BROCADE IP PRIMER

Chapter 14: Security, Redundancy and MoreLet's look at an example. Suppose you had a Class C network—192.168.100.0/24. You want to create an ACL that references all 254 usableaddresses in that range. To reference it as a network, you know that you woulduse 192.168.100.0 followed by a subnet mask of 255.255.255.0. The 1s inthe subnet mask demarcate the network portion of the address. The 0s showyou the host portion. With an inverse mask, you would use 1s to designate theportion of the address that changes. In this case, you know that all of yourdesired addresses will start with 192.168.100. It's the last octet that willchange. The wildcard mask would be 0.0.0.255.(192) (168) (100) (0)1100 0000 . 1010 0000 . 0110 0100 . 0000 0000(0) (0) (0) (255)0000 0000 . 0000 0000 . 0000 0000 . 1111 1111In ACLs, “192.168.100.0 0.0.0.255” would include every address from192.168.100.0 (the network address) through 192.168.100.255 (the broadcastaddress). The 1s represent the bits that are variable (e.g., that canchange).“Why don't they just use subnet masks?!” I hear you cry. There are certainlymany other students of network engineering that have begged that samequestion. The question has one answer, really: flexibility. One of the tricks ofthe wildcard mask is that it doesn't have to be contiguous. We can place 0sand 1s where we please. It doesn't have to be in a continuous stream.Let's take another example. You have two networks that you want to identifywithin an ACL. One is 10.4.1.0/24, and the other is 10.6.1.0/24. You want tobe able to reference all addresses in both networks. Now, you could just createtwo lines: “10.4.1.0 0.0.0.255” and “10.6.1.0 0.0.0.255.” But you're usingwildcard masks, and you can be more efficient than that! How about this:“10.4.1.0 0.2.0.255.”(10) (4) (1) (0)0000 1010 . 0000 0100 . 0000 0001 . 0000 0000(0) (2) (0) (255)0000 0000 . 0000 0010 . 0000 0000 . 1111 1111“What a minute!” you say, “You stuck a 1 in the 15th bit all by itself!” That'strue. And that one tells the ACL processor that this bit can change. It has thepotential to change the value of the second octet. “10.4.1.0 0.2.0.255” willtranslate to all of the addresses from 10.4.1.0 through 10.4.1.255 and10.6.1.0 through 10.6.1.255. When that 15th bit is a value of zero, the second290 Brocade IP Primer