You are on page 1of 8

A P P E N D I X

Subnet Masking and Addressing


PIX Firewall lets you use subnet masking for commands that accept network masks. This appendix lists information by subnet mask and identifies which masks are for networks, hosts, and broadcast addresses.

Note

In some networks, broadcasts are also sent on the network address. This appendix includes the following sections:

Uses for Subnet Information Addresses in the .128 Mask Addresses in the .192 Mask Addresses in the .224 Mask Addresses in the .240 Mask Addresses in the .248 Mask Addresses in the .252 Mask

The subnet masks are also identified by the number of bits in the mask. Table D-1 lists subnet masks by the number of bits in the network ID.
Table D-1 Masks Listed by Number of Bit

Network ID Bits 24 25 26 27 28 29 30

Host ID Bits 8 7 6 5 4 3 2

Subnet .0 .128 .192 .224 .240 .248 .252

Example Notation 192.168.1.1/24 192.168.1.1/25 192.168.1.1/26 192.168.1.1/27 192.168.1.1/28 192.168.1.1/29 192.168.1.1/30

# of Subnets 1 2 4 8 16 32 64

# of Hosts on Each Subnet 254 126 62 30 14 6 2

The .255 mask indicates a single host in a network.

Configuration Guide for the Cisco Secure PIX Firewall Version 5.3 78-12111-01

D-1

Appendix D Uses for Subnet Information

Subnet Masking and Addressing

Uses for Subnet Information


Use subnet information to ensure that your host addresses are in the same subnet and that you are not accidentally using a network or broadcast address for a host.

Note

In the sections that follow, the network address provides a way to reference all the addresses in a subnet, which you can use in the global, outbound, and static commands. For example, you can use the following net static statement to map global addresses 192.168.1.65 through 192.168.1.126 to local addresses 192.168.2.65 through 192.168.2.126: static (dmz1,dmz2) 192.168.1.64 192.168.2.64 netmask 255.255.255.192. This section includes the following topics:

When NAT is Disabled With Limited IP Addresses

When NAT is Disabled


Subnet mask information is especially valuable when you have disabled Network Address Translation (NAT) using the nat 0 command. PIX Firewall requires that IP addresses on each interface be in different subnets. However all the hosts on a PIX Firewall interface between the PIX Firewall and the router must be in the same subnet as well. For example, if you have an address such as 192.168.17.0 and you are not using NAT, you could use the 255.255.255.192 subnet mask for all three interfaces and use addresses 192.168.17.1 through 192.168.17.62 for the outside interface, 192.168.17.65 through 192.168.17.126 for the perimeter interface, and 192.168.17.129 through 192.168.17.190 for the inside interface.

With Limited IP Addresses


Another use for subnet mask information is for network planning when an Internet service provider (ISP) gives you a limited number of IP addresses and requires you to use a specific subnet mask. Use the information in this appendix to ensure that the outside addresses you choose are in the subnet for the appropriate subnet mask. For example, if your ISP assigns you 192.168.17.176 with a subnet mask of .240, you can see in Table D-5, Subnet Number 12 for the .240 mask, that hosts can have IP addresses of 192.168.17.177 through 192.168.17.190. Because this only yields 14 hosts, you will probably use one for your router, another for the outside interface of the PIX Firewall, one for a static for a web server, if you have it, one for a static for your mail server, and the remaining 10 for global addresses. One of these addresses should be a PAT (Port Address Translation) address so that you do not run out of global addresses.

Configuration Guide for the Cisco Secure PIX Firewall Version 5.3

D-2

78-12111-01

Appendix D

Subnet Masking and Addressing Addresses in the .128 Mask

Addresses in the .128 Mask


Table D-2 lists valid addresses for the .128 subnet mask. This mask permits up to 2 subnets with enough host addresses for 126 hosts per subnet.
Table D-2 .128 Network Mask Addresses

Network Subnet Number Address 1 2 .0 .128

Starting Host Address .1 .129

Ending Host Address Broadcast Address .126 .254 .127 .255

Addresses in the .192 Mask


Table D-3 lists valid addresses for the .192 subnet mask. This mask permits up to 4 subnets with enough host addresses for 62 hosts per subnet.
Table D-3 .192 Network Mask Addresses

Network Subnet Number Address 1 2 3 4 .0 .64 .128 .192

Starting Host Address .1 .65 .129 .193

Ending Host Address Broadcast Address .62 .126 .190 .254 .63 .127 .191 .255

Addresses in the .224 Mask


Table D-4 lists valid addresses for the .224 subnet mask. This mask permits up to 8 subnets with enough host addresses for 30 hosts per subnet.
Table D-4 .224 Network Mask Addresses

Network Subnet Number Address 1 2 3 4 5 6 7 8 .0 .32 .64 .96 .128 .160 .192 .224

Starting Host Address .1 .33 .65 .97 .129 .161 .193 .225

Ending Host Address Broadcast Address .30 .62 .94 .126 .158 .190 .222 .254 .31 .63 .95 .127 .159 .191 .223 .255

Configuration Guide for the Cisco Secure PIX Firewall Version 5.3 78-12111-01

D-3

Appendix D Addresses in the .240 Mask

Subnet Masking and Addressing

Addresses in the .240 Mask


Table D-5 lists valid addresses for the .240 subnet mask. This mask permits up to 16 subnets with enough host addresses for 14 hosts per subnet.
Table D-5 .240 Network Mask Addresses

