- ACLs utilize wildcard masks to specify groups of IPs
or groups of subnets.
Keep in mind, this isn't a subnet mask and, in fact,
it is written something in the opposite of a subnet mask.
A wild card mask, is represented in octets,
like a subnet mask but zero equals exact match
and 255 equals any match.
So this will match 100.64.0,
basically the slash 24.
This will match the slash 16, 100.64,
while this matches the slash eight, 100.
Another way of looking at it
is 255 means ignore this portion of the octet.
I'll use this diagram as an example.
The first rule was covered in the previous chapter,
config t,
access list one, permit host 100.64.0.2
Rule two blocks 100.64.0.0 slash 24 with a command,
access list one,
deny 100.64.0.0 0.0.
0.255.
The third rule allows anything sourced from 100.64 slash 16
with access list one,
permit 100.64.0.0
0.0.255.255.
Wildcard masks don't always fall on even octet boundaries,
though there a few easy ways to calculate what it should be.
The simplest way is to take 255.255.255.255
and subtract the subnet mask
of the subnet you want to reference.
For example, a slash 30 subnet mask
is 255.255.255.252,
so doing the math gives me 0.0.0.3.
If the subnet size is a slash 21,
then subnet mask will be 255.255.248.0,
so after the math I get 0.0.7.255.
You should know that there really is
only math in one octet at a time,
so anything on an even boundary
is either going to be a zero, or a 255.
So I just swap the subnet mask zeros and 255s,
then the octet where the math needs to be done,
I subtract the value from 255.
As referenced earlier, every ACL
has an implicit deny any at the end.
To create a permit any at the end of an ACL
it's as simple as access list one permit any.
Now that it's created, I can apply it
to the interface incoming using the access group command.
Config t,
interface gig zero one,
IP,
access group one incoming.
The logic of the access group command
basically says apply ACL one to this interface
and have it filter traffic as it enters the interface.
Filtering ACLs has some interesting statistical properties.
Issuing a show IP access list command will display
each line of the ACL, but more interesting,
it will show many time each line has had a match.
This can be used for some basic troubleshooting
when traffic isn't flowing as expected,
in fact, an ACL can have all permit statements,
just to track how many times each line is activated.
Another troubleshooting aid in the log keyword
that can be added to the end of any ACL line.
Config t,
access list one,
permit 172.16.0.0 0.0.0
.255 log.
Now, any packets matched by this line
will also produce a line in the system log
showing source and destination IPs of the matched packets.
Issuing a show IP interface gig 0/1
will also display any ACLs set along
with their applied direction.
Wildcard masks will applied to nearly every ACL
you will create, so it's best to learn
how to calculate them now.