A wildcard mask is a 32-bit mask that identifies which address bits must match and which may differ. A 0 requires a match; a 1 ignores that bit. It resembles an inverted netmask but serves a matching purpose. section 17.4 section 23.2.1
Use wildcard masks to match interface addresses in OSPF or source addresses in standard numbered ACLs:
- 0.0.0.0 requires every address bit to match, selecting one exact address. section 17.4
- 0.0.0.255 ignores the final octet, matching a /24-sized address range. section 23.2.1
- Calculate an equivalent wildcard mask by subtracting each netmask octet from 255. section 23.2.1
- In ACLs, process entries from top to bottom, so a broad permit can prevent a later specific deny from being reached. section 23.2.1
Selecting OSPF interfaces
The command `network 192.168.1.0 0.0.0.7 area 0` matches interfaces whose first 29 bits correspond to 192.168.1.0, allowing addresses such as 192.168.1.1 and 192.168.1.5. For one exact interface, `network 192.168.2.1 0.0.0.0 area 0` requires all bits to match. section 17.4
Filtering an address range with an ACL
A standard ACL can deny `192.168.1.0 0.0.0.255`, matching that subnet, then permit `192.168.0.0 0.0.255.255`, matching the remaining 192.168.0.0/16 range. Apply the ACL to an interface with `ip access-group 1 out`.
