Access Security Guide K/KA/KB.15.15

Rules for defining a match between a packet and an access control entry (ACE)
• For a given ACE, when the switch compares an IPv4 address and corresponding mask in the
ACE to an IPv4 address carried in a packet:
• A mask-bit setting of 0 ("off") requires that the corresponding bits in the packet's address
and in the ACE's address must be the same. Thus, if a bit in the ACE's address is set to
1 ("on"), the same bit in the packet's address must also be 1.
• A mask-bit setting of 1 ("on") means the corresponding bits in the packet's address and
in the ACE's address do not have to be the same. Thus, if a bit in the ACE's address is
set to 1, the same bit in the packet's address can be either 1 or 0 ("on" or "off").
For an example, see“Example of how the mask bit settings define a match” (page 324).
• In any ACE, a mask of all ones means any IPv4 address is a match. Conversely, a mask of
all zeros means the only match is an IPv4 address identical to the host address specified in
the ACE.
• Depending on your network, a single ACE that allows a match with more than one source or
destination IPv4 address may allow a match with multiple subnets. For example, in a network
with a prefix of 31.30.240 and a subnet mask of 255.255.240.0 (the leftmost 20 bits),
applying an ACL mask of 0.0.31.255 causes the subnet mask and the ACL mask to overlap
one bit, which allows matches with hosts in two subnets: 31.30.224.0 and 31.30.240.0.
Bit Position in the Third Octet of Subnet Mask 255.255.240.0
1248163264128Bit Values
n/an/an/an/a1111Subnet Mask Bits
n/an/an/an/a1 or 0000Mask Bit Settings Affecting Subnet
Addresses
This ACL supernetting technique can help to reduce the number of ACLs you need. You can
apply it to a multinetted VLAN and to multiple VLANs. However, ensure that you exclude
subnets that do not belong in the policy. If this creates a problem for your network, you can
eliminate the unwanted match by making the ACEs in your ACL as specific as possible, and
using multiple ACEs carefully ordered to eliminate unwanted matches.
• Every IPv4 address and mask pair (source or destination) used in an ACE creates one of the
following policies:
• Any IPv4 address fits the matching criteria.
In this case, the switch automatically enters the address and mask in the ACE. For example:
Syntax
access-list 1 deny any
Produces this policy in an ACL listing:
MaskAddress
255.255.255.2550.0.0.0
This policy states that every bit in every octet of a packet's SA is a wildcard, which covers
any IPv4 address.
• One IPv4 address fits the matching criteria.
In this case, you provide the address and the switch provides the mask. For example:
Overview 323