A wildcard mask is a 32-bit quantity that is divided into four octets. A wildcard mask is paired with an IP address. The numbers one and zero in the mask are used to identify how to treat the corresponding IP address bits. The term wildcard masking is a nickname for the ACL mask-bit matching process and comes from of an analogy of a wildcard that matches any other card in the game of poker. Wildcard masks have no functional relationship with subnet masks. They are used for different purposes and follow different rules. Subnet masks start from the left side of an IP address and work towards the right to extend the network field by borrowing bits from the host field. Wildcard masks are designed to filter individual or groups of IP addresses permitting or denying access to resources based on the address. Trying to figure out how wildcard masks work by relating them to subnet masking will only confuse the entire matter. The only similarity between a wildcard mask and a subnet mask is that they are both thirty-two bits long and use ones and zeros for the mask.

Another issue is that the ones and zeros mean something different in a wildcard mask as opposed to a subnet mask. In order to eliminate confusion, X’s will be substituted for the 1’s in the wildcard masks in the graphics. This mask would be written as 0.0.255.255. A zero means let the value through to be checked, the X’s (1’s) mean block the value from being compared.

In the wildcard mask process, the IP address in the access-list statement has the wildcard mask applied to it. This creates the match value, which is used to compare and see if a packet should be processed by this ACL statement, or sent to the next statement to be checked. The second part of the ACL process is that any IP address that is checked by a particular ACL statement will have the wildcard mask of that statement applied to it. The result of the IP address and the wildcard mask must equal the match value of the ACL. This process is illustrated in the animation.

There are two special keywords that are used in ACLs, the any and host options. Simply put, the any option substitutes 0.0.0.0 for the IP address and 255.255.255.255 for the wildcard mask. This option will match any address that it is compared against. The host option substitutes for the 0.0.0.0 mask. This mask requires that all bits of the ACL address and the packet address match. This option will match just one address.

Web Links ACL http://www.foothilltech.org/tsharif/ apjohns0_Ch06__ ACLs%5B1%5D.ppt