Write one ACL line that matches only the odd-numbered /24 subnets in 10.1.0.0/16. How does it work?
Show the answer
Say this first
10.1.1.0 0.0.254.255. The third octet of the wildcard is 254, which is 11111110 in binary, so only
the lowest bit of the third octet is checked, and the base address says that bit must be 1. Every
odd third octet (1, 3, 5 up to 255) matches and every even one fails. Wildcard bits do not have to be
contiguous, which is what makes this possible in one line.
Go deeper
The method
- Write the values you want to match in binary.
- Bits that are the same in all of them: wildcard 0, and copy that bit into the base address.
- Bits that differ: wildcard 1.
- Check the result: the line matches every combination of the "1" bits. If your set is not every combination, you will match extra subnets and need more than one line.
Worked examples
| Goal | Line | Why |
|---|---|---|
| Odd /24s in 10.1.0.0/16 | 10.1.1.0 0.0.254.255 | only bit value 1 of octet 3 checked, must be 1 |
| Even hosts in 192.168.1.0/24 | 192.168.1.0 0.0.0.254 | last bit must be 0: .0, .2, up to .254 |
| 192.168.4.0/24 and 192.168.6.0/24 | 192.168.4.0 0.0.2.255 | 4 = 00000100, 6 = 00000110, only bit value 2 differs |
| 10.1.1.0, .3.0, .5.0, .7.0 (/24s) | 10.1.1.0 0.0.6.255 | 1, 3, 5, 7 = 00000xx1: bit values 2 and 4 vary |
| VLAN 50 at every site, plan 10.site.vlan.0/24 | 10.0.50.0 0.255.0.255 | second octet ignored, third must be 50 |
The last one is the real-world use: when the addressing plan encodes site and function in fixed octets, one line matches "the voice subnet at every site" for QoS, PBR or a security policy.
Where it breaks
Subnets 1, 3 and 5 only cannot be one line, because the varying bits also produce 7. Non-contiguous
wildcards are an IOS ACL feature: prefix lists, ASA ACLs and cloud security groups only take
contiguous prefixes. Always add a remark line, because the next engineer will not decode 0.0.6.255
at a glance.
They will ask next
Why can't a prefix list do this?
A prefix list matches a network and a prefix length, which is always a contiguous run of fixed leading bits. It cannot say "ignore the second octet but check the third".
Does IOS store the address exactly as you typed it?
IOS clears the bits that the wildcard ignores, so if you type a host address with a subnet wildcard, the line is shown with the network address. Check
show access-listsafter entering clever wildcards to see what was really stored.
Traps
- Assuming any set of subnets fits in one line. Test every combination of the wildcard's 1 bits.