{"id":76,"date":"2011-05-18T19:59:11","date_gmt":"2011-05-18T17:59:11","guid":{"rendered":"http:\/\/www.zed-network.fr\/blog\/?p=76"},"modified":"2013-01-04T18:47:49","modified_gmt":"2013-01-04T17:47:49","slug":"calcul-de-wildcard-pour-faire-des-filtres","status":"publish","type":"post","link":"https:\/\/zed-network.fr\/?p=76","title":{"rendered":"Calcul de wildcard pour faire des filtres"},"content":{"rendered":"

Exemple nous recevons les r\u00e9seaux suivants :<\/p>\n

172.16.1.0\/24,\u00a0172.16.2.0\/24, 172.16.3.0\/24, 172.16.4.0\/24, 172.16.5.\/24, 172.16.6.0\/24.<\/p>\n

Nous voulons garder uniquement les r\u00e9seaux suivants :\u00a0172.16.2.0\/24 \u00e0 172.16.5.0\/24.<\/p>\n

Nous voyons si l’on transforme en binaire ce qui nous interresse que nous avons 3 bits qui changent (envert). Nous transformons donc les trois bits en 1 et nous obtenons un wildcard de 7.<\/p>\n

172.16.1.0\/24 =\u00a0\u00a0\u00a0\u00a0\u00a0172.16.00000<\/strong><\/span>001<\/span><\/strong>.0
\n172.16.2.0\/24 =\u00a0\u00a0\u00a0\u00a0\u00a0172.16.00000<\/strong><\/span>010<\/span><\/strong>.0
\n172.16.3.0\/24 =\u00a0\u00a0\u00a0\u00a0\u00a0172.16.00000<\/span>011<\/span><\/strong>.0
\n172.16.4.0\/24 =\u00a0\u00a0\u00a0\u00a0\u00a0172.16.00000<\/strong><\/span>100<\/span><\/strong>.0
\n172.16.5.0\/24 =\u00a0\u00a0\u00a0\u00a0\u00a0140.10.00000<\/strong><\/span>101<\/span><\/strong>.0
\n172.16.6.0\/24 =\u00a0\u00a0\u00a0\u00a0\u00a0140.10.00000<\/strong><\/span>110<\/span><\/strong>.0<\/span><\/p>\n

Wild card\u00a0\u00a0\u00a0\u00a0 =\u00a0\u00a0\u00a0\u00a0 \u00a00.0.00000111.0\u00a0\u00a0\u00a0\u00a0 = 0.0.7.0<\/p>\n

Le probl\u00e8me \u00e9tant que nous voulons que de 2 \u00e0 5. Il faut donc segmenter.<\/p>\n

172.16.1.0\/24 =\u00a0\u00a0\u00a0\u00a0\u00a0172.16.00000<\/strong>001<\/strong>.0<\/span>
\n172.16.2.0\/24 =\u00a0\u00a0\u00a0\u00a0\u00a0172.16.00000<\/strong><\/span>0<\/span>10<\/span><\/strong>.0
\n172.16.3.0\/24 =\u00a0\u00a0\u00a0\u00a0\u00a0172.16.000000<\/span>11<\/span><\/strong>.0
\n172.16.4.0\/24 =\u00a0\u00a0\u00a0\u00a0\u00a0172.16.00000<\/strong><\/span>1<\/span>00<\/span><\/strong>.0
\n172.16.5.0\/24 =\u00a0\u00a0\u00a0\u00a0\u00a0140.10.00000<\/strong><\/span>1<\/span>01<\/span><\/strong>.0<\/span>
\n172.16.6.0\/24 =\u00a0\u00a0\u00a0\u00a0\u00a0140.10.00000<\/strong>110<\/strong>.0<\/p>\n

En gardant seulement les 4 r\u00e9seaux qui nous interessent, on peut voir que l’on a possibilit\u00e9 de couper en deux.<\/p>\n

172.16.2.0\/24 =\u00a0\u00a0\u00a0\u00a0\u00a0172.16.00000<\/strong><\/span>0<\/span>10<\/span><\/strong>.0
\n172.16.3.0\/24 =\u00a0\u00a0\u00a0\u00a0\u00a0172.16.000000<\/span>11<\/span><\/strong>.0<\/p>\n

Et,<\/p>\n

172.16.4.0\/24 =\u00a0\u00a0\u00a0\u00a0\u00a0172.16.00000<\/strong><\/span>1<\/span>00<\/span><\/strong>.0
\n172.16.5.0\/24 =\u00a0\u00a0\u00a0\u00a0\u00a0140.10.00000101<\/span>.0<\/strong><\/span><\/p>\n

