| 3.1 |  | Access Control Lists |
| 3.1.3 |  | Summarizing ACLs |

| Subnet masks can also be represented as a fixed length notation. For example, 192.168.10.0/24 would represent 192.168.10.0 255.255.255.0. Some other abbreviated notations that are commonly used include the following:

- The source/source-wildcard of 0.0.0.0/255.255.255.255 means "any".
- The source/wildcard of 10.1.1.2/0.0.0.0 is the same as "host 10.1.1.2".

How can a range of networks be summarized into a single network for ACL optimization? Consider the following networks:

192.168.32.0/24

192.168.33.0/24

192.168.34.0/24

192.168.35.0/24

192.168.36.0/24

192.168.37.0/24

192.168.38.0/24

192.168.39.0/24

The first two octets and the last octet are the same for each network. The following is an explanation of how to summarize these into a single network.

As shown in Figure , the third octet for the above networks can be written according to the octet bit position and address value for each bit.

Since the first five bits match, the eight networks can be summarized into one network as 192.168.32.0/21 or 192.168.32.0 255.255.248.0. All eight possible combinations of the three low-order bits are relevant for the network ranges in question. The following command defines an ACL that permits this network. Subtracting 255.255.248.0, a normal mask, from 255.255.255.255 yields 0.0.7.255. The syntax for this configuration is as follows:

access-list 10 permit ip 192.168.32.0 0.0.7.255

For a further explanation, consider another set of networks:

192.168.146.0/24

192.168.147.0/24

192.168.148.0/24

192.168.149.0/24

The first two octets and the last octet are the same for each network. The third octet for the above networks can be written as shown in Figure , according to the octet bit position and address value for each bit.

Unlike the previous figure, these networks cannot be summarized into a single network, but rather must occupy a minimum of two networks. The above networks can be summarized into two networks:

- For networks 192.168.146.x and 192.168.147.x, all bits match except for the last one, which is ignored. This can be written as 192.168.146.0/23 or 192.168.146.0 255.255.254.0.
- For networks 192.168.146.x and 192.168.149.x, all bits match except for the last one, which is ignored.

The following defines a summarized ACL for the above networks.

access-list 10 permit ip 192.168.146.0 0.0.1.255

access-list 10 permit ip 192.168.148.0 0.0.1.255