Goldfish Networks wordmark
IntermediatePublished 2026-06-25

ACL Wildcard Masks: Match Host, Subnet, and Range

Bundle lab

Hands-on CCNA ACL practice using standard ACLs and wildcard masks to allow a single host, a contiguous range, and an entire subnet while proving a deny. You will place the ACL near the destination, order statements correctly, verify with end-host pings and ACL counters, and troubleshoot common mistakes.

Track
Est. time
55 minutes
Difficulty
Intermediate
Topics

Learning objectives

  • Craft wildcard masks for a single host, a precise contiguous range, and a full subnet using standard ACL syntax.
  • Place a standard ACL near the destination, applied in the correct direction, so it filters the intended routed flow.
  • Order ACEs correctly so specific permits come before broader subnet denies to avoid shadowing.
  • Verify ACL behavior using end-host pings and ACL hit counters on IOS.
  • Troubleshoot wildcard math, ACL placement/direction, and statement order problems without breaking return traffic.

Troubleshooting focus

  • ping -I 10.10.10.10 10.30.30.10 from CLIENT10 fails: a broader deny is shadowing the host permit. In show access-lists, confirm the host permit and the bench-block permit both sit above the broader /24 deny.
  • A source inside 10.10.10.64–10.10.10.79 is denied, or one outside it is permitted: the wildcard is off by a bit. A 16-address block needs its base aligned to the block size, and a wildcard whose final octet is one less than the block size.
  • ping -I 10.10.10.20 10.30.30.10 succeeds when it should fail: the ACL is not filtering the request.
  • Replies from SRV-APP10 never get back to CLIENT10: the ACL was applied inbound on the server LAN. Inbound sees only server-sourced replies, so it black-holes responses and never inspects the requests. Trace the forward path and re-apply outbound on Ethernet0/2.
  • Sources other than Site A are blocked as well: the list has no trailing catch-all.
  • Pings behave in a way the ACEs do not explain: run show access-lists and see which line is incrementing. All counters at zero means the ACL is on the wrong interface or the wrong direction and no packets are hitting it.

Topology

Subscribe to preview this lab's topology.

See plans

Related labs

More hands-on Cisco Modeling Labs practice on the same track and topics.

Study this topic

Free guides, a command cheat sheet, and graded practice for this lab's topic.

Learn Access Control Lists (ACLs)What Is an Access Control List (ACL)?

Grade your work

How this lab is graded
  • Build it your way. Where a lab lets you choose a value — a VLAN name, an interface description — grading checks that you configured it, not which name you picked. Names that another line has to reference, like an ACL applied with access-class, are stated in the guide and do have to match.
  • Addresses, modes and protocol keywords are exact. An IP address, a subnet mask, switchport mode trunk, an encapsulation — these carry the meaning of the lab, so they are graded as written in the guide.
  • Grading reads your saved configuration. Export the lab from CML after you have configured it, and make sure anything you set is in the running-config — a change that only exists in a terminal session never reaches the grader.
  • You can submit as many times as you like. Your best score stands, and each attempt tells you which checks passed so you can work the gaps.
  • Scored something you believe is correct? Use Report an issue on this page — that is exactly how the grading fixes in the changelog got found.

Create a free account to submit your lab for grading.

Create a free account
Found a problem with this lab?

Please sign in to report a problem — tying it to your attempts lets us reproduce and fix it faster.