<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Garamond;
panose-1:2 2 4 4 3 3 1 1 8 3;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Are you trying to protect the routers from other hosts within the same network, or just from other networks?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">If the latter, then what you’re trying to do is simple, and broadcast/not using the addresses you mentioned at the beginning isn’t an issue, as every address
in the grouping can be used (subnets in ACLs is just to specify a set of IPs, not defining a subnet in the traditional networking sense).<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">If the former, you’d be better off with subnets and a layer 3 switch/router to route between the subnets.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Garamond","serif";color:#1F497D">Matthew Ballard<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Garamond","serif";color:#1F497D">Network Manager<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Garamond","serif";color:#1F497D">Otis College of Art and Design<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Garamond","serif";color:#1F497D"><a href="mailto:mballard@otis.edu">mballard@otis.edu</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Garamond","serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Garamond","serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><b><span style="font-size:11.0pt;font-family:"Garamond","serif";color:black">CONFIDENTIALITY NOTICE</span></b><span style="font-size:11.0pt;font-family:"Garamond","serif";color:black">: This electronic message
transmission contains information from Otis College of Art and Design, which may be confidential. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the content of this information is prohibited. If you have
received this communication in error, please notify us immediately by e-mail and delete the original message and any attachment without reading or saving in any manner.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> cisco-voip [mailto:cisco-voip-bounces@puck.nether.net]
<b>On Behalf Of </b>Lelio Fulgenzi<br>
<b>Sent:</b> Thursday, February 05, 2015 8:35 AM<br>
<b>To:</b> Cisco-voip (cisco-voip@puck.nether.net)<br>
<b>Subject:</b> Re: [cisco-voip] OT: using subnet/wildcard mask for group within a group, issues?<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:black">Thanks Anthony!<br>
<br>
I should have included that I would be looking at ACLs only, nothing like modifying router interfaces or anything like. Using DHCP reserved addresses, the clients in question would get the appropriate IP address and be allowed through.<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:black">---<br>
Lelio Fulgenzi, B.A.<br>
Senior Analyst, Network Infrastructure<br>
Computing and Communications Services (CCS)<br>
University of Guelph<br>
<br>
519</span><span style="font-size:10.0pt;font-family:"Cambria Math","serif";color:black">‐</span><span style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:black">824</span><span style="font-size:10.0pt;font-family:"Cambria Math","serif";color:black">‐</span><span style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:black">4120
Ext 56354<br>
<a href="mailto:lelio@uoguelph.ca">lelio@uoguelph.ca</a><br>
<a href="http://www.uoguelph.ca/ccs">www.uoguelph.ca/ccs</a><br>
Room 037, Animal Science and Nutrition Building<br>
Guelph, Ontario, N1G 2W1<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:black"><o:p> </o:p></span></p>
<div class="MsoNormal" align="center" style="text-align:center"><span style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:black">
<hr size="2" width="100%" align="center" id="zwchr">
</span></div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span style="font-family:"Helvetica","sans-serif";color:black">From:
</span></b><span style="font-family:"Helvetica","sans-serif";color:black">"Anthony Holloway" <<a href="mailto:avholloway+cisco-voip@gmail.com">avholloway+cisco-voip@gmail.com</a>><br>
<b>To: </b>"Lelio Fulgenzi" <<a href="mailto:lelio@uoguelph.ca">lelio@uoguelph.ca</a>>, "Cisco-voip (<a href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a>)" <<a href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a>><br>
<b>Sent: </b>Thursday, February 5, 2015 11:29:24 AM<br>
<b>Subject: </b>Re: [cisco-voip] OT: using subnet/wildcard mask for group within a group, issues?<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif";color:black">I'm no Route/Switch engineer, so I'm likely wrong here, but I'll give my two cents anyway.<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif";color:black">You didn't specifically state what you are doing though. E.g., ACLs, Interfaces, Routes, etc.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif";color:black">Let's pretend for a moment you wanted to carve out a new network in your environment for this range.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif";color:black">I don't think you'll be allowed to configure this as different interfaces within a single router. It will tell you that the address on the interface is overlapping with another
interface, or something like that. With that, what you could do, is redesign your subnets for this range. You will need to go through the exercise of changing all of the subnet masks for the hosts between .1 - .54. However, it's likely not going to be that
easy, as you can see below, the new variable length subnet masks will chop up your existing network into four new networks. The fourth and last one is your desired new network, so really you end up with three networks for the 50 potential hosts which exist
