CCNA Complete Guide 2nd Edition.pdf - Cisco Learning Home

- Do not confuse wildcard masks with subnet masks!
0s indicate bits in the address that must be exactly matched.
1s indicate bits in the address that do not need to be matched. Also known as “don’t care” bits.
- Below lists 2 wildcard mask examples:
0.0.0.0 .00000000.00000000.00000000.00000000. The entire IP address must be matched.
0.0.0.255 00000000.00000000.00000000.11111111. Just the first 24 bits must be matched.
- A wildcard mask can be calculated by subtracting the subnet mask from 255.255.255.255:
i) To match all hosts in a network with subnet mask of 255.255.240.0, the wildcard mask
is 255.255.255.255 – 255.255.240.0 = 0.0.15.255.
ii) To match all hosts in a network with subnet mask of 255.255.128.0, the wildcard mask
is 255.255.255.255 – 255.255.128.0 = 0.0.127.255.
Extended IP Access Lists
- Extended ACLs provide complex and powerful matching logic with the ability to examine many
parts of a packet. A match of an extended access list entry requires that all defined matching
parameters are matched. Action will be taken after the matching process.
- Below lists the syntax of an extended access list statement:
access-list {access-list-number} {deny | permit} {protocol} [host] {source-addr}
[source-wildcard] [src-port] [host] {destination-addr} [destination-wildcard] [dst-port]
- Extended ACL examples:
access-list Statement What It Matches
access-list 101 deny ip any host 172.16.1.1 Any IP packet, any source
IP address, with a
destination of 172.16.1.1.
access-list 101 deny tcp any gt 1023 host 172.16.1.1 eq 23 TCP segments with any
source address, source port
greater than 1023, with a
destination of 172.16.1.1
and destination port of 23.
access-list 101 deny tcp any host 172.16.1.1 eq 23 Same as previous example,
but any source port can be
matched as the source port
parameter is removed.
access-list 101 deny udp 172.16.2.0 0.0.0.255 lt 1023 any UDP segments with a source
address in network
172.16.2.0, source port less
than 1023, with any
destination IP address.
- Below lists the Cisco IOS ACL operators used for matching TCP and UDP port numbers:
lt Less than
gt Greater than
eq Equal to
neq Not equal to
range Range of port numbers
137
Copyright © 2008 Yap Chin Hoong
yapchinhoong@hotmail.com