03-09-2015 05:00 AM - edited 03-05-2019 12:58 AM
Hi all
Very silly question but stuck in calculating this below wildcard... any help?
20 permit ip 192.168.0.0 0.0.252.255
Just need to know which IP range would it be allowed?
Much appreciate for help!
Solved! Go to Solution.
03-09-2015 05:20 AM
Correct
03-09-2015 05:05 AM
It will allow 192.168.0.0 - 192.168.3.254
Cheers,
Sam
03-09-2015 05:16 AM
Thanks Sam!
So It would be
192.168.1.0
192.168.2.0
192.168.3.0
all they way down to 192.168.3.254
am I correct?
03-09-2015 05:20 AM
Correct
03-09-2015 05:31 AM
Hi Sam
So this IP address (192.168.48.62) wouldn't fall into the below access list
permit ip 192.168.0.0 0.0.252.255.
Because 3rd octet could only have 0, 1, 2 and 3. Is it correct?
thanks!
03-18-2015 07:15 AM
there is easy way to calculate if you know subnetting :
keep in mind 255.255.255.255 mask , and if u need to convert ur subnet mask to wildcard do math:
255.255.255.255 - ur mask = wildcard mask
255.255.255.252=> 255.255.255.255 -255.255.255.252=0.0.0.3 wildcard mask , thats mean u will have 3 ip available one is broadcast and 2 for hosts .
and vice verse operation from wildcard to subnet mask 255.255.255.255- wildcard mask=ur subnet mask is valid too.
03-09-2015 05:29 AM
Sam,
I am sorry but I am afraid you are not right. Your answer would be correct if the wildcard mask was 0.0.3.255. However, the wildcard mask in question is 0.0.252.255.
252 in binary is 1111-1100. Because in a wildcard mask, a binary '0' means "compare and match" while a binary '1' means "don't care", a wildcard 252 would mean: "Don't care about the topmost 6 bits, but compare and match the lowmost 2 bits". Because the reference value for these two lowmost bits is 0 (this results from the reference IP address 192.168.0.0), in essence, this ACL entry would match only those addresses that, at the same time,
In other words, the matching IP addresses would be 192.168.<4xN>.<anything> where N is an integer between 0 and 63, inclusive, e.g. 192.168.0.1, 192.168.4.2, 192.168.48.23, 192.168.100.50, 192.168.244.111, ...
Would you agree?
Best regards,
Peter
03-09-2015 05:38 AM
Hi Peter
Thanks for your reply!
Could you please explain bit more about what your reply below:
In other words, the matching IP addresses would be 192.168.<4xN>.<anything> where N is an integer between 0 and 63, inclusive, e.g. 192.168.0.1, 192.168.4.2, 192.168.48.23, 192.168.100.50, 192.168.244.111, ...
Kind regards
Shaiq
03-09-2015 06:09 AM
Shaiq,
This is really only an exercise with numbers in binary.
If you take an octet and write it out in binary, you basically indicate the presence of a particular power of two in that octet, starting with 128 and going down through 64, 32, 16, 8, 4, 2, and ending with 1.
Now notice that in a binary number of the form xxxx-xx00, you are saying:
So any number in the binary form of xxxx-xx00 consists of all possible combinations of 128, 64, 32, 16, 8, or 4 present in its binary representation - note that these powers of two as well as their arbitrary sums are always multiples of four. This is what I said when I indicated that the third octet of a matching address must be an integer multiple of four.
That is also what I said when I suggested that the IP address is of the form 192.168.<4xN>.<anything>. The third octet must be a multiple of four. Of course, no octet can be higher than 255, so the highest N you can have is 63, as 63x4 = 252. Any higher N would cause the third octet to be higher than 255 and that would no longer be a valid IP address.
You can also take it from another point of view if you are slightly fluent with binary arithmetics in computers (if not and all what follows is just gibberish to you, you can ignore it safely). Notice that the binary number in the form of xxxx-xx00 has six bits whose value can be arbitrary (the 'x' bits). If I had these six free bits isolated and wrote them down as a new binary number xx-xxxx, they would yield a value between 0 and 63, inclusive (6 bits give you 2^6=64 different combinations, ranging from 0 to 63). Now, you may know that a bit shift operation to the left is equivalent to multiplying the number by two. So if I bit-shifted the xxxxxx one time to the left, I would get a value of xxx-xxx0 (the former value in the range of 0-63 multiplied by 2), and if I bit-shifted the number to the left again, I would get a value of xxxx-xx00 (the former value in the range of 0-63 twice multiplied by two - that is, four). Hence the N, being nothing else than the xx-xxxx, in the range of 0-63, multiplied by 4 as I indicated in my IP address above.
Feel free to ask further!
Best regards,
Peter
03-09-2015 08:00 AM
Peter,
Thanks for your help.
I did work out and understood its the block that it takes as multiple of 4's because 256 - 252 = 4. Hence in 3rd octet it would be 0, 4, 8, 12, 16, 20, 24, 28, 32, 36, 40, 44, 48, and 51 ..etc
I was troubleshooting 192.168.48.0 with wildcard mask 0.0.252.255. But it also allowing all other subnets as well.
So to block only these subnets (192.168.48.0, 192.168.49.0, 192.168.50.0, 192.168.51.0), I need to do each subnet manually (like 192.168.48.0 0.0.0.255 and so on)...???
Regards
Shaiq
03-09-2015 08:14 AM
The proper command to block the subnets you have listed would be:
20 deny ip 192.168.48.0 0.0.3.255
The mask that was in the original post is ambiguous. the above ACL will block 192.168.48.0, 192.168.49.0, 192.168.50.0 & 192.168.51.0.
Regards,
Sam
03-09-2015 05:47 AM
Good catch Peter, thanks. Cisco shows the 192.168.0.0 0.0.252.255 as "%Inconsistent address and mask", it will not input into a route statement. The mask from the original poster should be 0.0.3.255 or 255.255.252.0.
Cheers,
Sam
03-09-2015 07:24 AM
-
03-09-2015 07:26 AM
Thanks Jon, I can see where that is true, the access list with the OP's mask will take into an access list. I would be curious to see how that ACL would be interpreted since it is an invalid mask.
Cheers,
Sam
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide