Hi Mahesh,
It seems to me the wildcard mask in this ACL has not been converted from subnet notation to the wildcard notation, and as a result, the ACL matches a very peculiar and unintended set of sources. The 255 octets of the wildcard mask signify that corresponding octets of an IP address may be arbitrary. Regarding the last octet of the wildcard mask, the situation in binary is as follows:
27 in binary is 00011011
224 in binary is 11100000
The matching is then as follows:
00011011
iiimmmmm
where i means ignore and m means match
Notice that in this octet, the wildcard mask requires that the IP address matches on the rightmost 5 bits carrying the total value of 27, and the leftmost 3 bits (carrying values of 32, 64 and 128) will not be matched, meaning they can be arbitrary. By enumerating all their combinations of set/not-set and evaluating the resulting octet value, you get 8 values:
27+0=27
27+32=59
27+64=91
27+96=123
27+128=155
27+160=187
27+192=219
27+224=251
So the set of sources this ACL would match has the following symbolic format:
...
Best regards,
Peter
