Reverse Masking.  I have at network 172.16.16.0 255.255.254.0

swensonj
swensonj used Ask the Experts™
on
In need to not nat the first 100 ip address of this subnet and nat the remaining ip addressess.  I'm using a Cisco router and access-lists  I'm having trouble what the reverse masking should be on the first line of this access-list and also the easiest way to caluclate it
example
access-list 146 deny ip 172.16.16.0 0.0.?.?  any
access-list 146 permit ip 172.16.16.0 0.0.1.225 any

Thanks
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Most Valuable Expert 2015

Commented:
access-list 146 deny ip 172.16.16.0 0.0.0.63
access-list 146 deny ip 172.16.16.0 0.0.0.31
access-list 146 deny ip 172.16.16.0 0.0.0.3
Les MooreSr. Systems Engineer
Top Expert 2008

Commented:
How about this one

access-list 146 deny ip 172.16.16.0 0.0.0.63
access-list 146 deny ip 172.16.16.64 0.0.0.31
access-list 146 deny ip 172.16.16.96 0.0.0.3
access-list 146 deny ip host 172.16.16.100
access-list 146 permit ip 172.16.16.0 0.0.1.255 any

Author

Commented:
Can you guys explain why you did the access list this way?  I assume that one access-list with one reverse mask could be used instead of the 3 and 4 described above

Thanks
Ensure you’re charging the right price for your IT

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

u said 100 IP dont require natting so.
access-list 146 deny ip 172.16.16.0 0.0.0.63 =64 IP
access-list 146 deny ip 172.16.16.64 0.0.0.31=32 IP
access-list 146 deny ip 172.16.16.96 0.0.0.3 =4 IP
Total 100IP

access-list 146 permit ip 172.16.16.0 0.0.1.255 any ----rest all will be permitted ..


Commented:
Wildcard masking works the same as subnet masking, but just in reverse. (SM is 11111...100...0, while WC-mask is 000...011..1).  So wildcards masks also have the same characteristic than subnet masks:  It can only group IP's in groups of the power of 2: 1, 2, 4, 8, 16, 32, 64, ...

So, to get to the 100 IP's, you use a group of 63, a group of 32, a group of 4 (and a group of 1, if you want to exclude .100 also).  But if you have any freedom in the choice of the exclusion range, allign it with the powers of 2:  Either exclude 63 addresses (172.16.16.0-63, with "access-list 146 deny ip 172.16.16.0 0.0.0.63") or 127 (172.16.16.0-127, with "access-list 146 deny ip 172.16.16.0 0.0.0.127").  This prevents using multiple access-list entries.

Author

Commented:
Thanks

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial