IPv4 Access Control Lists (ACLs)

Planning an ACL Application

ACL mask to overlap one bit, which allows matches with hosts in two subnets: 31.30.224.0 and 31.30.240.0.

Bit Position in the Third Octet of Subnet Mask 255.255.240.0

Bit Values

128

64

32

16

8

4

2

1

 

 

 

 

 

 

 

 

 

Subnet Mask Bits

1

1

1

1

n/a

n/a

n/a

n/a

Mask Bit Settings Affecting

0

0

0

 

n/a

n/a

n/a

n/a

1 or 0

Subnet Addresses

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

This ACL supernetting technique can help to reduce the number of ACLs you need. You can apply it to a multinetted VLAN and to multiple VLANs. However, ensure that you exclude subnets that do not belong in the policy. If this creates a problem for your network, you can eliminate the unwanted match by making the ACEs in your ACL as specific as possible, and using multiple ACEs carefully ordered to eliminate unwanted matches.

■Every IPv4 address and mask pair (source or destination) used in an ACE creates one of the following policies:

•Any IPv4 address fits the matching criteria. In this case, the switch automatically enters the address and mask in the ACE. For example:

access-list 1 deny any

produces this policy in an ACL listing:

Address Mask

0.0.0.0255.255.255.255

This policy states that every bit in every octet of a packet’s SA is a wildcard, which covers any IPv4 address.

•One IPv4 address fits the matching criteria. In this case, you provide the address and the switch provides the mask. For example:

access-list 1 permit host 10.28.100.15 produces this policy in an ACL listing:

AddressMask

10.28.100.150.0.0.0

This policy states that every bit in every octet of a packet’s SA must be the same as the corresponding bit in the SA defined in the ACE.

9-30