Alright, so let's now move into Access Control Lists.
And as I've mentioned a few times in this course, your Access Control Lists,
your knowledge of Access Control Lists is going to be critical for your success on the certification exam.
And the reason why is you always have to remember this.
Access Control Lists are purely a tool, a feature that we have
that gives us the opportunity to identify things like source IPs, destination IPs,
source ports, destination ports, transport layer protocols, or just any type of protocol,
quality of service markings, as well as certain TCP flags, and so on and so forth.
So ACLs are all about what? They're all about traffic identification.
So anytime you have a service, a feature in use that requires you to differentiate different types of traffic,
you're going to need an Access Control List in order to accomplish that.
So for example, with network address translation, how do you define who's allowed to be network address translated?
Access Control List.
With a traffic filter, how do you define what traffic is going to be permitted or denied through that router?
With an Access Control List.
With quality of service, how do you identify, or I should say classify, different types of traffic?
How do you classify it as voice versus video versus data versus this versus that?
Again, you can use Access Control Lists for that.
When it comes to policy-based routing, when we did our demonstration, what did we use?
Access Control Lists.
Even with route filters, like a distribute list, the EIGRP, you could use Access Control Lists if you want to.
Prefix lists are better, but you can still use Access Control Lists.
And the list goes on and on, folks.
So as you can see, the Access Control List is really just about identifying things,
and then how you apply it ultimately determines what it's being used for.
So oftentimes in the security world, you hear Access Control Lists, security features, security.
Well, yeah, it's one thing it can do.
That's if you apply it as a security feature.
But if you don't apply it as a security feature, you can use it for other things.
But in this case, for this exam, we really are using it and going to be tested on it in multiple ways.
So we already saw how we could use it for policy-based routing.
Make sure you know that.
We've already seen how you can use it for network access translation.
Make sure you know that.
So anytime we brought up Access Control Lists in this course,
make sure you understand the Access Control Lists from that perspective.
Now we're going to focus on it from a traffic filtering standpoint.
So how can I apply it to permit or deny traffic as it's flowing through my environment?
So regardless of whether we use it for traffic filter or anything else, what do we have?
We have an Access Control List.
Think of it like a clipboard.
And then on that clipboard, you have a whole bunch of permit and deny statements.
And the permit or deny statements are going to be all –
what they do is ultimately dependent on what you apply it to.
So whether it's for network access translation or quality of service
or policy-based routing or traffic filtering,
ultimately determines what permit or deny means when it's all said and done.
So for this discussion on traffic filtering, permit means allow the traffic.
Deny means drop the traffic.
That's essentially what it means.
And so when you think about it from that perspective,
we are dealing legitimately with a type of clipboard,
something that is going to control access to or from the environment
through or not through an actual device.
So when we look at our Avengers Headquarters here,
we have an Access Control List, who's allowed in Avengers Headquarters
versus who's not allowed in Avengers Headquarters.
So you can see we have a list that starts at the top here.
Obviously, Tony's first because, you know, he cries when he's not first.
And then we have Steve's second because, you know, he's Captain America.
So he's going to be right near the top, but Tony always trumps Steve.
But then we go down our list, and you'll see some are permit, some are deny,
some are permit, some are denies, and so on and so forth.
And what we need to recognize is that when this list is being processed,
it's going to be processed from the top of the list to the bottom of the list,
which means smallest number to largest number.
So we're going to start up here, and we're going to work our way down.
So let's pretend right now that Thor shows up at the door,
and Thor bangs his mighty hammer on the door.
And what's going to happen, folks?
Is Thor going to be permitted, or is Thor going to be denied?
Well, let's start at the top, folks.
Top-down processing and work our way down until we find a match for Thor.
Do we have a match for Thor?
I think we do.
Sequence number four is a match.
So, folks, is Thor permitted or denied from entering the building?
It's important you realize that we immediately execute upon a match.
You see that?
So what does that mean?
It means that when we find our match, we stop.
And once we stop, we execute exactly what it says.
In this case, Thor is denied.
Now, why is this so critical to understand, and why am I presenting it to you this way?
One, because a lot of people are MCU fans.
But two, I want you to keep going down this list.
Is there another entry, folks, that Thor matches, yes or no?
John says all original Avengers.
Yeah, exactly, John.
So this one as well.
And this is why step two is so critical.
Because if Thor is an original Avenger, look, it says permit.
That means Thor is allowed in the building if sequence number six was executed.
So we need rules in place to make sure that the order of processing functions as we need it to.
So the rules are top-down processing.
And then as soon as you find a match, stop and execute.
The rest don't matter.
So in this scenario, none of this matters now.
And if we didn't have this rule in place, then we'd have a conflict.
Because four and six would be in conflict with each other.
Also, this is imperative because if the order is wrong, you can really see how we could be messed up.
Because now in this case, folks, is Thor permitted or is Thor denied?
Well, if we were just looking for Thor, we would see that Thor is denied.
But wait, is Thor really denied, yes or no?
Let me know.
Thor is permitted.
Exactly, John, why?
All original Avengers say permit.
