ACL wildcard masks
When creating an ACE, you may need to specify a network ID and the subnet mask. However, within ACLs and ACEs, you cannot use a subnet mask as Cisco IOS on the router was not built or designed to accept subnet masks as part of an ACE. ACLs use a wildcard mask, which is a 32-bit binary string used by the Cisco IOS router to determine which bits within the address to match and which bits to ignore.
As with a subnet mask, ones and zeroes are used to indicate the network and host portions of an IP address. For example, the ones within a subnet mask are used to identify the network portion of an address, while the zeroes are used to identify the host portion. Within a wildcard mask, these bits are used for a different purpose. Here, the ones and zeroes are used to filter either a group of addresses or a single IP address to decide whether to permit or deny access to a network resource.
In a wildcard mask, the zeroes are used to match the corresponding bit value...
