Cisco Catalyst 2960 Series, Configuration Manual

Page: 1248 / 2288

• IP options--Specifies IP options; one reason to filter on IP options is to prevent routers from being
saturated with spurious packets containing them.
Source and Destination Addresses
Source and destination address fields in an IP packet are two typical fields on which to base an access list.
Specify source addresses to control the packets being sent from certain networking devices or hosts. Specify
destination addresses to control the packets being sent to certain networking devices or hosts.
Wildcard Mask for Addresses in an Access List
Address filtering uses wildcard masking to indicate to the software whether to check or ignore corresponding
IP address bits when comparing the address bits in an access list entry to a packet being submitted to the
access list. By carefully setting wildcard masks, you can specify one or more IP addresses for permit or deny
tests.
Wildcard masking for IP address bits uses the number 1 and the number 0 to specify how the software treats
the corresponding IP address bits. A wildcard mask is sometimes referred to as an inverted mask because a
1 and 0 mean the opposite of what they mean in a subnet (network) mask.
• A wildcard mask bit 0 means check the corresponding bit value; they must match.
• A wildcard mask bit 1 means ignore that corresponding bit value; they need not match.
If you do not supply a wildcard mask with a source or destination address in an access list statement, the
software assumes an implicit wildcard mask of 0.0.0.0, meaning all values must match.
Unlike subnet masks, which require contiguous bits indicating network and subnet to be ones, wildcard masks
allow noncontiguous bits in the mask.
The table below shows examples of IP addresses and masks from an access list, along with the corresponding
addresses that are considered a match.
Table 112: Sample IP Addresses, Wildcard Masks, and Match Results
Match Results Wildcard Mask Address
All addresses will match the access
list conditions. 255.255.255.255 0.0.0.0
Network 172.18.0.0 0.0.255.255 172.18.0.0/16
Only host 172.18.5.2 matches 0.0.0.0 172.18.5.2/16
Only subnet 172.18.8.0/29 matches 0.0.0.7 172.18.8.0
Only subnet 172.18.8.8/29 matches 0.0.0.7 172.18.8.8
Only subnet 172.18.8.15/30
matches 0.0.0.3 172.18.8.15
Consolidated Platform Configuration Guide, Cisco IOS Release 15.2(4)E (Catalyst 2960-X Switches)
1166
Information About Access Control Lists