Thor belongs to that group.
Since Thor belongs to that group, top-down processing, immediate execution upon a match, Thor is permitted.
Even though the next entry right after that says deny, it doesn't matter.
And that is what you have to be careful about.
And that is what you have to be careful of on this certification exam for any question that has an ACL in it.
It doesn't matter what the question is about.
It could be about NAT, policy-based routing, traffic filtering, anything.
You have to remember that the ACL could be the reason why that feature is not working.
And it could be as simple as they have the order incorrect on you.
So being able to read an ACL is critical for your success on the certification exam.
In addition, don't forget that at the very bottom, we have the implicit deny all.
It's right here.
You see it?
No, you can't.
You can't see it.
It's not there.
It's implicit deny all.
It's invisible.
It doesn't exist.
But it's there.
Meaning that if you're not on the list, you're not getting in.
Whenever I provide this discussion, I always think of Stanley Ipkiss.
Does anybody remember poor Stanley Ipkiss?
Let's see how many of you are old enough to know what I'm talking about.
Yes!
Jim Carrey's character in the movie The Mask in 1994 with Cameron Diaz.
I think it was 1994.
I think it might have been 92.
I think it was 94 though.
Before he puts on the mask, his character is Stanley Ipkiss.
He goes to the Coco Bongo Club and he's not allowed to get in the club.
Why?
He's not on the list.
He's not cool enough.
He's not popular enough.
Whatever.
It doesn't matter.
He's just not on the list.
Stanley Ipkiss got hit by the implicit denial rule because he just simply wasn't on the list.
He puts on the mask and he shows up with a bunch of Benjamins in his hands and starts tossing them around.
Of course, he gets into the Coco Bongo Club that way.
Thanos showed up.
If you're an MCU fan, Thanos shows up.
Thanos, you're not on the list.
I'm sorry.
You're not getting in.
I don't care if you have the Infinity Gauntlet on your hand.
It doesn't matter.
I don't care if you have all the stones.
You're not getting in.
I'm sorry.
He can brute force his way in, but still.
The idea is implicit denial at the very end.
You're not getting in.
It's that simple.
Order of operations.
This is another way to view this here.
You've got your incoming traffic or your outgoing traffic on your router interfaces.
As a result of that with your ACLs, for traffic filtering standpoint, if traffic arrives in on an interface or is leaving an interface and there's an ACL on that interface,
the question is, does that traffic match any of our entries?
If it does match, we stop, and then we do what it says.
Permit or deny.
If it doesn't match, then we go to the next one.
If that one doesn't match, we go to the next one.
If you don't match each entry, you keep going.
Keep going.
Then if you find a match, you stop.
You execute.
If you don't find anything, you get to the very bottom, and you're automatically denied.
Critical for your exam success.
That's why we go over this.
When you look at this video access control list, if this is what I was showing on the certification exam, what does this do?
This permits and allows every single private IP address from the RFC 1918 address spaces and denies everything else.
Even though it doesn't say denies everything else, you have to recognize that it is denying everything else because there's nothing else listed there.
If we look here, we'll see that it's applied to this particular interface.
As traffic arrives inbound on this interface, this is my router.
This is my interface.
That's inbound.
When it arrives in on that interface, then this access control list gets applied.
In this case, if the source of the traffic is within that range, you are permitted.
If it's outside of that range, you are denied.
We have two types of ACLs we need to be aware of.
We need standard IPv4 ACLs.
We have extended IPv4 ACLs.
Standard only filters based on the source IP address.
It's a great way to remember that.
S and S.
Source of the IP address.
These access control lists are typically very simple, very easy to implement.
Basically, you're just specifying, hey, if the source IP of the packet matches this range, then you're permitted or you're denied.
What have you specified?
It's not very granular control in this case.
Whereas, if you need granular control, you've got to go for your extended access control list.
Your extended access control list, we can filter based on our source address.
We can filter based on our destination address.
We can filter based on source ports and destination ports.
We can filter based on protocol types like TCP versus UDP versus EIGRP versus OSPF versus ICMP versus IGMP versus GRE versus ESP versus AH, right?
Different types of protocols that exist or even just all IP traffic when it's all said and done.
And then even quality of service markings can come into play here.
Various TCP flags or whether the TCP session is established or not established.
There's a lot of different things you can match on in an access control list when you're using an extended ACL.
Now, when it comes to IPv4 standard and extended ACLs, there's two different ways we can identify them, which just frustrates me to no end.
And that is via numbers or via names.
Via numbers or via names.
So, numbering-wise, this is your numbering scheme for standard ACLs.
This is your numbering scheme for extended ACLs.
And if you're using named ACLs where you don't provide numbers, you just simply give it a name.
And so, the numbering scheme helps the router understand whether it should give you standard syntax or extended syntax.
So, if I create an access control list and number it five, it's going to be standard syntax.
If I number it 105, then it's going to give me extended syntax.
Whereas down here when we're using named, I actually have to tell the router whether it's a standard one I'm creating or whether it's an extended one I'm creating in my configuration.
And so, if I specify standard, then it gives me standard syntax.