Network Subnet Number Address 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 .0 .16 .32 .48 .64 .80 .96 .112 .128 .144 .160 .176 .192 .208 .224 .240

Starting Host Address .1 .17 .33 .49 .65 .81 .97 .113 .129 .145 .161 .177 .193 .209 .225 .241

Ending Host Address Broadcast Address .14 .30 .46 .62 .78 .94 .110 .126 .142 .158 .174 .190 .206 .222 .238 .254 .15 .31 .47 .63 .79 .95 .111 .127 .143 .159 .175 .191 .207 .223 .239 .255

Configuration Guide for the Cisco Secure PIX Firewall Version 5.3

D-4

78-12111-01

Appendix D

Subnet Masking and Addressing Addresses in the .248 Mask

Addresses in the .248 Mask


Table D-6 lists valid addresses for the .248 subnet mask. This mask permits up to 32 subnets with enough host addresses for 6 hosts per subnet.
Table D-6 .248 Network Mask Addresses

Network Subnet Number Address 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 .0 .8 .16 .24 .32 .40 .48 .56 .64 .72 .80 .88 .96 .104 .112 .120 .128 .136 .144 .152 .160 .168 .176 .184 .192 .200 .208 .216 .224 .232

Starting Host Address .1 .9 .17 .25 .33 .41 .49 .57 .65 .73 .81 .89 .97 .105 .113 .121 .129 .137 .145 .153 .161 .169 .177 .185 .193 .201 .209 .217 .225 .233

Ending Host Address Broadcast Address .6 .14 .22 .30 .38 .46 .54 .62 .70 .78 .86 .94 .102 .110 .118 .126 .134 .142 .150 .158 .166 .174 .182 .190 .198 .206 .214 .222 .230 .238 .7 .15 .23 .31 .39 .47 .55 .63 .71 .79 .87 .95 .103 .111 .119 .127 .135 .143 .151 .159 .167 .175 .183 .191 .199 .207 .215 .223 .231 .239

Configuration Guide for the Cisco Secure PIX Firewall Version 5.3 78-12111-01

D-5

Appendix D Addresses in the .252 Mask

Subnet Masking and Addressing

Table D-6

.248 Network Mask Addresses (continued)

Network Subnet Number Address 31 32 .240 .248

Starting Host Address .241 .249

Ending Host Address Broadcast Address .246 .254 .247 .255

Addresses in the .252 Mask


Table D-7 lists valid addresses for the .252 subnet mask. This mask permits up to 64 subnets with enough host addresses for 2 hosts per subnet.
Table D-7 .252 Network Mask Addresses

Network Subnet Number Address 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 .0 .4 .8 .12 .16 .20 .24 .28 .32 .36 .40 .44 .48 .52 .56 .60 .64 .68 .72 .76 .80 .84 .88 .92 .96

Starting Host Address .1 .5 .9 .13 .17 .21 .25 .29 .33 .37 .41 .45 .49 .53 .57 .61 .65 .69 .73 .77 .81 .85 .89 .93 .97

Ending Host Address Broadcast Address .2 .6 .10 .14 .18 .22 .26 .30 .34 .38 .42 .46 .50 .54 .58 .62 .66 .70 .74 .78 .82 .86 .90 .94 .98 .3 .7 .11 .15 .19 .23 .27 .31 .35 .39 .43 .47 .51 .55 .59 .63 .67 .71 .75 .79 .83 .87 .91 .95 .99

Configuration Guide for the Cisco Secure PIX Firewall Version 5.3

D-6

78-12111-01

Appendix D

Subnet Masking and Addressing Addresses in the .252 Mask

Table D-7

.252 Network Mask Addresses (continued)

Network Subnet Number Address 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 .100 .104 .108 .112 .116 .120 .124 .128 .132 .136 .140 .144 .148 .152 .156 .160 .164 .168 .172 .176 .180 .184 .188 .192 .196 .200 .204 .208 .212 .216 .220 .224 .228 .232 .236

Starting Host Address .101 .105 .109 .113 .117 .121 .125 .129 .133 .137 .141 .145 .149 .153 .157 .161 .165 .169 .173 .177 .181 .185 .189 .193 .197 .201 .205 .209 .213 .217 .221 .225 .229 .233 .237

Ending Host Address Broadcast Address .102 .106 .110 .114 .118 .122 .126 .130 .134 .138 .142 .146 .150 .154 .158 .162 .166 .170 .174 .178 .182 .186 .190 .194 .198 .202 .206 .210 .214 .218 .222 .226 .230 .234 .238 .103 .107 .111 .115 .119 .123 .127 .131 .135 .139 .143 .147 .151 .155 .159 .163 .167 .171 .175 .179 .183 .187 .191 .195 .199 .203 .207 .211 .215 .219 .223 .227 .231 .235 .239

Configuration Guide for the Cisco Secure PIX Firewall Version 5.3 78-12111-01

D-7

Appendix D Addresses in the .252 Mask

Subnet Masking and Addressing

Table D-7

.252 Network Mask Addresses (continued)

Network Subnet Number Address 61 62 63 64 .240 .244 .248 .252

Starting Host Address .241 .245 .249 .253

Ending Host Address Broadcast Address .242 .246 .250 .254 .243 .247 .251 .255

Configuration Guide for the Cisco Secure PIX Firewall Version 5.3

D-8

78-12111-01

You might also like