0 checks, 1 ignores
ACLs (like OSPF network commands) use wildcard masks to say which bits of an address must match. A 0 bit means "this bit must be the same", a 1 bit means "any value is fine".
For a whole subnet, the wildcard is the subnet mask turned inside out: take each octet away from 255.
| To match | Address | Wildcard | Shortcut |
|---|---|---|---|
| One host | 192.168.10.50 | 0.0.0.0 | host 192.168.10.50 |
| A /24 | 192.168.10.0 | 0.0.0.255 | |
| A /26 (.64 to .127) | 192.168.10.64 | 0.0.0.63 | |
| A /30 | 10.0.12.0 | 0.0.0.3 | |
| 192.168.0.0 to 192.168.255.255 | 192.168.0.0 | 0.0.255.255 | |
| Everything | 0.0.0.0 | 255.255.255.255 | any |
Working one out
Subnet mask 255.255.255.192 (/26): 255 - 255 = 0, 255 - 255 = 0, 255 - 255 = 0, 255 - 192 = 63, so the wildcard is 0.0.0.63. Block size 64: the subnets start at .0, .64, .128 and .192.
Common mistake:
permit 192.168.10.50 0.0.0.255doesn't match one host: it matches all of 192.168.10.0/24, and IOS rewrites the line as192.168.10.0 0.0.0.255. Usehost(or wildcard 0.0.0.0) for one address.