If I specify extended, then it gives me extended syntax.
So, here's an example of creating an entry, a single entry for an access control list that is a standard numbered ACL.
So, access list in global configuration mode, followed by the number, followed by permit or deny, followed by your IP source range.
So, in this case, if we just go to router number five in this example, configure terminal, and we type in access list, we give it access list number five.
Do I already have access list five on there?
I actually do from earlier, remember?
We were using it.
All right.
So, let's save an access hyphen list.
We'll go with, what do we got, 540.
Let's just do 10.
So, access list 10, and then you'll see that you've got your permit, your deny, or even a remark to make a comment to give it a description.
So, let's just simply say permit in this particular example.
And then if I type in something like host, that means this exact host IP address.
So, let's just say 10.40.23.10 as an example.
Now, if I wanted to create another entry within the same one, then you just simply type in access list again.
You type in 10, and then let's say it's permit.
And let's say instead of permitting a specific host, we want to specify an addressing space, a range.
So, let's do something like 10.40.12.0, and then 0.0.0.
So, this is a wildcard mask.
And in this case, it's going to be 61.31.
Nope.
I want 63 instead.
That's what I wanted.
And I'm doing this on purpose here now because I want to show you if I type in do show access list, it didn't delete or erase what I did before.
It just simply added another one.
As you can see, every time you do it, every time you do it, you're just adding, adding, adding, adding, adding, adding, adding to that list.
If you want to do a specific deny, you can go ahead and do a specific deny if you want by just putting in the deny parameter.
But that's all.
You create it in global configuration mode.
So, do show run pipe to section access list with these commands.
And the order you create them in is the order they show up.
And then you have your named standard access control list.
So, with named standard access control list, you're going to type in IP access list first instead.
And then you specify that you want a standard access control list.
And then you're going to specify the name of that access control list.
And now you're in a special configuration mode for standard named access control list configuration mode.
So, again, just like before, we could type in permit and dump this in.
We can type this in.
So, basically, you're doing the same thing, but you don't specify everything else in front of it because that stuff doesn't matter.
And so, if I type in do show access hyphen list 10 and do show access list on core standard, you'll see they're the same for this demonstration.
But what I want to point out to you now is that with standard access control list, pardon me, with numbered access control list, you can't really edit them.
That's right, you can't really edit them.
Let's go ahead and try and edit this one.
So, let's do a do show run.
Go global configuration mode.
Do show run.
Pipe to section.
Access.
So, these are the three access control lists here.
So, folks, how do you typically delete something in your config that you don't want anymore?
You would type a no.
And then you would put it in.
There you go.
Deleted, right?
Okay, let's take a look at our running config now.
Oops.
Okay, where's the other ones?
Where's the other ones?
They're all gone, eh?
Do show access list 10.
I deleted the whole thing.
So, you can't edit them.
I deleted the whole thing.
So, you can't edit your numbered access control list.
How would you edit them?
Well, the old school way is to copy and paste your access control list into notepad, make the changes you want,
then delete the access control list and copy and paste the new one onto the device.
How many of you have ever had to do it that way?
It's no fun.
All right, let me just put it back in right now.
Let me show you a way that we can edit named access control lists.
That's the power of your named access control list.
So, right now, if I type in do show access-list.
And what was it called again?
Encore standard, right?
What we could do is we could go back into the configuration mode.
So, we could type in ip access-list standard encore standard.
And what I can do is I can do something like this, no 10.
So, by typing in no 10, what does that do for me?
What does that do for me?
Typing in no 10, I can just get rid of that one entry and that doesn't affect the whole access list.
So, using named access lists gives you a lot more flexibility when it comes to configuration and editing and all that stuff.
And so, now if I want to apply something in somewhere else, you could specify the sequence number where you want it to go.
So, for example, let's say I type in sequence number 27.
And let's say I want to deny a specific address.
Let's go ahead and say we're going to deny 10.40.13.00.00.
Let's do that.
Right, there you go.
You see how I was able to put it in there?
And let's say we want to go ahead and add that other one in we took out.
But we want to, instead of having it sequence 10, I want to have it sequence 5.
So, you have a lot of flexibility here when it comes to editing your access control list without having to use notepad and copying and pasting and destroying the whole ACL.
So, what does that mean?
It means you can do the same thing with your numbered ACLs.
So, let's type in do show access-list number 10 in this case.
What I'm going to show you now is what if I type in IP access-list standard, but just put in the number 10.
So, our Cisco iOS devices let us do this.
So, if I wanted to say no 20, like we wanted to delete this one before, but it deleted the whole ACL, well now it only deletes that one entry.
So, I encourage you, even if you have numbered ACLs nowadays, use the named ACL configuration mode syntax in order to work with your numbered ACLs.
This is going to allow you to do the changes you need without having to copy and paste and doing everything else you want to do outside of the actual iOS environment.
So, just something to keep in mind.
So, now that we've got some of that stuff out of the way, let's talk about the elephant in the room, and that is the wildcard mask.
How many of you feel comfortable with the wildcard mask that you don't need to have a conversation with me about it?
