subnetmask in access list

[aksher]

172.16.43.128 255.255.255.128

why cant we use 255 in the fourth octet of the netmask.pls give high priority to solve this.

[pcomeaux]

You can use the 255 in the last octet to make your mask look like 255.255.255.255.

This ACL rule would only apply to a single host, not a subnet or network.

The 172.16.43.128 address you provided could be a host on a /24 network or it could be the Subnet Address for a /25 or more network.

Tell us more about what your goals are with this ACL and we can help you find an exact match to your needs.

thanks

peter

[aksher]

that's ok peter, what i actually wanted to know is ,the fourth octet represents an address or a network and why we are not using 0 or 255 in the netmask part...

thanks in advance

[pcomeaux]

Are you trying to block one host?

i.e. 172.16.43.128

or Are you trying to block an entire network?

i.e. 172.16.43.128 to 172.16.43.255

thanks

peter

[aksher]

am trying to block the network

i.e.172.16.43.128 to 172.16.43.255

thanks for your support

[pcomeaux]

Ok - back to your original question.

172.16.43.128 255.255.255.128

You need to understand binary to find the true reason why the mask needs to be 255.255.255.128 to block the range of addresses from 172.16.43.128 to 172.16.43.255.

172 = 10101100

16 = 00010000

43 = 00101011

128 = 10000000

129 = 10000001

130 = 10000010

...

255 = 11111111

notice the only thing that doesn't change is the leading digit in the fourth octet.

The mask indicates what digits you care to match at all times (1s) and the ones you don't care about matching (0s) --> thus you cover a range.

255.255.255.128 has a 1 as the leading digit in the fourth octect - the rest of the digits are 0s, which you don't care about.

If you were to apply a 255.255.255.255 mask to 172.16.43.128, you would care about all digits, and only match on the exact address.

If you were to apply the mask 255.255.255.192 to 172.16.43.128, you would care about the first 2 digits of the 4th octet, which would cover the range 172.16.43.128 to 172.16.43.191.

Hopefully this is the information you sought. Please let us know if you have any follow up questions.

thanks

peter

[aksher]

thanks for your contiuous support.

so there is no need to use wildcard mask as used in routers for firewalls...

[pcomeaux]

Yes, since both devices support IPv4 and to do so requires the proper use of binary math to determine subnet masks and wildcards.

peter