Wildcard Masks

Because of the way the CNA system applies wildcard masks to IP addresses in an access-list, the following rules apply when defining permit and deny statements:

• You must zero out each bit in the IP address that is set to be ignored by the mask.
• Once a bit is set to be ignored (changed to 1) in the 32-bit binary representation of the mask, all bits to the right of that location must also be ones in the mask (and zeros in the address).

For example, if the address is 16.1.31.5 and you specify a mask of 0.0.255.255 with the intention of masking out the last two octets of the address, the first of the two rules requires that you specify the IP address and mask as:

16.1.0.0 0.0.255.255
 

 

If you specify a mask of 0.0.7.255, it gets more complicated.

Here is the address, 16.1.31.5, in binary:

0001 0000   0000 0001   0001 1111   0000 0101
 

 

And here is the mask, 0.0.7.255:

0000 0000   0000 0000   0000 0111   1111 1111
 

 

Wherever there are ones in the mask, there must be zeros in the address:

0001 0000   0000 0001   0001 1000   0000 0000
 
0000 0000   0000 0000   0000 0111   1111 1111
 

 

The new binary representation translates to 16.1.24.0, so the address and mask must be specified in the access list rule as:

16.1.24.0 0.0.7.255
 

 

Additionally, because of the second rule, you cannot specify a mask such as 0.0.255.0. This defines a mask in which ones are followed by zeros:

0000 0000   0000 0000   1111 1111   0000 0000
 

 

Because the last (right-most) octet of the mask contains zeros after the third octet’s ones, it is in violation of the second rule.

Nor would the mask 0.0.0.16 be allowed, since it also results in zeros to the right of a one:

0000 0000   0000 0000   0000 0000   0001 0000
 

 

In fact, the only valid mask values other than 255 are 127, 63, 31, 15, 7, 3 and 1, since they are the only values that result in an unbroken string of ones at the right-most end of the binary mask.

NOTE: The CNA wildcard mask rules differ from some router access-list rules, such as that defined by Cisco’s IOS, which do permit the intermingling of matching and ignored bits.