Numbered and named ACLs, wildcard masks

There are two methods you can use to configure Access Control Lists (ACLs) on a router. The two types of ACL configurations are:

• Numbered ACLs - identifies the ACL by a particular number.
• Named ACLs - identifies the ACL by an arbitrary name that you define. Both numbered and named ACLs allow you to configure either a Standard or Extended ACL.

Numbered ACLs

With numbered ACL configurations, Standard ACLs use specific number ranges, and Extended ACLs use different number ranges. Both Standard and Extended numbered ACLs have two ranges each:

• a “normal” number range
• an additional set of numbers (also called the “expanded range”)

You can use either range to create the same type of ACL; the range you choose doesn’t change how the ACL works.

Type of ACL	Normal Number Range	Additional Number Range
Standard numbered ACL	1-99	1300-1999
Extended numbered ACL	100-199	2000-2699

As you can see above, there are two ranges for both Standard and Extended ACLs: the normal number range and the additional (“expanded”) number range. Whether you use the normal range or the additional range for either a Standard or Extended ACL does not make any difference. It is important that you have these ranges memorized for the CCNA 200-301 v1.1 exam.

Sidenote

History on the additional ranges

The reason there’s a gap between the normal ranges and the additional (“expanded”) ranges is historical. ACL numbers in between those ranges were used for different protocols in older IOS versions. The additional number ranges were added later to expand the set of numbered ACLs you can configure.

Named ACLs

With named ACL configurations, you give your ACL a name. This makes it more descriptive and easier to identify in the running configuration.

One key difference is that when you create a named ACL, you must explicitly specify whether it’s a Standard or Extended ACL.

Another advantage of named ACLs is that they’re easier to edit and modify after they’ve been created (you’ll see why when we walk through configuration details).

Wildcard masks

Before getting into the configuration of Standard and Extended named or numbered ACLs, we need to review wildcard masks, since they’re required when configuring any type of ACL.

We briefly touched on wildcard masks in Chapter 3.7.2 How to configure OSPFv2 on Cisco routers, since they’re used to configure network statements when enabling OSPF on a router interface.

Wildcard masks let you match:

• one specific IP address
• all IP addresses in a particular subnet (a.k.a. “network”)
• a range of IP addresses that spans multiple subnets

Which of these you match depends on the wildcard mask you use.

When working with wildcard masks, you’re comparing the binary bits of an IP address (or network address) against the wildcard mask.

For example, suppose we want to cover all IP addresses in a subnet that uses a /30 subnet mask (that is, 255.255.255.252 in dotted decimal notation). In binary, that subnet mask looks like this:

/30 =

11111111.11111111.11111111.11111100

Please review Chapter 3.1.1 IPv4 Addressing and Chapter 3.2 Subnetting and Variable Length Subnet Masks (VLSM) if you feel that you need a refresher on binary, subnet masks, and subnetting.

The wildcard mask is the inverse of the subnet mask:

Wildcard Mask for a /30 or 255.255.255.252 =

00000000.00000000.00000000.00000011

Notice how the bits are inverted in the wildcard mask. The wildcard mask for 255.255.255.252 becomes 0.0.0.3. The decimal value of “3” in the 4^th octet comes from adding up the positional values where the “1s” are set: (2 + 1 = 3). The logic for a wildcard mask is the opposite of a subnet mask:

• Wherever there is a “0” in a wildcard mask, those bits must match exactly. In other words, the binary bits in the packet’s IP address should match this entry of the ACL exactly.
• Wherever there is a “1”, those bits are ignored. That means any value within that portion of the packet’s IP address will be accepted and counted as a match. To define a range with a wildcard mask, you set some bits to 0 (must match) and some bits to 1 (ignored).

The image below displays the network address of 192.168.1.0 and shows which bits must match exactly vs. which bits will be ignored (meaning any value in that bit range will be accepted and counted as a match):

Image 206

Image Title - Logic for matching values within the 192.168.1.0 network address and a Wildcard Mask of 0.0.0.3

As you can see above, the IP addresses that would count as a match (if this wildcard mask were used in an ACL statement) would be the range 192.168.1.0 - 192.168.1.3. Any IP address outside that range would not match.

• The first 3 octets must match exactly.
• In the 4^th octet, only the range listed above is accepted as a match.

Everything being discussed here about wildcard masks also applies to configuring OSPF network statements. The difference is the purpose: with OSPF, the wildcard mask identifies which router interface(s) should participate in OSPF, which also allows the network associated with that interface(s) to be advertised to your neighbor.

What if we wanted to match all IP addresses within the 192.168.1.0/24 network? First, convert the subnet mask from dotted decimal notation into binary:

/24 or (“255.255.255.0”) =

11111111.11111111.11111111.00000000

Then invert the bits to derive the wildcard mask:

Wildcard Mask for a /24 or 255.255.255.0 =

00000000.00000000.00000000.11111111

So the wildcard mask that covers this range is 0.0.0.255.

Remember:

• Bits under “0” must match exactly.
• Bits under “1” are ignored, so any value is accepted.

If you think about any /24 network, the entire 4^th octet is host bits. For the 192.168.1.0/24 network, that means the range is 192.168.1.0 - 192.168.1.255. In the context of a 0.0.0.255 wildcard mask, this means any value within the 4^th octet would be accepted as a match, because it is ignored. As long as the values within the 1^st, 2^nd, and 3^rd octet (192.168.1) match exactly, the packet’s IP address will count as a match.

Matching host addresses in an ACL

If you want to match only one IP host address in an ACL, use the wildcard mask 0.0.0.0. This means that when the router inspects a packet, all 4 octets of the IP address must match the ACL entry exactly.

Easy method to find the right wildcard mask

As we also discussed in Chapter 3.7.2 How to configure OSPFv2 on Cisco routers, there’s a quick way to find the wildcard mask for a given subnet mask.

If you know the subnet mask of the network you want to match, subtract it from 255.255.255.255. The result is the wildcard mask.

For example, to determine the wildcard mask for a subnet mask of 255.255.255.0 (/24):

$$\mathrm{255.255.255.255}$$

$$\frac{-\mathrm{255.255.255.0}}{\mathrm{0.0.0.255}}$$

If you wanted to determine the wildcard mask for a subnet mask of 255.255.255.248 (/29):

$$\mathrm{255.255.255.255}$$

$$\frac{-\mathrm{255.255.255.248}}{\mathrm{0.0.0.7}}$$