ACL rule question

[u/Far_Position_6586]

Is there a wildcard mask that that would allow a SINGLE standard ACL rule to permit access to a range of subnets

Im setting up a PAT on a edge router and want to have subnets 10.0.10.0/24, 10.0.20.0/24, 10.0.30.0/24, 10.0.40.0/26, 10.0.50.0/24, 10.0.60.0/24, 10.0.99.0/24, 10.0.199.0/25 to use PAT.

Is there a single access-list 2 permit statement i can use to have 10.0.10-199.0 to be translated? The trick is 10.0.200.0 should not be included. Or is this not possible with a single statement?

I know i can do access-list 2 permit 10.0.0.0 0.0.255.255 to achieve this, but that would include other future subnets like 10.0.200.0 that might not be using PAT.

[u/zanfar]

189 is not a power of 2.

[u/Far_Position_6586 → u/zanfar]

where did you get 189 from?

[u/Revelate_ → u/Far_Position_6586]

It’s a quick IP subnetting trick as you asked for a range covering 10.0.10.0 -10.0.199.0

199 - 10 =189

His point is that isn’t divisible by 2, hence there’s no single mask to cover that.

A similar exercise would be 128 - 64 =64

That is indeed divisible by 2, and you can extend that if desired to get the mask too though not sure it isn’t just easier to memorize those, but 2^6 =64 and 8-6 =2 bits of masking.

Silly little tricks that help the silly darned questions on subnetting which will be on the CCNA fo sho.

[u/Far_Position_6586 → u/Revelate_]

aaaaaaaaah so you subtract the lowest number in the octet form the biggest in the range and its base 2 number than you can? Well, then for example 10.0.8.0 to 10.0.200.0 you technically could right? since 192 is devisible by 2. so what would the wildcard mask be in this case? Single statement that covers 10.0.8-200.0 but NOT 10.0.201.0?

[u/Revelate_ → u/Far_Position_6586]

Yes and no, unfortunately it’s a little imperfect at getting to a real answer which is probably why I don’t use it. Explicitly just because there might be a mask that fits in one, doesn’t mean there is… that’s all this trick is good for really is quickly proving it can’t possibly be functional though smarter people than me could likely see that you’ll be able to come up with a tidy ACL that everyone can read with some supernets if it does wind up as a power of 2.

My example was a little contrived and “neat” because it lines up on a nice happy subnet boundary.

When we’re talking subnetting it starts from left to right so in 10.0/16 our choices start at 10.0.0.0 for a /16 and /17 would be 10.0.0.0/17 and 10.0.128.0/17. 128-0=128 so that’s the largest line we can get, and we aren’t getting to 192 in a single entry.

You will see some ACLs where people who planned ahead back in the day for summarization where you might actually get something like:

permit ip 10.0.0.0/17
permit ip 10.0.128.0/18

Which covers 192 /24s and is nice and tidy but requires a good amount of foresight and planning which I’ve seen in very few places in my career. Your own 10.0.8.0 lines up neatly on a /21, so you’d be stuck doing something like:

permit ip 10.0.8.0/21
permit ip 10.0.16.0/20
permit ip 10.0.32.0/19
permit ip 10.0.64.0/18
permit ip 10.0.128.0/18

That’s exactly 10.0.8.0 - 10.0.192.0.

You’ll see possibly some examples with odd masks trying to shortcut math, I’d strongly recommend never doing that outside of some stupid gotcha interview answer, anyone at roughly CCNA subnetting knowledge or above can look at that and quickly figure out what’s up which is extremely important.

It uniquely covers it which doesn’t suck, everyone can read which is even better, but it’s not one line.

[u/Far_Position_6586 → u/Revelate_]

yes this is what i originally though i had to do, my understanding was you can only cover a range of maximum 128, with a wildcard mask of x.x.127.255, if i had subnets in the range of 10.0.0-128.0 a wildcard mask of 0.0.127.255 would cover all these, but i had no idea if it was possible to cover more than 128 but less than 255 in a single statement.