Hi, I think The trick is to understand what is valid subnet and then go for wildcard mask for it. So, access-list 1 permit 10.44.38.0 0.0.3.255 <<< This is talking of /22 network, so pair is  0-3,4-7,8-11,...,36--39 ,40--43>>> so 10.44.40.18 will be ...