00000000.11111111
172.16.0.0 0.0.0.255 is the decimal representation of IP address and wildcard mask
From the example, we can see that the value of the first three octets matches exactly and the value of the last octet can be any. The IP address of the 172.16.0.0/24 network can be get matched with those statements.
- Access Control Lists (ACLs) Wildcard Masks
- How to Configure Access Control List for VTY lines (TELNET and SSH)
Download Access Control Lists (ACLs) Wildcard Masks in pdf – Click here