| 3.1 |  | Access Control Lists |
| 3.1.2 |  | Understanding ACL concepts |

| Using masks Masks are used with IP addresses in IP ACLs to specify what should be permitted and denied. The following types of masks can be used:

- Masks to configure IP addresses on interfaces start with 255 and have the large values on the left side, such as IP address 209.165.202.129 with a 255.255.255.224 mask.
- Masks for IP ACLs are the reverse, such as mask 0.0.0.255. This is sometimes called an inverse mask or a wildcard mask.

When the value of the mask is broken down into binary code, consisting of zeros and ones, the results determine which address bits are to be considered in processing the traffic. A zero indicates that the address bits require an exact match to be considered. A one in the mask indicates ignore the corresponding bit in the address.

In Figure , imagine that all traffic beginning with 10.1.1 must be matched for traffic to be processed. Based on the binary mask, it can be seen that the first three sets, or octets, must match the given binary network address exactly. The last sets of numbers are ignored (.11111111). Therefore, all traffic beginning with 10.1.1 will match since the last octet is ignored. With this mask, network addresses 10.1.1.1 through 10.1.1.255 (10.1.1.x) will be processed.

The ACL inverse mask can also be determined by subtracting the normal mask from 255.255.255.255. In Figure , the inverse mask is determined for network address 172.16.1.0 with a normal mask of 255.255.255.0.