Access Security Guide K/KA/KB.15.15
Syntax
access-list 1 permit host 10.28.100.15
Produces this policy in an ACL listing:
MaskAddress
0.0.0.010.28.100.15
This policy states that every bit in every octet of a packet's SA must be the same as
the corresponding bit in the SA defined in the ACE.
• A group of IPv4 addresses fits the matching criteria
In this case you provide both the address and the mask. For example:
Syntax
access-list 1 permit 10.28.32.1 0.0.0.31
MaskAddress
0.0.0.3110.28.32.1
This policy states that:
• In the first three octets of a packet's SA, every bit must be set the same as the
corresponding bit in the SA defined in the ACE.
• In the last octet of a packet's SA, the first three bits must be the same as in the ACE, but
the last five bits are wildcards and can be any value.
• Unlike subnet masks, the wildcardbits in an ACL mask need not be contiguous. For example,
0.0.7.31 is a valid ACL mask. However, a subnet mask of 255.255.248.224 is not a valid
subnet mask.
Example of how the mask bit settings define a match
Assume an ACE where the second octet of the mask for an SA is 7 (the rightmost three bits are
"on", or "1") and the second octet of the corresponding SA in the ACE is 31 (the rightmost five
bits). In this case, a match occurs when the second octet of the SA in a packet being filtered has
a value in the range of 24 to 31. See Table 30 (page 324).
Table 30 How the mask defines a match
Bit position in the octetLocation of octet
1248163264128
11111000SA in ACE
11100000Mask for SA
0/10/10/111000Corresponding Octet of a Packet's
SA
The shaded area indicates bits in the packet that must exactly match the bits in the source address in the ACE.
Wherever the mask bits are ones (wildcards), the corresponding address bits in the packet can be any value,
and where the mask bits are zeros, the corresponding address bits in the packet must be the same as those in
the ACE. Note: This example covers only one octet of an IPv4 address. An actual ACE applies this method to
all four octets of the address.
324 IPv4 Access Control Lists (ACLs)