VMware ESXi and vSphere Cluster Management

Wildcard Masks Explained for Cisco ACLs and Routing Protocols

Learn how Cisco wildcard masks match IPv4 addresses, calculate inverse masks, and configure EIGRP, OSPF, and ACLs with practical examples.

A wildcard mask is a 32-bit IPv4 matching pattern used with an address to select one address, a subnet, multiple subnets, or a bit-defined set of addresses. Cisco IOS commonly uses wildcard masks in routing-protocol network statements and IPv4 access control lists (ACLs).

A wildcard mask is not a subnet mask. A subnet mask identifies the network and host portions of an address. A wildcard mask tells Cisco which address bits must match and which bits may vary.

How wildcard masks work

Pair an IPv4 address with a wildcard mask and compare the two values bit by bit across all 32 positions. Every bit in the wildcard mask has one of two meanings.

A wildcard bit of 0 creates a fixed bit. A wildcard bit of 1 creates a don't-care bit, meaning either binary value is accepted. The comparison applies to every octet, not just to decimal octet boundaries.

Address matching versus subnet identification

With a normal subnet mask, 1 bits identify the network portion and 0 bits identify the host portion. With a wildcard mask, 0 bits identify positions that must match and 1 bits identify positions that may vary. The similar-looking masks therefore have opposite matching semantics.

Converting subnet masks to wildcard masks

For a conventional contiguous subnet mask, calculate the wildcard mask by subtracting each subnet-mask octet from 255:

wildcard octet = 255 - subnet-mask octet

This is the octet form of inverting every subnet-mask bit. Such a result is often called an inverse mask.

For example, the /23 subnet mask 255.255.254.0 becomes 0.0.1.255 because 255 - 254 is 1 and 255 - 0 is 255.

A wildcard mask is not required to be the inverse of a conventional subnet mask. ACLs can use noncontiguous wildcard masks, where fixed and variable bits are interspersed. These patterns select bit combinations rather than one continuous CIDR block.

Single-subnet example: 10.0.1.0/24

To match every address in 10.0.1.0/24, use:

10.0.1.0 0.0.0.255

The first three wildcard octets contain only zeros, so all 24 bits corresponding to 10.0.1 must match. The last octet contains eight ones, so any value from 0 through 255 is permitted.

Therefore, this pair matches the span 10.0.1.0 through 10.0.1.255. In a routing statement, the address-and-wildcard pair selects local interface addresses in that range. In an ACL, it matches packet addresses in that range.

Matching two adjacent /24 networks

These two adjacent networks can be selected with one address-and-wildcard pair:

10.0.0.0 0.0.1.255

The third-octet values 0 and 1 are:

0 = 00000000
1 = 00000001

The third-octet wildcard is 1, or 00000001. Its least significant bit is a don't-care bit, so the third octet may end in either 0 or 1. The other seven bits in that octet must remain zero. All eight bits of the fourth octet are variable.

The result is the continuous range 10.0.0.0 through 10.0.1.255, equivalent in size to a /23 range. The base address must be chosen so every fixed bit is correct. A careless base address can produce a different range or fail to represent the intended networks.

Special wildcard values

• 0.0.0.0: Every bit must match, so the pair identifies one exact host. In ACL syntax, the host keyword represents this behavior.
• 255.255.255.255: Every bit is a don't-care bit, so every IPv4 address matches. In ACL syntax, the any keyword represents this behavior.

192.168.0.1 0.0.0.0       exact host
0.0.0.0 255.255.255.255   every IPv4 address

Wildcard masks in EIGRP

An EIGRP network statement uses an address and wildcard mask to select local interfaces. It does not simply act as a route-advertisement filter.

router eigrp 100
 network 10.0.1.0 0.0.0.255

This configuration selects local interfaces whose IPv4 addresses match 10.0.1.0 0.0.0.255, including an interface addressed anywhere in the 10.0.1.0/24 range. EIGRP can then operate on those interfaces. Connected networks associated with selected interfaces can be advertised, subject to the rest of the EIGRP configuration and the interface state.

To select both adjacent /24 ranges from the earlier example:

router eigrp 100
 network 10.0.0.0 0.0.1.255

Use protocol-specific interface commands to check which interfaces were selected and whether they are operational.

Wildcard masks in OSPF

OSPF network statements also use an address and wildcard mask, followed by an area:

router ospf 1
 network 10.0.1.0 0.0.0.255 area 0

This activates OSPF on local interfaces whose addresses match the /24 pattern and assigns those interfaces to area 0. The statement selects interfaces; it is not merely a declaration of a remote network.