Anybody here?
Andrew wants to skip it?
Anybody else?
I can't skip it.
Alright, here's the deal.
If you can't read wildcard masks, you will bomb every question, bomb every question on the exam that has access control lists in it.
So, my goal today is to teach you how to shortcut your success on the certification exam.
That's my goal, because you can't waste time.
On average, Cisco says you should be able to answer every question in a minute 15 seconds, on average.
So, an ACL question should take you a little longer, obviously, than some of the other ones, but on average, a minute 15.
Well, the only way to average that out, including with access control, is to have shortcuts at your disposal.
So, let's go ahead and teach you how to understand what a wildcard mask is, but then I'll show you how to shortcut it.
And on the exam, the shortcuts will work.
Like 99.8% of the time.
Those are odds I like.
Go with them, and you're going to have no problems on the exam being successful.
So, what is a wildcard mask?
Okay, so the wildcard mask, as we talked about, remember in OSPF, with the network command?
The wildcard mask on Cisco IOS, as we talked about, with the network command for OSPF, is to do what?
Identify all of the IP addresses that must match.
That's it.
So, in this case, this example here says, all IP addresses from 10.1.1.0 through 10.1.1.255.
That's all that means.
It doesn't mean anything else.
The combination of these two values is to define a range of IP addresses to match.
Define a range of IP addresses to match.
Now, I know it looks like a backwards subnet mask.
It looks like an inverted subnet mask, but it's not.
It has a completely different purpose, and it works totally different than a subnet mask.
So, a question is, is it fair to say that they are used to indicate the size of network address spaces when the masks don't need to be contiguous?
No, no, because they have to be contiguous, or it doesn't work.
And if you want to match network spaces that are not contiguous, then yes, you can do that with a wildcard mask.
So, let's go back and let's look at what you said again.
So, you said, is it fair to say that they are used to indicate the size of a network address space when the masks don't need to be contiguous?
So, we'll say that is sort of true.
That is sort of correct.
Because it's not about, one, the masks.
It's not about the masks at all.
It's about the addressing space.
So, it doesn't matter what subnet masks are.
It matters what are all of the addresses we want to match.
And so, the easiest and simplest way to do that is with contiguous IP addresses, regardless of what the subnets are.
So, for example, if I wanted to match 10.0.0.0 to 10.255.255.255, that would be every single IP address from 10.0.0.0 to 10.255.255, right?
And that would be, it doesn't matter what the subnet is.
So, I've got an example of that because of yesterday.
If we go back to R1 from yesterday, we have an access list on R1, remember?
And this access list was from what?
This access list right here, we created for the IPsec VPN.
So, when you look at 10.0.0.0, 0255.255.255, that says every single address from 10.0.0.0 to 10.255.255.255, which means it doesn't matter if you're in the 10.0.0.0 subnet or the 10.0.1.0 subnet or the 10.0.2.0 subnet.
Like, the subnet doesn't matter.
The mask doesn't matter.
It is purely based on the IP addresses in the source and destination of the packet.
So, if you wanted to match addresses, though, that were not contiguous, let's say you wanted to match all the addresses in 10.0.0.0 and all the addresses in 10.0.2.0 at the same time and 10.0.4.0 and 10.0.6.0,
then could you get crafty with your wildcard mask and accomplish that?
It's hard to do that, though.
It's really hard to do that.
And so, the exam is not going to go crazy like that on you.
The exam is going to keep it simple.
Simple.
And what does simple mean?
It means simple wildcard masks that in each octet would only typically have either 0 or 127 or 63 or 31.
Let's do this instead.
We'll go with 255 first.
127, 63, 31, 15, 7, 3, 1, 0.
So, those would be the only possible values that you would see.
In reality, though, could you have other values?
Sure, you could.
You could have any value you want in a wildcard mask.
Can you have any value you want in a subnet mask?
No.
In a subnet mask, you have 255, 128, 192, 224, 240, right?
Contiguous ones followed by contiguous zeros, whereas there's no rules here for wildcard masks.
So, something like Conrad, you typed in of 0, 255, 0, 255.
Although those are valid values that I'm talking about here, what you need to realize is that this is not simple.
This is 8 zeros followed by 8 ones followed by 8 zeros followed by 8 ones.
That is actually extremely complicated.
When it's all said and done, when you combine it together with an address.
Because what we're basically saying in the end is that the entire first octet has to match.
The entire second octet is wild.
It can be anything we want it to be.
The entire third octet has to be a match to the IP address.
And then the last octet could be wild.
It could be anything we want it to be.
So, that would actually create a very interesting combination of addresses that we are trying to match.
But it would be based on this first value that's included as well.
And I'll show you how the binary works here momentarily if you've never seen me do this.
So, for example, this one's simple, but this one's not.
This one's not, and this one's not.
They're legit not simple.
Because when you convert these to binary, you have zeros followed by ones followed by zeros followed by ones followed by zeros followed by ones as an example.
That makes it complicated.
To make it simple, which the exam is going to do like 99.8% of the time, is your wildcard mask is always going to be zeros followed by ones.
