IP ACL within a VLAN

Hallo Sascha,

This is the the typical confusion of Subnet Masks vs. Wildcards in any kind of ACL - it exists since any kind of network ACL and filtering were introduced. 

===

Take a position where you have a VERY structured IP addressing scheme based on 10.0.0.0, and you use the middle two octets to signify where the network is, and what type of network.

Using the high half of the second octet is north. low half south, and use use even numbers for private networks, and odd for public. The third octed being odd means it is a wireless network.

You want to permit private wireless in the south.

Thats 10.0xxxxxx0.xxxxxxx1.don't care

or acces 10 per ip 10.0.1.0 0.129.1.255 simple all those condidtions in one line of an access list.

TBH I quite like it as it is, but I have been working with it for a number of years so am familiar. What this all means is that I can see that it is a mask, and that it is legit (mask must be contiguous so allowed values are 128 192 224 240 248 252 254 and 255) or that is is a wild card. The way it gets presented makes it obvious as well.

10.23.0.0 255.255.0.0 is *clearly* a mask.

0.0.23.46 255.255.0.0 is clearly a wild card, as the bits that are a 1 in the wildcard are zero in the "address".

It may look confusing, but once you get the hang, it makes sense.

===

Yes, it's a step from IP subnetting to filtering. I hope this clarifies things.

Regards,

-Kurt.