IPv4 Access Control Lists (ACLs)
Planning an ACL Application
ACL mask to overlap one bit, which allows matches with hosts in two
subnets: 31.30.224.0 and 31.30.240.0.
Bit Position in the Third Octet of Subnet Mask 255.255.240.0
Bit Values
128 64 32 16 8 4 2 1
Subnet Mask Bits
Mask Bit Settings Affecting
Subnet Addresses
1
0
1
0
1
0
1 n/a
n/a
n/a
n/a
n/a
n/a
n/a
n/a 1 or 0
This ACL supernetting technique can help to reduce the number of ACLs
you need. You can apply it to a multinetted VLAN and to multiple VLANs.
However, ensure that you exclude subnets that do not belong in the policy.
If this creates a problem for your network, you can eliminate the
unwanted match by making the ACEs in your ACL as specific as possible,
and using multiple ACEs carefully ordered to eliminate unwanted
matches.
■ Every IPv4 address and mask pair (source or destination) used in an
ACE creates one of the following policies:
• Any IPv4 address fits the matching criteria. In this case, the
switch automatically enters the address and mask in the ACE. For
example:
access-list 1 deny any
produces this policy in an ACL listing:
Address Mask
0.0.0.0 255.255.255.255
This policy states that every bit in every octet of a packet’s SA is a
wildcard, which covers any IPv4 address.
• One IPv4 address fits the matching criteria. In this case, you
provide the address and the switch provides the mask. For example:
access-list 1 permit host 10.28.100.15
produces this policy in an ACL listing:
Address Mask
10.28.100.15 0.0.0.0
This policy states that every bit in every octet of a packet’s SA must
be the same as the corresponding bit in the SA defined in the ACE.
9-30
