Choices for Using Wildcard Masks

Transcription

1 Choices f Using Wildcard Masks 1 Wildcard masks are usually set up to do one of four things: 1. Match a specific host. 2. Match an entire subnet. 3. Match a specific range. 4. Match all addresses. 1. Matching a specific host. F standard access lists: Access-List 10 permit Access-List 10 permit Access-List 10 permit host F extended access lists: Access-list 110 deny ip any Access-list 110 deny ip host any 2. Matching an entire subnet Example 1 : Address: Subnet Mask: Access-list 25 deny Example 2 : Address: Subnet Mask: Access-list 12 permit Example 3 Address: Subnet Mask: Access-list 125 deny udp any (standard ACL s assume a mask) 3. Match a specific range Example 1: Address: Subnet Mask: custom mask: Access-list 125 permit udp any Example 2: Address Range: to wildcard: Access-list 125 deny ip any (This ACL would block the lower half of the subnet.)

2 Example 3: Address: to wildcard Access-list 125 permit ip any 4. Match everyone. F standard access lists: Access-List 15 permit any Access-List 15 deny F extended access lists: Access-List 175 permit ip any any Access-List 175 deny tcp any Creating Wildcard Masks Just like a subnet mask the wildcard mask tells the router what part of the address to check igne. Zero (0) must match exactly, one (1) will be igned. The source address can be a single address, a range of addresses, an entire subnet. As a rule of thumb the wildcard mask is the reverse of the subnet mask. Example #1: IP Address and subnet mask: IP Address and wildcard mask: All zero s ( ) means the address must match exactly. Example #2: (This address must match exactly.) One s will be igned. Example #3: (Any subnet address will match to ) This also wks with subnets. Example #4: IP Address and subnet mask: IP Address and wildcard mask: (Subtract the subnet mask from to create the wildcard) Do the math = 0 (This is the inverse of the subnet mask.) = 31

3 Example #5: IP Address and subnet mask: IP Address and wildcard mask: Do the math... (This is the inverse of the subnet mask.) 3 Wildcard Mask Problems 1. Create a wildcard mask to match this exact address. IP Address: Subnet Mask: Create a wildcard mask to match this range. IP Address: Subnet Mask: Create a wildcard mask to match this host. IP Address: Subnet Mask: Create a wildcard mask to match this range. IP Address: Subnet Mask: Create a wildcard mask to match this range. IP Address: Subnet Mask: Create a wildcard mask to match this exact address. IP Address: Subnet Mask: Create a wildcard mask to match this range. IP Address: Subnet Mask: Create a wildcard mask to match this range. IP Address: Subnet Mask: Create a wildcard mask to match this host. IP Address: Subnet Mask: Create a wildcard mask to match this range. IP Address: Subnet Mask: Create a wildcard mask to match this range. IP Address: Subnet Mask: Create a wildcard mask to match this range. IP Address: Subnet Mask:

4 Wildcard Mask Problems 4 Based on the given infmation list the usable source addresses range of usable source addresses that would be permitted denied f each access list statement. 1. access-list 10 permit access-list 5 permit any 3. access-list 125 deny tcp host fragments 4. access-list 11 deny access-list 108 deny ip access-list 171 deny any host fragments 7. access-list 105 permit any 8. access-list 109 permit tcp host eq access-list 111 permit ip any any 10. access-list 195 permit udp access-list 110 permit ip access-list 120 permit ip access-list 130 permit ip access-list 140 permit ip

5 15. access-list 150 permit ip access-list 101 Permit ip Answer: 17. access-list 185 permit ip access-list 160 deny udp gt access-list 195 permit icmp access-list 10 permit access-list 190 permit tcp any 22. access-list 100 permit ip Wildcard Mask Problems Based on the given infmation list the usable destination addresses range of usable destination addresses that would be permitted denied f each access list statement. 1.access-list 125 deny tcp host fragments 2. access-list 5 permit any any 3. access-list 150 permit ip access-list 120 deny tcp access-list 108 deny ip access-list 101 deny ip

6 7. access-list 105 permit any access-list 120 permit ip access-list 160 deny udp eq access-list 150 permit ip Prepared by: ENGR. CECILLE D.ATIENZA-VENAL CCNA Instruct