ACL wildcard mask practice
Wildcard masks and matching. Relevant for CCNA, Security+.
Wildcard masks are inverted subnet masks, and that one fact trips people up on the exam. A 0 bit must match, a 1 bit is ignored. Subbing asks for the wildcard of a network, the prefix behind a wildcard, how many addresses a wildcard covers, whether an address matches a permit line, the highest address a line matches, which of three lines a packet hits first, and what host and any expand to.
Five sample questions, with the working
Generated by the same code as the app. They change with every release; the app never runs out.
Wildcard mask that matches exactly 150.103.243.0/24?
Answer: 0.0.0.255
- Mask /24 = 255.255.255.0
- 255.255.255.255 - 255.255.255.0 = 0.0.0.255
Wildcard 0.0.0.31 corresponds to which prefix length?
Answer: /27
- Invert: 255.255.255.255 - 0.0.0.31 = 255.255.255.224
- Count the 1-bits: /27
Does 33.115.176.93 match "permit 33.115.176.0 0.0.1.255"?
Answer: yes
- Wildcard 0.0.1.255 = /23 (mask 255.255.254.0)
- 33.115.176.93 AND 255.255.254.0 = 33.115.176.0: match
Packet from 217.245.93.52. Which ACL line is applied first?
1: permit 48.96.0.0 0.0.255.255
2: permit 217.0.0.0 0.255.255.255
3: deny 11.96.29.0 0.0.0.255
line 2line 1no line (implicit deny)line 3
Answer: line 2
- 1: permit 48.96.0.0 0.0.255.255 → no match
- 2: permit 217.0.0.0 0.255.255.255 → matches
- 3: deny 11.96.29.0 0.0.0.255 → no match
- line 2
How many addresses does wildcard 0.0.0.127 match?
Answer: 128
- 0.0.0.127 has 7 1-bits → 2^7 = 128
Question types in this topic
- ACL matching
- Wildcard for a network
- Wildcard address count
- Wildcard to prefix
- First matching line
- host and any keywords
- Highest matched address
Guide
Wildcard masks explained: What a wildcard mask is, how it relates to a subnet mask, how to compute one for any network, and how Cisco ACLs use host and any.
Questions people ask
What is the wildcard mask for a /24?
0.0.0.255. Subtract the subnet mask 255.255.255.0 from 255.255.255.255.
What does "host 10.1.1.5" mean in an ACL?
The pair 10.1.1.5 0.0.0.0: every bit must match, so exactly one address. "any" is 0.0.0.0 255.255.255.255: nothing has to match.
How are ACL lines evaluated?
Top-down, and the first matching line decides. If no line matches, the implicit deny at the end drops the packet.
Other topics