So, basically, yes, the backwards of a subnet mask.
But that's the simplest way to do them.
And even in the real world, I try to keep things simple.
I would prefer to have multiple simple entries in my ACL than one really complex one where I don't know 100% if I'm only matching the exact IP addresses I want to match.
Because just think about it this way.
All it takes is for you to match one IP address you did not intend to match.
And that might be permitting it or denying it.
If you're permitting it, that could allow a cyber criminal to do damage to your network if they get through that one address that you've permitted that you shouldn't have permitted.
Or if you're denying that address, it means somebody or something can't do what it needs to do all because you tried to get way too creative with your wildcard masks.
So we keep it simple.
So, basically, in any given octet, it would be something like 000255 or 00255255 or 00127255 or 0063255 or 007255 or 0007 or 00015.
That's simple because it'd be ones followed by zeros.
So let's look at it now this way.
And let's go through this example.
When you see zeros in the wildcard mask and you see ones, what do they mean?
I've seen it referred to in many different ways.
A lot of documentation, zero bit means match.
One bit means ignore.
I've seen it says, I care about this bit, use this bit, preserve this bit, carry this bit down for zeros.
Or one meaning, I don't care about this bit, don't use this bit, don't preserve this bit, don't carry this bit down.
All right, let me explain what all that means here by actually looking at it in binary.
And in the end, I don't want you to use binary on the exam, all right?
So let's be clear about that.
You're wasting your time if you are.
I'm going to show you some shortcuts.
When it's all said and done, that only works because everything is simple and perfect on the exam 99.8% of the time.
I'll take those odds and take my shortcuts so I can save time.
All right, so this is the IP address.
This is the IP address.
This is the wildcard mask in binary.
So let's underline our zeros.
Let's underline our ones.
Zero, as we said, means match.
I care, use this, preserve.
All this simply means is this.
I cannot touch these.
They must remain exactly as they are.
That's all that means.
So let's go ahead and rewrite them all down here.
Boop, boop, boop, there you go.
That's all that means.
A zero wildcard bit means the IP address bit cannot be touched.
Good, done.
The ones mean that these, all of these, are wild.
Wild means what in a game of cards, folks?
If we were playing crazy eights and I said eights are wild, what does that mean?
It means an eight can be anything I want it to be.
So if I'm playing and I want my eight to be a three right now, my eight can be a three.
So let's represent wild with X's.
So let me ask you this, folks.
An X is wild, which means it can be anything I want it to be.
In binary, we have two possible values.
We have a zero and we have a one.
So an X, each X can be a zero or a one.
So the lowest, lowest option we have here is all of them to be zeros.
So let's convert this to decimal now.
We've got 10.
We've got one.
Folks, what would this octet be if all of those are zero?
It's a simple answer.
It's not too hard.
If they're all zero in binary, they are exactly zero.
There you go.
There's one value that I have.
I need to figure out one more value.
What if all the X's are the maximum possible value?
Now what is that?
That's right.
Good job.
It's 255.
What have we just discovered by doing this?
The range of IPs.
This means this.
That's it.
So access list five permit 10.1.1.0 through 10.1.1.255.
That's how you read that.
Let me show you a shortcut here.
Why?
Because everything is perfect.
We have zeros followed by ones.
This is a beautiful network ID.
If we had a subnet of a slash 24,
that would be the exact backwards of a slash 24 subnet mask.
If we flipped all of this around,
if these were all zeros and these were all ones,
that would be a slash 24 subnet mask.
So all those things make this perfect.
So all you have to do for the exam,
if you're looking at this, is go.
10.1.1.0 through 10.1.1.255.
There you go.
No binary involved.
You just figured out the same range.
And you might be asking,
Raymond, when you took the exam,
did you do this?
Yeah, I did.
How'd you do?
Really well.
If it didn't work for me,
I wouldn't be showing it to you.
Let's put it that way.
And so this is the same thing.
When we were working with OSPF,
I was able to quickly give you examples.
Okay, well, this means this.
This means that.
Because that's all I'm doing in my head.
That's what I'm doing.
I'm keeping things simple
in order to accomplish that objective.
All right, let's look at another example.
Let me ask you this, folks, though.
For those of you here today,
is this the first time you're seeing something like this?
And right now you're going,
hey, that's pretty good.
If I can use that on the exam,
that's pretty good.
Just want to know.
So.
Look at this one.
We have a different wildcard mass now.
So if I convert it,
let's do the long way,
which you're not going to do it this way on the exam,
but let's do the long way.
Let's underline
what we have.
Here's our ones.
Here's our zeros
that we need to keep,
that we need to keep.
Why?
Because these are zeros for the wildcard mass,
so I got to keep all the IP bits.
And then we got our ones at the end.
So the ones at the end,
are wild.
So these are wild.
So let's put X's here instead.
Now, if these X's are all zero,
then we get 10.1.1.0.
If all these X's are ones, folks,
what do we get?
If all those X's are ones,
what do we get now?
What do we get now?
10.1.1.15.
That's right.
So there's our range.
So let's do the shortcut.
