Okay....I've been avoiding this post like the plague, but I still don't think that I have a real good grasp on this so here it goes:
Let's say that I want to allow 192.168.16.52 and 192.168.19.56 networks access to telnet. There are network 192.168.3.0 - 15.0 in between. Aside from allowing the 2 subnets specifically, I want to create a mask that allows the 2 only.
16 = 3rd octet = 00010000
19 = 3rd octet = 00010011
52 = 00110100
56 = 00111000
So, my acl would look like:
access-list permit tcp 192.168.16.0 0.0.15.?
I've found extreme examples from INE that state to AND the 2 addresses and then XOR for the mask:
Yes. The reason to add the binary version of the IP hosts together is to compare the bits value.
In your example the 1st and 2nd octet was obvious that matched. That's way we only compared the 3rd and 4th octet.
Let's take another example :
As the privious example the first to octets match so they will be as they are on the network (10.1 ) and the wildcard will be 0.0 - why ? because we want an exact match , remember if you use set a bit 0 on the wildcard the bit on the network must match, if you set the wildcard bit to 1 the network bit can be anything ( 0 or 1 ).
Does that look right? The other question that I had is when you do this, does it really guarantee only these 3 hosts will get through? Or, does this type of mask still allow other hosts in (like too large of a summary)?
This is actually a pretty cool feature, i didn't even know it existed until I was looking for a solution to advertise a subnet (prefix in BGP talk), only if a certain condition existed. This is exactly what conditional advertisements does
j ai une question j ai achete un routeur cisco 887VA-k9 , je le configuré avec la configuration ci- dessous
si je le lier avec mon pc portable sur l un de ses ports directement ça marche toute est bien ( la connexion internet + m...
Attached policy provides CLI access to the Cisco 4G router over text messaging. Two files are in the attached .tar file:
2. PDF with instructions on how to load and use the .tcl file.