Dans les deux bits en verts qui reste on voit que seul le premier change. Ce qui fait 1 bits \u00e0 1 donc 1 en decimal.<\/span><\/p>\n

En conclusion on peut avoir cette ACL :<\/p>\n

ip access-list 10 permit 172.16.2.0 0.0.1<\/span><\/strong>.0<\/p>\n

ip access-list 20 permit 172.16.4.0 0.0.1<\/strong><\/span>.0<\/p>\n

 <\/p>\n

Plus int\u00e9ressant maintenant, nous recevons la classe comp\u00e8te 172.16.0.0\/24 jusqu’\u00e0 172.16.255.0\/24. Nous voulons uniquement les r\u00e9seaux paires : 172.16.0.0, 172.16.2.0, etc…<\/p>\n

On fait la\u00a0m\u00eame\u00a0op\u00e9ration que precedement : \u00e0 Gauche la liste compl\u00e8te de 0 \u00e0 32 et \u00e0 droite en rouge les paires et en noir les impaires. \u00a0En gros si l’on observe bien la seule diff\u00e9rence entre les deux si l’on prend que les paires le premier bit est toujours \u00e0 0 et si on prend les impaires le premier est toujours \u00e0 1. Donc on peut faire le wildcard suivant : 1111 1110 => 254.<\/p>\n\n\n\n\n
Liste compl\u00e8te des 32 premi\u00e8res entr\u00e9es<\/th>\nListe surlign\u00e9 des 32 premi\u00e8res entr\u00e9es<\/th>\n<\/tr>\n
bin 0000 0000 = dec 0
\nbin 0000 0001 = dec 1
\nbin 0000 0010 = dec 2
\nbin 0000 0011 = dec 3
\nbin 0000 0100 = dec 4
\nbin 0000 0101 = dec 5
\nbin 0000 0110 = dec 6
\nbin 0000 0111 = dec 7
\nbin 0000 1000 = dec 8
\nbin 0000 1001 = dec 9
\nbin 0000 1010 = dec 10
\nbin 0000 1011 = dec 11
\nbin 0000 1100 = dec 12
\nbin 0000 1101 = dec 13
\nbin 0000 1110 = dec 14
\nbin 0000 1111 = dec 15
\nbin 0001 0000 = dec 16
\nbin 0001 0001 = dec 17
\nbin 0001 0010 = dec 18
\nbin 0001 0011 = dec 19
\nbin 0001 0100 = dec 20
\nbin 0001 0101 = dec 21
\nbin 0001 0110 = dec 22
\nbin 0001 0111 = dec 23
\nbin 0001 1000 = dec 24
\nbin 0001 1001 = dec 25
\nbin 0001 1010 = dec 26
\nbin 0001 1011 = dec 27
\nbin 0001 1100 = dec 28
\nbin 0001 1101 = dec 29
\nbin 0001 1110 = dec 30
\nbin 0001 1111 = dec 31
\nbin 1111 1110 = dec 32<\/td>\n		bin 0000 0000 = dec 0<\/strong><\/span>
\nbin 0000 0001 = dec 1
\nbin 0000 0010 = dec 2<\/span>
\nbin 0000 0011 = dec 3
\nbin 0000 0100 = dec 4<\/span><\/strong>
\nbin 0000 0101 = dec 5
\nbin 0000 0110 = dec 6<\/span><\/strong>
\nbin 0000 0111 = dec 7
\nbin 0000 1000 = dec 8<\/strong><\/span>
\nbin 0000 1001 = dec 9
\nbin 0000 1010 = dec 10<\/span><\/strong>
\nbin 0000 1011 = dec 11
\nbin 0000 1100 = dec 12<\/span><\/strong>
\nbin 0000 1101 = dec 13
\nbin 0000 1110 = dec 14<\/span><\/strong>
\nbin 0000 1111 = dec 15
\nbin 0001 0000 = dec 16<\/span><\/strong>
\nbin 0001 0001 = dec 17
\nbin 0001 0010 = dec 18<\/span><\/strong>
\nbin 0001 0011 = dec 19
\nbin 0001 0100 = dec 20<\/span><\/strong>
\nbin 0001 0101 = dec 21
\nbin 0001 0110 = dec 22<\/span><\/strong>
\nbin 0001 0111 = dec 23
\nbin 0001 1000 = dec 24<\/span><\/strong>
\nbin 0001 1001 = dec 25
\nbin 0001 1010 = dec 26<\/span><\/strong>
\nbin 0001 1011 = dec 27
\nbin 0001 1100 = dec 28<\/span><\/strong>
\nbin 0001 1101 = dec 29
\nbin 0001 1110 = dec 30<\/span><\/strong>
\nbin 0001 1111 = dec 31
\nbin 1111 1110 = dec 32<\/span><\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Donc pour garder les r\u00e9seaux paires, on part de 172.16.0.0 avec le masque 0.0.254.0 et on vire tous les impaires. Idem pour avoir que les impaires on part de 172.16.1.0 avec le meme masque 0.0.254.0.<\/p>\n