So the shortcut instead would be
10.1.1.0 plus 0.0.0.15.
10.1.1.15.
There's your start.
There's your end.
Very easy to do for the exam.
Now let's do another one.
But instead, let's change this value here.
So if we change that value instead,
now we have 10.1.1.64.
0.0.0.15.
So let's go ahead and put our binary for the IP,
the binary for the wildcard,
draw our lines,
yada, yada, yada,
et cetera, et cetera.
Put X's here.
And now what?
Well, if all of these X's are ones,
well, if all of these are zeros,
be very careful with this example
because look, there's a one here, right?
This one, this one got preserved, folks.
So now we've got 64.
That's what we have.
And if these are all ones,
now you got 64 plus 8 plus 4 plus 2 plus 1
for a grand total of, that's right, 79.
There we go.
Only pressed it six times.
So now we have our total range.
So doing our shortcut,
10.1.1.64.
0.0.0.15.
10.1.1.79.
So now we have our total range.
79.
All right.
Now this is where I tell you
that you have to be very careful
in the real world
because you might be going like,
oh my gosh, I could use this in the real world.
It'd be so easy.
Nah, yes and no
because you got to understand what I said
is everything is perfect.
Everything is perfect, remember?
So let's make this not perfect now.
What if we accidentally put this in here?
What if we did that?
Well, let's look at this.
All right, so 66 is now 64 plus 2, that's 66.
So wildcard mask being that.
So we preserve this one,
but you see that one there?
That's wild now.
That's wild, you see that?
So it's still X's.
So if it's still X's, this is still my range.
This is still my range, folks,
even if I type that in.
That's why you got to be careful
with access control lists.
So we use our shortcut here
and we did this.
That's not correct.
Does that make, no, that's 64, that's 66, that's 81.
So you see the shortcut here is not going to work
because this is actually not perfect.
That is not accurate.
That would never be a network ID
if we had a 255, 255, 255, 240 something mask.
Would never be possible.
So in this case, it fails.
So this is not something I would worry about on the exam
and I would not worry about things being inaccurate.
I would worry, I would be focused on the fact
that Cisco is giving me good, accurate, solid,
typical, best practice access control lists
and I can go ahead and use Raymond's shortcut
in this particular case and be successful, quick, fast
on the certification exam.
So that is your goal if you can do that.
Now I'm going to show you a couple of things
just in case it comes up.
This is interesting because that is not
what we classify as a simple wildcard mask
because look, it's zeros followed by ones
followed by a zero.
So when you look at it this way now,
you'll see that all of these can be anything
I want them to be, but this always has to be a zero.
Folks, if that very last binary bit always has to be a zero,
then when it comes to the binary numbers in this octet,
if that final binary value is always,
let me rephrase that,
when it comes to the decimal numbers of those octets,
of that octet, if that binary value always has to be zero,
then what are the numbers going to be in the end?
Andrew says even, exactly, Andrew.
Because if that has to be zero,
then the one bit is never set.
If the one bit is never set,
then we're always counting by twos.
So it could be zero.
If this is all zeros,
then the answer is what?
Zero.
But then we had 0, 0, 0, 0, 0, 0, 1, 0
because it always has to be zero the last one.
Now we've got two.
What about 0, 0, 0, 0, 0, 1, 0, 0?
Now you've got four.
What about 0, 0, 0, 0, 0, 1, 1, 0?
Now you've got six.
You see, we're counting by twos.
Even numbers only.
Even numbers only, as Andrew said.
But what if we change this right here?
Look at this.
Just change this value here.
So instead of saying 1, 9, 2, 1, 6, 8, 0, 0,
I say 1, 9, 2, 1, 6, 8, 0, 1.
If I use the same wildcard mask,
now you see this always has to be a what?
This always has to be a one.
It always has to be a one
because of the wildcard mask.
It says I have to match that.
So now, since that always has to be a one,
now it's every single odd number.
So here's the deal.
If you see this wildcard mask at all,
then I want you to think,
ooh, ooh, even or odd.
That's immediately what I want you to think,
even or odd.
And then what I want you to do is look at this value here.
If that is a one, then you think odd.
If it is a zero, then you think even.
That's it.
Keep it that simple, folks.
Don't overcomplicate it
because it's already overcomplicated.
All right.
So there's some good shortcuts for you
and things to keep in mind for the certification exam.
Now, here's something else I want to show you really quickly
that's going to help you get through things on the exam really fast.
Let's say that you are given a network as such
and you have a multitude of different ways that you can be tested on this.
For example, they might turn around and say,
create an access control list that matches that,
permits it or denies it, whatever.
They could already have an access control list created
and you are troubleshooting.
So you know the network because it's in a diagram
and you want to confirm if there's an access control list
that matches that or not.
Again, how are you going to do that?
Well, you've got to figure out what that would be
as an access control list entry with the network ID
and the wildcard mask.
That's what you're going to have to figure out.
So the best and easiest way to do that
is to take 255, 255, 255, 255
and subtract the subnet mask from it.
255, 255, 255.0
and that actually will give you the perfect wildcard mask
for that network ID.
