Hi,
The use of wildcard masks in the network command is controversial and in my opinion, Cisco should not have done that in the first place. It unnecessarily confuses people because they think they can use any wildcard mask in the network command while in reality, the mask must either be a subnet mask (the command will accept it), or it must be a wildcard mask that corresponds to a valid subnet mask. It is not possible to use wildcard masks in the network command that do not directly correspond to a valid subnet mask.
In ACLs, that's a different story. In an ACL, you compare the source/destination IP address of packets to the addresses in the ACL entry. You need to have a means of saying what bits you want to compare between the packet addresses and the ACL entry addresses, and which bits you want to ignore. This is accomplished by the use of wildcard masks - in an ACL entry, a wildcard masks tells the router which bits of the packet's addresses shall be compared, and the addresses in the ACL entry tell the router what value should the compared bits be set to. Note that this has no direct relation to subnet masks at all. I may want, for whatever purposes, compare only the 1st, 8th-15th and 23rd bit. This does not create any sensible subnet, though the need to compare just these bits may be perfectly valid. That is why subnet masks and wildcard masks are two different things - because they have different purposes.
Best regards,
Peter
