IPv4 Access Control Lists (ACLs)
Planning an ACL Application
dictates that a match occurs only when the source address on such packets
is identical to the address configured in the ACE.
ip access-list standard Fileserver
permit 10.28.252.117 0.0.0.0
exit
Inbound Packet “A” On VLAN 20
– Destination Address: 10.35.248.184
– Source Address: 10.28.252.117
Inbound Packet “B” On VLAN 20
– Destination Address: 10.35.248.184
– Source Address: 10.28.252.120
This ACL (a standard ACL named “Fileserver”) includes an ACE (Access Control Entry)
that permits matches only with the packets received from 10.28.252.117 (the SA).
Packets from any other source do not match and are denied.
Source Address (SA)
Mask (All zeros mean that a match occurs
only when an IP packet’s source address is
identical to the source address configured
in the ACE.
The VLAN permits packet “A”
because its source address matches
the source address in the ACE.
The VLAN denies packet “B”
because its source address does not
match the source address in the ACE.
ACE
Figure 9-5. Example of an ACL with an Access Control Entry (ACE) that Allows Only One Source Address
Examples Allowing Multiple IPv4 Addresses. Table 9-2 provides exam-
ples of how to apply masks to meet various filtering requirements.
Table 9-2. Example of Using an IPv4 Address and Mask in an Access Control Entry
Address in the ACE Mask Policy for a Match Between a
Packet and the ACE
Allowed Addresses
A: 10.38.252.195 0.0.0.255 Exact match in first three
octets only.
B: 10.38.252.195 0.0.7.255 Exact match in the first two
octets and the leftmost five bits
(248) of the third octet.
C: 10.38.252.195 0.0.0.0 Exact match in all octets.
D: 10.38.252.195 0.15.255.255 Exact match in the first octet
and the leftmost four bits of the
second octet.
10.38.252.< 0-255 >
(See row A in table 9-3, below.)
10.38.< 248-255 >.< 0-255 >
(In the third octet, only the rightmost three bits are
wildcard bits. The leftmost five bits must be a
match, and in the ACE, these bits are all set to 1. See
row B in table 9-3, below.)
10.38.252.195
(There are no wildcard bits in any of the octets. See
row C in table 9-3, below.)
10.< 32-47 >.< 0-255 >.<0-255>
(In the second octet, the rightmost four bits are
wildcard bits. See row D in table 9-3, below.)
9-32
