ACL Wildcard Masks Explained for CCNA

Wildcard masks indicate which bits of an IP address must match an ACL statement, where a '0' means the bit must match exactly, and a '1' means the bit is ignored.

What is a Wildcard Mask?

A **wildcard mask** is a 32-bit sequence used in Cisco routers to determine which parts of an IP address to examine when applying an Access Control List (ACL) or OSPF network statement. It works inversely to a subnet mask. In a wildcard mask, a `0` bit signifies that the corresponding bit in the IP address MUST match exactly, while a `1` bit signifies that it can be ignored (a wildcard).

Calculating Wildcard Masks

The easiest way to calculate a wildcard mask for a given subnet is to subtract the subnet mask from `255.255.255.255`.

* **Subnet Mask:** `255.255.255.0` (/24) * **Calculation:** `255.255.255.255` - `255.255.255.0` * **Wildcard Mask:** `0.0.0.255`

This tells the router to check the first three octets strictly (0) and ignore the last octet (255).

Special Keywords: Host and Any

Cisco IOS provides convenient keywords to replace common wildcard masks:

* **host:** Replaces a wildcard mask of `0.0.0.0`. It means "match this exact IP address." For example, `192.168.1.10 0.0.0.0` is equivalent to `host 192.168.1.10`. * **any:** Replaces an IP address and wildcard mask of `0.0.0.0 255.255.255.255`. It means "match any IP address."

❓ Frequently Asked Questions