Allowing Network host .253 from each /24 subnet.

[Bouki]

Hi Guys,

I have /16 network  subneted to /24 for each store, I need to allow access from the network host .253  from each /24 subnet to a specific services on the DMZ (resides on Palo Alto) and I need one ACE entry in the access-list permit the .253 form each /24 subnet.

Mother subnet: 10.184.0.0/16

Store 1: 10.184.0.0/24

Store 2: 10.184.1.0/24

.

.

.

Your help is much appreciated.

Many thanks.

Said

[chrihussey · Accepted solution]

Think this would work:

!
ip access list 1 permit 10.184.0.253 0.0.255.0
!

It is a simple source based ACL, but the mask gives you the idea.

Hope this helps

Regards

[Bouki]

Brilliant stuff, Many thanks, tested and it is working.

Can I ask you to explain how does it work please? how did you come up with the access-list?

[chrihussey]

In binary terms, when you create a mask, the ones are a must match, the zeros mean it doesn't matter. So for example:

If the 192.168.1.X network has a mask of 255.255.255.0 and 255 in binary is 11111111, so the mask in binary is 11111111 11111111 11111111 0000000. Meaning 192.168.1 is a must match, but the host (4th octet) can be anything from 1 - 255.

In the Cisco world access lists use reverse masks. So the reverse mask in an access list to designate the entire 192.168.1.1-255 subnet would be 0.0.0.255, or 00000000 00000000 00000000 11111111.

In your case you wanted to have the 1st, 2nd and 4th octet remain the same with the 3rd octet be variable, so 10.184.0.253 0.0.255.0 is 00000000 00000000 11111111 00000000.

Hope that makes sense.

Below is a Cisco link that may prove helpful.

https://www.cisco.com/c/en/us/support/docs/ip/routing-information-protocol-rip/13788-3.html

Regards

[Bouki]

Much appreciated and I really do mean it.

Bless you.

[Karsten Iwen · Accepted solution]

As you are asking on a Cisco-forum, I expect that you don't want to control that traffic on the PA-firewall, but on a device in front of that? What kind of device is that?

If it is an IOS router:

permit ip 10.184.0.253 0.0.255.0 DESTINATION

If it is on an ASA:

permit ip 10.184.0.253 255.255.0.255 DESTINATION