Et voila on a ce que l’on veut en 1 ACL.<\/p>\n

Dernier exemple un peu plus complexe. Nous allons combiner ce que l’on a vu en acceptant que les paires entre 20 et 30 exclus avec le moins de ligne d’ACL possible.<\/p>\n

L’id\u00e9e est de r\u00e9cup\u00e9rer ce que l’on a d’abord entre 20 et 30. Si l’on fait le meme exercice on se rend compte que l’on va matcher sur 16, 18 et 30. Il faudra donc supprimer c’est enregistrement un par un.<\/p>\n

bin 0001 0000 = dec 16
\nbin 0001 0010 = dec 18
\nbin 0001 0100 = dec 20
\nbin 0001 0110 = dec 22
\nbin 0001 1000 = dec 24
\nbin 0001 1010 = dec 26
\nbin 0001 1100 = dec 28
\nbin 0001 1110 = dec 30<\/p>\n

le premier wildcard est 14 0000 1110. Cela va prendre les paires de 16 \u00e0 30. Il suffit apr\u00e8s d’interdire les intrus.<\/p>\n

#do sh ip access\r\nStandard IP access list 1\r\n    1 deny   172.16.16.0, wildcard bits 0.0.0.255\r\n    2 deny   172.16.18.0, wildcard bits 0.0.0.255\r\n    3 deny   172.16.30.0, wildcard bits 0.0.0.255 \r\n    20 permit 172.16.16.0, wildcard bits 0.0.14.0 \r\n!\r\n#do sh ip bgp\r\nBGP table version is 6, local router ID is 10.0.1.2\r\nStatus codes: s suppressed, d damped, h history, * valid, > best, i - internal,\r\n              r RIB-failure, S Stale\r\nOrigin codes: i - IGP, e - EGP, ? - incomplete\r\n\r\n   Network          Next Hop            Metric LocPrf Weight Path\r\n*> 172.16.20.0\/24   10.0.1.1                 0             0 100 i\r\n*> 172.16.22.0\/24   10.0.1.1                 0             0 100 i\r\n*> 172.16.24.0\/24   10.0.1.1                 0             0 100 i\r\n*> 172.16.26.0\/24   10.0.1.1                 0             0 100 i\r\n*> 172.16.28.0\/24   10.0.1.1                 0             0 100 i<\/pre>\n
 <\/p>\n","protected":false},"excerpt":{"rendered":"
Exemple nous recevons les r\u00e9seaux suivants : 172.16.1.0\/24,\u00a0172.16.2.0\/24, 172.16.3.0\/24, 172.16.4.0\/24, 172.16.5.\/24, 172.16.6.0\/24. Nous voulons garder uniquement les r\u00e9seaux suivants :\u00a0172.16.2.0\/24 \u00e0 172.16.5.0\/24. Nous voyons si l’on transforme en binaire ce qui nous interresse que nous avons 3 bits qui changent (envert). Nous transformons donc les trois bits en 1 et nous obtenons un wildcard de […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"footnotes":""},"categories":[3],"tags":[],"class_list":["post-76","post","type-post","status-publish","format-standard","hentry","category-ccie-rs"],"_links":{"self":[{"href":"https:\/\/zed-network.fr\/index.php?rest_route=\/wp\/v2\/posts\/76","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zed-network.fr\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zed-network.fr\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zed-network.fr\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zed-network.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=76"}],"version-history":[{"count":4,"href":"https:\/\/zed-network.fr\/index.php?rest_route=\/wp\/v2\/posts\/76\/revisions"}],"predecessor-version":[{"id":100,"href":"https:\/\/zed-network.fr\/index.php?rest_route=\/wp\/v2\/posts\/76\/revisions\/100"}],"wp:attachment":[{"href":"https:\/\/zed-network.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=76"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zed-network.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=76"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zed-network.fr\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=76"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}