Access List Wildcard Error
So one of the issues coming up that was a minor but easily fixable was an ACL change that was widespread. Throughout this change a host needed to be allowed to several hosts in multiple octets. An issue that they had was the ACL would change when they looked up the ACL list and didn't know why.
ACL Request Example:
Permit connection from My Personal PC to all Active Directory Servers.
MY PC : 10.10.10.11
Active Directory Servers: 192.168.X.9 - 12
****Each store is on the 192.168.X.9 through 12. The "X" represents the number relevant to the store location.
The ACL that was placed:
access-list 100 permit ip host 10.10.10.11 192.168.1.9 0.0.0.255.3
Show access-list results:
20 permit ip host 10.10.10.11 192.168.0.8 0.0.255.3
So what happened? The ACL was put in place and they expected to see a "9" as the starting digit. Allowing an increment through 9, 10, 11, 12 for access.
The output is the way it is because of what I like to say as the "multiple" factor.
In IP world we always include "0" zero as a number or in this case the first starting number of each range. Knowing we are covering a range from 0 - 3 or 9 - 12. That is a total of "4" four numbers.
So since it is a case of 4 numbers we must increment either our ACL Wildcard to include 4 which would be from 8 to 12.
New ACL
access-list 100 permit ip host 10.10.10.11 192.168.1.8 0.0.255.4
ACL Request Example:
Permit connection from My Personal PC to all Active Directory Servers.
MY PC : 10.10.10.11
Active Directory Servers: 192.168.X.9 - 12
****Each store is on the 192.168.X.9 through 12. The "X" represents the number relevant to the store location.
The ACL that was placed:
access-list 100 permit ip host 10.10.10.11 192.168.1.9 0.0.0.255.3
Show access-list results:
20 permit ip host 10.10.10.11 192.168.0.8 0.0.255.3
So what happened? The ACL was put in place and they expected to see a "9" as the starting digit. Allowing an increment through 9, 10, 11, 12 for access.
The output is the way it is because of what I like to say as the "multiple" factor.
In IP world we always include "0" zero as a number or in this case the first starting number of each range. Knowing we are covering a range from 0 - 3 or 9 - 12. That is a total of "4" four numbers.
So since it is a case of 4 numbers we must increment either our ACL Wildcard to include 4 which would be from 8 to 12.
New ACL
access-list 100 permit ip host 10.10.10.11 192.168.1.8 0.0.255.4
Show access-list results:
30 permit ip host 10.10.10.11 192.168.0.8 0.0.255.4
As we can see it remains 8 because we used the correct increment value for the wildcard mask. Just a reminder we can also create two separate ACL's that will allow seperately 9, 10, 11 and then one ACL for 12.
Comments
Post a Comment