Note: For the first post in this series, please see the Subnetting Made Easy, Part 1 post.
Recently I received an e-mail from a reader who was having trouble with one of their labs. The lab required them to write an ACL which matches only part of a subnet, as opposed to the whole subnet which is what is commonly seen in lab environments. The details are as follows:
- Network Address: 192.168.0.192 /27
- Usable Addresses: 192.168.0.193 - 192.168.0.222
- Subnet Mask: 255.255.255.224
- Wildcard Mask: 0.0.0.31
The range of addresses inside the subnet which need to be matched are:
Match Addresses: 192.168.0.193 - 192.168.0.206
In order to create the ACL, the author needs to find out which wildcard mask matches only the above mentioned addresses.
The Solution
The solution I use to answer this question is the same one I use when I’m summarising routes. I convert the necessary octet to binary and then find the least significant bit that matches both the lowest IP address and highest IP address in the range. In this case the details are as follows:
- Octet: 4th (given that the network address is a /27)
- Lowest IP: 192.168.0.193
- Highest IP: 192.168.0.206
| /25 | /26 | /27 | /28 | /29 | /30 | /31 | /32 | ||
| 128 | 64 | 32 | 16 | 8 | 4 | 2 | 1 | ||
| Network: | 1 | 1 | 0 | 0 | 0 | 0 | 0 | 0 | = 192 |
| Lowest IP: | 1 | 1 | 0 | 0 | 0 | 0 | 0 | 1 | = 193 |
| Highest IP: | 1 | 1 | 0 | 0 | 1 | 1 | 1 | 0 | = 206 |
As highlighted above, first, second third and fourth most significant bits match. The fifth bit however, does not. This therefore means the fourth bit is the one we’re looking for. From this we can deduce the following:
- Network Address: 192.168.0.192 (the 192 is because of the 128 + 64 as shown above)
- Subnet Mask: 255.255.255.240 (/28) - (This is because the four most significant bits match)
- Wildcard Mask: 0.0.0.15 - (Inverse of the Subnet Mask - 255 - 240 = 15)
Other Posts in this Series:
See the Subnetting Made Easy - Index post for links to all of the posts in this series.
As always, if you have any questions or have a topic that you would like me to discuss, please feel free to post a comment at the bottom of this blog entry, e-mail at will@oznetnerd.com, or drop me a message on Reddit (OzNetNerd).
Note: The opinions expressed in this blog are my own and not those of my employer.
Leave a comment