Wildcard Masks in Cisco IOS: ACL & OSPF Subnet Guide

1. What is a Wildcard Mask?

A wildcard mask is a 32-bit bitmask used in Cisco IOS configuration commands (such as Access Control Lists and OSPF network statements) to indicate which bits in an IP address must match and which bits can be ignored.

• Bit = 0: The corresponding bit in the packet's IP address MUST match exactly.
• Bit = 1: The corresponding bit in the packet's IP address is a "don't care" wildcard bit.

2. Inverting the Subnet Mask

In standard network matching, a wildcard mask is simply the bitwise inverse (NOT) of the subnet mask. The simplest mathematical trick is subtracting each octet of the subnet mask from 255:

Subnet Mask:   255.255.255.0  (/24)
Calculation:   (255-255).(255-255).(255-255).(255-0)
Wildcard Mask: 0.0.0.255

Subnet Mask:   255.255.252.0  (/22)
Calculation:   (255-255).(255-255).(255-252).(255-0)
Wildcard Mask: 0.0.3.255

3. Wildcard Masks in Cisco CLI Configuration

Here is an example configuring a GigabitEthernet interface and enabling OSPF Area 0 for a /24 subnet:

! Interface IP & Subnet Mask Configuration
Router(config)# interface GigabitEthernet0/0/1
Router(config-if)# ip address 10.0.50.1 255.255.255.0
Router(config-if)# no shutdown

! OSPF Network Statement with Wildcard Mask
Router(config)# router ospf 1
Router(config-router)# network 10.0.50.0 0.0.0.255 area 0

! Extended ACL Permit Rule
Router(config)# ip access-list extended SECURE_VLAN
Router(config-ext-nacl)# permit ip 10.0.50.0 0.0.0.255 192.168.10.0 0.0.0.255

4. Non-Contiguous Wildcard Masks

While standard subnet masks must have contiguous 1s followed by contiguous 0s, wildcard masks in Cisco Access Control Lists do not strictly require contiguous bits. For example, a wildcard mask of 0.0.0.1 can match all even or all odd IP addresses across a subnet—a powerful tool for specialized firewall traffic engineering.