So now 10.1.1.0 through 10.1.1.255, right?
That's every IP address in that subnet.
So now if you had to create an access control list,
well then just use those two values now.
Use this value and use this value.
You're done.
If you were trying to confirm if this was correct,
well now you have 100% confirmation
that that is correct, that it actually matches.
What about this scenario here, 10.1.1.0.28?
Well, take 255, 255, 255, 255,
subtract 255, 255, 255, 240 from it
and you get 00015.
Now you've got this value and this value.
So if you had to create an access control list,
there you go, you got your values.
If you had to verify an already existing access control list,
well now you can verify it.
Well, what about this one, 10.1.1.64.28?
Same thing, just go ahead and do the subtraction
and then take the first number, 10.1.1.64,
combine it with the wildcard mask and there you go.
You're able to verify, you're able to confirm,
you're able to get what you want.
So as you can see, a lot of little tips, tricks, techniques
here to help you get really, really fast with ACLs in the exam
so that way there, you're not wasting time.
If you're wasting time, you run out of time.
When you run out of time, you fail the exam.
All right, what about scenarios where you might have
to combine values together?
Look at this, we have 172.16.00.24
all the way to 172.16.31.0.24.
So how many different networks do we have here?
We have 32 different entries.
So on modern-day equipment, folks,
I could do something like this.
I really could.
Why? Because access control lists are processed in TCAM
and doing something like this is probably not going to cause
any issues with the performance on my device.
And this way I keep it simple, I created one entry
for each and every single one of them.
But Cisco on the exam may force you not to do it this way
or they may present to you an access control list
that is something like this instead.
It is an ACL that is a single entry that covers
every single IP address from here to here,
every single IP address, not every single subnet, okay,
every single IP address.
Always remember that.
When you're dealing with access control lists,
it's not about subnets, it's about IP addresses.
So yes, does it match every single IP address
in all of those subnets?
Yes, it does.
But it's not matching a subnet mask,
it's just matching the IP addresses.
The subnet mask doesn't matter
when it's all said and done with the ACL.
So, right, you have two different options.
Two different options.
So if you can do this way, do this way.
It's simpler, right?
Maybe take you a little bit more time,
but a little bit of copying and pasting,
a little of this, a little of that,
you can go ahead and do it.
But if you're forced to do something like this,
or you're forced to verify something like this,
it's gonna require a little bit of work on your part.
Because you're gonna have to figure out
exactly what this wildcard mask is,
and how are you gonna get that?
So to do that, take the first value and the last value,
and then write them out like this.
Now this is very, very, very, very similar
to what we did with our summarization discussion for OSPF.
Remember we had 10.0.0.0, 10.0.1.0,
10.0.2.0, 10.0.3.0, slash 24, 24, 24, 24, right?
That's what we had.
And what did I tell you to do?
I said, well, if you're gonna figure it out in this case,
then what I want you to do
is I want you to keep the 10, the zero,
and then what is that?
That is one, two, three, four, five, six, seven, eight, zero,
and then do the last one.
So 10.0.1, two, three, four, five, six, seven, eight.
There you go.
And then we work our way from here to here.
We find out exactly where things change.
And then based on that,
then these are all ones and these are all zeros.
And this is our new subnet mask.
Would it be 255, 255, 255?
Oops, nope.
Would we have 248, 248, 252?
Oh my gosh, I'm drawing a blank right now.
22, 22, 252.0, 252.0 in that case, I believe.
I'm trying to do it all in my head right now
without writing it down properly.
It's a slash 22.
So it's a slash 22.
So it would be 10.0.0.0 slash 22 because it would be 22 ones here.
That's summarization, though.
That's summarization.
But same kind of idea is happening here.
So in reality, I could just write 172, 16,
write this out like this,
and then write all of these out as zero.
We could totally do that.
And then what are we going to do?
We're going to figure out where do the binary values change.
We see they change right there.
So now instead of ones and zeros, it's zeros and ones.
That's it.
Zeros and ones instead of ones and zeros.
And so put our zeros in.
Put our ones in.
Convert it to decimal.
And now we have the first value, 172, 16, 0, 0,
and then the wildcard mask.
And there you go.
You figured it out.
So now something like this, again, only works if it's perfect.
And that's true for the real world.
If these are not contiguous subnets, it's not going to work.
Number two, they have to be a power of two because of how binary works.
If they're not a power of two, it's not going to work.
Number three, if I convert this to a subnet mask,
flip it to a subnet mask, so convert all the zeros to ones
and all the ones to zeros in the wildcard mask,
with that subnet mask combined with that network ID,
would that actually be the network ID for that subnet mask?
If it's not, then, again, this shortcut wouldn't work.
It has to do with binaries, powers of two, stuff like that,
and network IDs and counting and everything.
So even in the real world, if you want to combine networks together,
you can't just combine whatever you want.
If you did, then you might be permitting things you don't want to permit
and denying things you don't want to deny.
So take this example here, 172.16.10.0 to 172.16.26.0.
So we got 17 in this case, so not a power of two.