in that lower range.<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif";color:black">Current (host range) [count]:<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif";color:black"><a href="http://192.168.45.0/26" target="_blank">192.168.45.0/26</a> (.1 - .62) [62]<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif";color:black">New (host range) [count]:<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif";color:black"><a href="http://192.168.45.0/27" target="_blank">192.168.45.0/27</a> (.1 - .30) [30] *<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif";color:black"><a href="http://192.168.45.32/28" target="_blank">192.168.45.32/28</a> (.33 - .46) [14] **<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif";color:black"><a href="http://192.168.45.48/29" target="_blank">192.168.45.48/29</a> (.49 - .54) [6] ***<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif";color:black"><a href="http://192.168.45.56/29" target="_blank">192.168.45.56/29</a> (.57 - .62) [6]<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif";color:black">*Because of the new broadcast address of .31, you'd have to re-ip the current .31 host<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif";color:black">**Because of the new network address of .32, you'd have to re-ip the current .32 host. Same for the broadcast address of .47, you'd have to re-ip the current .47 host<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif";color:black">***Because of the new network address of .48, you'd have to re-ip the current .48 host. Same for the broadcast address of .55, you'd have to re-ip the current .55 host<o:p></o:p></span></p>
</div>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif";color:black">To see this visually:<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif";color:black"><img border="0" width="229" height="357" id="_x0000_i1026" src="cid:image001.png@01D04133.F1D85AD0" alt="Inline image 2"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif";color:black">If you did a router on a stick with sub interfaces for the four new subnets, then the hosts communicating between subnets cannot talk at layer 2 anymore, and would need to be
routed. If you had them plugged into a layer 3 switch that was doing routing, then I wouldn't suspect much would change in terms of traffic patterns or network load. This would be further reduced if you addressed common servers contiguously. E.g., CUCM+CUC+CER+IM&P
as .5, .6, .7, and .8.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif";color:black">Routes to this router would not have to change, which is nice, but that's only if your routes were nicely summarized to begin with. I suspect they are. E.g,, A route of
<a href="http://192.168.45.0/26" target="_blank">192.168.45.0/26</a> going to this router, which now has four sub interfaces, one for each new subnet, would still work fine, and would not need to change. If I'm not mistaken, some/all routing protocols would
summarize these four networks into <a href="http://192.168.45.0/26" target="_blank">
192.168.45.0/26</a> anyway, for the purpose of advertising to other routers. You may have to turn on route summarization however.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif";color:black">Now, let's pretend you actually just wanted to create an ACL to permit those last 6 hosts to access some other subnet, and keep your existing network intact. Then, this is
a whole lot less work and you simply need to create an ACE for your ACL which permits the wild card match. Let's assume that your protected voice subnet was
<a href="http://192.168.46.0/26" target="_blank">192.168.46.0/26</a><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif";color:black">permit ip 192.168.45.56 0.0.0.7 192.168.46.0 0.0.0.63<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif";color:black">Or if not using wild card masks<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif";color:black">permit ip 192.168.45.56 255.255.255.248 192.168.46.0 255.255.255.192<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif";color:black">I don't know if that helped or not, but it was fun using subnet calculating again. Something I haven't done in quite a few years. I think I did it right. ;)<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif";color:black">On Thu Feb 05 2015 at 9:11:18 AM Lelio Fulgenzi <<a href="mailto:lelio@uoguelph.ca" target="_blank">lelio@uoguelph.ca</a>> wrote:<o:p></o:p></span></p>
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:black"><br>
This group is full of it. Knowledge, that is. So who better to ask these questions....<br>
<br>
I've got a subnet, say <a href="http://192.168.45.0/26" target="_blank">192.168.45.0/26</a>, of which I want to allow only a small group of that subnet to access a particular host. I'm able to reserve the top end, which falls into another subnet,
<a href="http://192.168.45.56/29" target="_blank">192.168.45.56/29</a>.<br>
<br>
So, the first network, 192.168.45.0 has network id .0, first host .1, last host .62, b/cast .63<br>
And, the subgroup would be, network id .56, first host .57, last host .62, b/cast .63<br>
<br>
I'm thinking, as long as I don't use 56 and 63, I can do this.<br>
<br>
The hosts I will be protecting will be voice gateways, and collaboration servers, e.g. callmanager, connection, etc.<br>
<br>
Would there be a time where the hosts being protected would interpret the incorrect broadcast address? I don't see how. But I could be missing something.<br>
<br>
Lelio<br>
<br>
<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:black">---<br>
Lelio Fulgenzi, B.A.<br>
Senior Analyst, Network Infrastructure<br>
Computing and Communications Services (CCS)<br>
University of Guelph<br>
<br>
<a href="tel:519%E2%80%90824%E2%80%904120%20Ext%2056354" target="_blank">519<span style="font-family:"Cambria Math","serif"">‐</span>824<span style="font-family:"Cambria Math","serif"">‐</span>4120 Ext 56354</a><br>
<a href="mailto:lelio@uoguelph.ca" target="_blank">lelio@uoguelph.ca</a><br>
<a href="http://www.uoguelph.ca/ccs" target="_blank">www.uoguelph.ca/ccs</a><br>
Room 037, Animal Science and Nutrition Building<br>
Guelph, Ontario, N1G 2W1<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:black"><o:p> </o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif";color:black">_______________________________________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip" target="_blank">https://puck.nether.net/mailman/listinfo/cisco-voip</a><o:p></o:p></span></p>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:black"><o:p> </o:p></span></p>
</div>
</div>
</body>
</html>