CCNA Cisco Certified Network Associate Study Guide - FTP Server

Access Lists 445
Now, that was the easy part. What if you want to specify only a small
range of subnets? This is where the block sizes come in. You have to specify
the range of values in a block size. In other words, you can’t choose to specify
20 networks. You can only specify the exact amount as the block size value.
For example, the range would either have to be 16 or 32, but not 20.
Let’s say that you want to block access to part of network that is in the
range from 172.16.8.0 through 172.16.15.0. That is a block size of 8. Your
network number would be 172.16.8.0, and the wildcard would be
0.0.7.255. Whoa! What is that? The 7.255 is what the router uses to determine
the block size. The network and wildcard tell the router to start at
172.16.8.0 and go up a block size of eight addresses to network 172.16.15.0.
It is actually easier than it looks. I could certainly go through the binary
math for you, but actually all you have to do is remember that the wildcard
is always one number less than the block size. So, in our example, the wildcard
would be 7 since our block size is 8. If you used a block size of 16, the
wildcard would be 15. Easy, huh?
We’ll go through some examples to help you really understand it. The following
example tells the router to match the first three octets exactly but that
the fourth octet can be anything.
RouterA(config)#access-list 10 deny 172.16.10.0 0.0.0.255
The next example tells the router to match the first two octets and that the
last two octets can be any value.
RouterA(config)#access-list 10 deny 172.16.0.0 0.0.255.255
Try to figure out this next line:
RouterA(config)#access-list 10 deny 172.16.16.0 0.0.3.255
The above configuration tells the router to start at network 172.16.16.0
and use a block size of 4. The range would then be 172.16.16.0 through
172.16.19.0.
The example below shows an access list starting at 172.16.16.0 and going
up a block size of 8 to 172.16.23.0.
RouterA(config)#access-list 10 deny 172.16.16.0 0.0.7.255
The next example starts at network 172.16.32.0 and goes up a block size
of 32 to 172.16.63.0.
RouterA(config)#access-list 10 deny 172.16.32.0 0.0.31.255