They are contiguous, but this wouldn't be the network ID anyways
when it's all said and done once we do the binary math.
So let's do the binary math here.
Wait, that's the same answer.
That's right.
So even this range of addresses, if we combined this range of addresses,
it would actually be everything from 172.16.0.0 all the way to 172.31.255.
No, what do we have?
172.16.31.255.
That's what it is.
So even though those are the only addresses, if we try to combine them together,
the entire range is this no matter what.
Why? Powers of two.
Binary.
So just keep that in mind in the real world.
The exam, it's not going to happen to you more than likely
because Cisco's not going to give you stuff that doesn't work.
Cisco's going to give you stuff that does work.
So you can totally use this really quickly and get it done on the exam.
But in the real world, just be careful.
You can't just use shortcuts anytime you want and say, well, Raymond said so.
Well, no, I'm helping you get through an exam right now.
That's what I'm doing.
You've got to be careful in the real world because, remember,
you're still dealing with binary powers of two.
So therefore, you know, 0, 1, 2, 4, 8, 16, 32, 64, 128.
That really makes a difference in what you can group together.
So take a look at something like this.
If you're presenting something like this on the certification exam,
how could you combine all of these addresses together into one?
Into one.
So notice this is not networks I'm talking about.
This is just straight-up addresses.
I'm saying, hey, every address from 10.10.10.248 to 10.10.10.255.
So one of the things you can do is you know you've got 10.10.10.
Those are all the same.
So it's 10.10.10.
And now you need 248 converted into binary.
So it would be 248 in binary.
We've got 1, 2, 3, 4, 5, 6, 7, 8.
That's what we have.
And then the other 255 would be 1, 2, 3, 4, 5, 6, 7, 8.
There we go.
So what does that mean?
Oh, wait, did I have 248 right or wrong?
That's 1, 2, 3, 4.
240.
1, 2, 3, 4.
No, I had it wrong.
I just realized that.
There we go.
That's what I want.
So 248 and 255.
So now what do you do?
Well, come from left to right.
Draw your line.
All of these are now going to be 0's.
These are all going to be 1's.
So what do you have?
You have 0, 2, 3, 4, 5, 6, 7, 8, 9, et cetera, et cetera, et
cetera, et cetera, et cetera.
And in your very last octet, you're
going to have 1, 2, 3, 4, 5, 6, 7, 8.
So then you have 0.0.0.
What would this be?
7.
So there's your wildcard mask.
So then take your first address, this one here, 10.10.10.248
with a wildcard mask of 0007.
That would be every single IP address from there
all the way up to 255.
And so then here's an example using network IDs or networks.
So in this case here, we've got contiguous networks
from 32 to 39.
But let me show you a shortcut here
that we could have done on the last one.
I'm going to teach you how to shortcut it.
And again, shortcutting.
Actually, let's do the shortcut on the other one first.
Shortcutting is going to work for you in this case.
Why?
Because again, perfect values, powers of 2,
contiguous, et cetera, et cetera.
So what I want you to do, if you were on the exam,
instead of doing all this, if you don't want to do this,
do 10.10.10.255 minus 10.10.10.248.
There's your wildcard mask.
Wait.
Go back for a second, Raymond.
Really?
You want me to go back?
OK, I can go back.
Can we do that here?
Yeah, sure.
This is where you've got to be careful.
There's a little exception to the rule.
0 minus 0.
The answer is not 0.
You've got to remember.
Once you've messed around with the octet that's changing,
everything after that is going to be 1's.
So always remember that it's going to be.
So if you're going to shortcut it this way,
remember that after that middle octet that's changing,
then it's 255 after that.
So yeah, it works there as well.
So you could totally do that.
If you're comfortable enough doing that.
And here, because we were in the last octet,
it wasn't a big deal.
In this case, we're in the third octet.
So we've got to be careful with that very last octet.
So let me show you that.
We'll just shortcut this one.
No binary on this one.
Then remember, this is going to be 255 then.
So now you've got 10.10.32.0007255.
So again, all these shortcuts I show you,
because I have used them on certification exams,
and I have been successful so many times,
like super high 90 percentile range of being successful,
that it is my duty to teach you this stuff
to get you ready for the exam.
Because in the real world, folks,
sometimes your access control list,
there's tools for that.
There's tools for that.
And you have a lot of time to figure them out,
craft them, verify them, get them approved,
and so on and so forth.
We just don't have that on the certification exam.
So there you go.
Make sure you know a lot of that stuff.
Why?
Because that's going to help you read, help you verify,
help you look at things and go, what's that, what's that,
what's that, what's that, what's that, what's that.
And you may never actually have to use what I just showed you
from a configuration standpoint.
But you may be always using it from a verification standpoint,
meaning, okay, does that one match what I'm looking at?
Okay, let's do a quick math calculation.
Okay, good.
Yeah, no, it doesn't.
There's my problem.
Okay, let's look at the multiple choice questions.
Yes, there's one.
Change access control list entry, da, da, da, two, da, da, da.
Good.
There's the answer.
We're done.
Right?
It's about helping you verify and get to your answer
really, really quick.