ACL help!!!

[shan-cao]

Hi, I have a problem with the following application:

router A can receive many route through rip protocol:

196.1.1.0/24,196.1.2.0/24,196.1.3.0/24,196.1.4.0/24,196.1.5.0/24,196.1.6.0/24,196.1.7.0/24,196.1.8.0/24,196.1.9.0/24,196.1.10.0/24. I just wish routerA can be configured a filter that allow only network 196.1.2.0/24,196.1.8.0/24 and 196.1.10.0/24. I wish the filter can be configured with minimal number of lines.

I see the configuration as following:

router rip

distribute-list 1 in serial 0

!

access-list 1 permit 196.1.0.0 0.0.10.255.

!

I can not understand the line: 0.0.10.255. what's mean with the line? Who can give me a explain or a cisco web link for that? Thanks a lot!

Sincerely

[andreas.schnell]

The line:

0.0.10.255

.. is a Wildcardmask, which is used together with ACL's (and OSPF too).

So the statement:

access-list 1 permit 196.1.0.0 0.0.10.255

... means basically that the IP Range:

196.1.0.0 - 196.1.10.255 is allowed to pass this ACL.

Hope it was helpful?!

cheers

Andy

[shan-cao]

Hi, Thanks for your response. But the filter only allows the 196.1.2.0/24, 196.1.8.0/24,196.1.10.0/24 to be received by the router A. How to do it?

the line: 0.0.10.255 isn't a normal wildcardmask.

Sincerely

[andreas.schnell]

I guess I don't actually understand your question *g*

Do you ask how to block 196.1.2.0/24, 196.1.8.0/24 and 196.1.10.0/24 ??

Additionally... Why do you think that 0.0.10.255 is not a normal Wildcardmask?

cheers

Andy

[shan-cao]

:),normal wildcardmask is always configured as .3, .15, .7 , .31, 63, 127, 255.

Honestly, I never see this type wildcardmask(0.0.10.255) in my network career.

Sincerely

[andreas.schnell]

--quote--

:),normal wildcardmask is always configured as .3, .15, .7 , .31, 63, 127, 255.

Honestly, I never see this type wildcardmask(0.0.10.255) in my network career.

--unquote--

Ahh.. allright, now I see what you mean.

After seeing it in binary, you're right. It's really unusual.

But dgham delivered a pretty good answer. Thanks for that. :-)

cheers

Andy

[dgahm]

Access lists use wildcard masks meaning that a binary 1 in a bit position is a don't care, and a binary 0 is a must match.

In the 3rd octet mask you have 10, which is 00001010. Since the address for the 3rd octet is 0, this means that all address bits must be 0, except for the bits in the postions with the mask 1s.

The decimal valuse of those binary positions is 2 and 8. If we look at all possible combinations of those 2 bits, we will get the addresses that will pass.

In decimal those are 0,2,8,10, so those are the only values in the 3rd octet that will pass.

So your distribution filter will work, since the 196.1.0.0 is not being sent.

[shan-cao]

:),Thanks for your explain. I have totally get it.