Wildcard masks in ACLs

An access control list is an ordered set of permit and deny rules. Standard ACLs commonly match a source address. Extended ACLs can match source and destination addresses along with other packet attributes.

Standard ACL examples

access-list 10 permit 192.168.10.0 0.0.0.255

This permits source addresses in the 192.168.10.0/24 block.

ip access-list standard MANAGEMENT
 permit host 192.168.0.1

The host keyword matches only 192.168.0.1, equivalent to 192.168.0.1 0.0.0.0.

ip access-list standard EXAMPLE
 permit any

The any keyword matches every IPv4 address, equivalent to 0.0.0.0 255.255.255.255.

ACL entries are processed from top to bottom. The first matching entry determines the action. A broad wildcard entry placed before a more specific entry can prevent the specific entry from ever being reached. IPv4 ACLs also have an implicit deny at the end, so traffic that matches no explicit permit is denied.

Contiguous and noncontiguous wildcard masks

A contiguous wildcard mask is commonly derived by inverting a conventional prefix-based subnet mask. Its zero and one regions correspond to fixed network bits and variable host bits.

A noncontiguous wildcard mask has fixed and variable positions interspersed. For example:

192.168.1.0 0.0.0.254

The final-octet wildcard 254 is binary 11111110. The first seven bits may vary, but the least significant bit must match the base address's least significant bit, which is zero. Consequently, this pattern matches addresses in 192.168.1.0/24 with even final-octet values: 0, 2, 4, and so on through 254.

Noncontiguous patterns are harder to read, validate, and maintain. Use a contiguous wildcard where possible. If a noncontiguous pattern is necessary, document the binary logic and test both matching and nonmatching examples.

Calculation and validation workflow

1. Identify the addresses or interfaces that must match.
2. Write the relevant address bits in binary when the range is not an ordinary contiguous subnet.
3. Mark each bit that must remain fixed and each bit that may vary.
4. Build the wildcard with 0 for fixed positions and 1 for variable positions.
5. Choose a base address whose fixed bits represent the intended set.
6. Test representative addresses that should match and addresses that should not match.
7. Apply the configuration and verify the operational result with IOS show commands.

Troubleshooting wildcard-mask problems

Too many routing-protocol interfaces are selected

A wildcard broader than intended, such as 0.0.255.255 instead of 0.0.0.255 for a /24, allows additional address bits to vary. Compare each wildcard bit with the intended fixed and variable positions, then check selected interfaces with protocol-specific commands. Use the inverse of the intended subnet mask or a more specific interface-based configuration where appropriate.

An intended EIGRP or OSPF interface does not participate

Check the interface IPv4 address and operational status. Confirm that every zero bit in the wildcard aligns with the configured base address. Review the routing-process configuration and correct the address-and-wildcard pair if necessary.

An ACL matches unexpected hosts

Calculate the actual range represented by the address and wildcard, then read the ACL in sequence order. A broad entry before a specific entry may match first. Use ACL counters to identify which rule receives traffic. Replace a subnet mask mistakenly entered as a wildcard and place specific rules before broad rules.

An exact-host rule does not match one address

If any wildcard bit is nonzero, that bit may vary, so the rule is not an exact match. Use 0.0.0.0 or the ACL host keyword.

A noncontiguous pattern behaves unexpectedly

Convert the relevant octet or octets to binary. Test several expected matching and nonmatching addresses. Do not interpret a noncontiguous wildcard as though it described one ordinary CIDR subnet.

IOS verification commands

show ip protocols
show ip eigrp interfaces
show ip ospf interface brief
show access-lists
show ip interface

Use show ip protocols to review routing-process network statements, protocol-specific interface commands to confirm interface participation, and show access-lists to inspect ACL entries and hit counts. The show ip interface command helps verify which ACLs are applied to interfaces.

Key takeaways

• A wildcard mask is a 32-bit address-matching pattern, not a subnet mask.
• Wildcard 0 requires the corresponding address bit to match.
• Wildcard 1 allows the corresponding address bit to vary.
• For a conventional subnet, subtract each subnet-mask octet from 255 to obtain the inverse wildcard.
• EIGRP and OSPF network statements select local interfaces; ACL entries match packet addresses.
• ACLs process entries top to bottom and end with an implicit deny.
• Noncontiguous wildcard masks can select special bit patterns, but they require careful documentation and testing.

For a compact reference, return to Wildcard Mask Explained.