A P P E N D I XD Subnet Masking and Addressing PIX Firewall lets you use subnet masking for commands that accept network masks. This appendix lists information by subnet mask and identifies which masks are for networks, hosts, and broadcast addresses. Note In some networks, broadcasts are also sent on the network address. This appendix includes the following sections: • • • • • • • Uses for Subnet Information Addresses in the .128 Mask Addresses in the .192 Mask Addresses in the .224 Mask Addresses in the .240 Mask Addresses in the .248 Mask Addresses in the .252 Mask The subnet masks are also identified by the number of bits in the mask. Table D-1 lists subnet masks by the number of bits in the network ID. Table D-1 Masks Listed by Number of Bit Network ID Bits 24 25 26 27 28 29 30 Host ID Bits 8 7 6 5 4 3 2 Subnet .0 .128 .192 .224 .240 .248 .252 Example Notation 192.168.1.1/24 192.168.1.1/25 192.168.1.1/26 192.168.1.1/27 192.168.1.1/28 192.168.1.1/29 192.168.1.1/30 # of Subnets 1 2 4 8 16 32 64 # of Hosts on Each Subnet 254 126 62 30 14 6 2 The .255 mask indicates a single host in a network. Configuration Guide for the Cisco Secure PIX Firewall Version 5.3 78-12111-01 D-1 another for the outside interface of the PIX Firewall.168. one for a static for your mail server. if your ISP assigns you 192.192. 192. and 192.1 through 192. Note In the sections that follow. you can see in Table D-5.168. the network address provides a way to reference all the addresses in a subnet.17.2. PIX Firewall requires that IP addresses on each interface be in different subnets.176 with a subnet mask of .177 through 192.2. you will probably use one for your router.17. that hosts can have IP addresses of 192.192 subnet mask for all three interfaces and use addresses 192.168.17.255. For example. However all the hosts on a PIX Firewall interface between the PIX Firewall and the router must be in the same subnet as well. Use the information in this appendix to ensure that the outside addresses you choose are in the subnet for the appropriate subnet mask.126: static (dmz1.17.17. Because this only yields 14 hosts.65 through 192.168.168. Configuration Guide for the Cisco Secure PIX Firewall Version 5.17.dmz2) 192.168.240.129 through 192.17. one for a static for a web server. which you can use in the global. you could use the 255. and static commands.1.168.65 through 192.17.168.255.168.168.64 192.168.168. For example. This section includes the following topics: • • When NAT is Disabled With Limited IP Addresses When NAT is Disabled Subnet mask information is especially valuable when you have disabled Network Address Translation (NAT) using the nat 0 command.240 mask.1.190.62 for the outside interface.255. One of these addresses should be a PAT (Port Address Translation) address so that you do not run out of global addresses.190 for the inside interface.64 netmask 255. With Limited IP Addresses Another use for subnet mask information is for network planning when an Internet service provider (ISP) gives you a limited number of IP addresses and requires you to use a specific subnet mask. Subnet Number 12 for the .17.2.168.0 and you are not using NAT.168.65 through 192. outbound.3 D-2 78-12111-01 . if you have an address such as 192. you can use the following net static statement to map global addresses 192.168.168.255.Appendix D Uses for Subnet Information Subnet Masking and Addressing Uses for Subnet Information Use subnet information to ensure that your host addresses are in the same subnet and that you are not accidentally using a network or broadcast address for a host.126 to local addresses 192. if you have it.126 for the perimeter interface. and the remaining 10 for global addresses.1.17. For example. 192 Starting Host Address .96 .94 .65 .225 Ending Host Address Broadcast Address .32 .127 .63 .128 Starting Host Address .127 .190 .224 Starting Host Address .62 .255 Configuration Guide for the Cisco Secure PIX Firewall Version 5.31 .159 .191 .255 Addresses in the .1 .0 .254 . This mask permits up to 2 subnets with enough host addresses for 126 hosts per subnet.128 .223 .192 Mask Table D-3 lists valid addresses for the .222 .Appendix D Subnet Masking and Addressing Addresses in the .224 subnet mask.254 .62 .0 .224 Network Mask Addresses Network Subnet Number Address 1 2 3 4 5 6 7 8 .65 .193 Ending Host Address Broadcast Address .64 . This mask permits up to 8 subnets with enough host addresses for 30 hosts per subnet.95 .191 .126 .158 .128 Network Mask Addresses Network Subnet Number Address 1 2 .161 .128 Mask Addresses in the .190 .1 .127 .224 Mask Table D-4 lists valid addresses for the .128 Mask Table D-2 lists valid addresses for the .192 Network Mask Addresses Network Subnet Number Address 1 2 3 4 .30 .126 .192 subnet mask.3 78-12111-01 D-3 .254 . This mask permits up to 4 subnets with enough host addresses for 62 hosts per subnet.64 .63 .129 .192 .128 .129 Ending Host Address Broadcast Address .193 .126 .160 .33 .97 . Table D-3 . Table D-2 .255 Addresses in the .129 .128 subnet mask. Table D-4 .1 .0 . 161 .209 .112 .207 .46 .78 .193 .238 .144 . This mask permits up to 16 subnets with enough host addresses for 14 hosts per subnet.255 Configuration Guide for the Cisco Secure PIX Firewall Version 5.63 .95 .240 Mask Table D-5 lists valid addresses for the .Appendix D Addresses in the .241 Ending Host Address Broadcast Address .126 .206 .64 .15 .159 .175 .62 .143 .160 .31 .208 .80 .47 .79 .223 .96 .174 .192 .33 .222 .48 .239 .158 .94 .240 Mask Subnet Masking and Addressing Addresses in the .225 .3 D-4 78-12111-01 .14 .224 .81 .240 Starting Host Address .30 .142 .65 .191 .1 .240 Network Mask Addresses Network Subnet Number Address 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 .0 .176 .97 .190 .49 .32 .177 .110 .111 . Table D-5 .254 .127 .145 .113 .128 .240 subnet mask.16 .129 .17 . 25 .64 .112 .15 .136 .47 .128 .73 .230 .223 .248 Mask Table D-6 lists valid addresses for the .49 .55 .81 .214 .191 . Table D-6 .232 Starting Host Address .104 .94 .120 .200 .192 .168 .56 .79 .199 .17 .206 .Appendix D Subnet Masking and Addressing Addresses in the .209 .105 .224 .175 .71 .201 .14 .7 .33 .167 . This mask permits up to 32 subnets with enough host addresses for 6 hosts per subnet.248 subnet mask.65 .86 .185 .174 .248 Mask Addresses in the .248 Network Mask Addresses Network Subnet Number Address 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 .183 .70 .198 .215 .127 .152 .169 .160 .231 .222 .16 .150 .8 .118 .134 .38 .103 .144 .158 .102 .166 .208 .177 .3 78-12111-01 D-5 .182 .95 .63 .62 .121 .40 .216 .32 .111 .142 .176 .135 .233 Ending Host Address Broadcast Address .119 .153 .137 .22 .9 .0 .129 .143 .238 .161 .72 .23 .57 .30 .54 .126 .145 .78 .87 .41 .151 .80 .1 .96 .39 .46 .239 Configuration Guide for the Cisco Secure PIX Firewall Version 5.110 .6 .48 .207 .97 .89 .190 .88 .193 .225 .31 .184 .159 .113 .24 .217 . 90 .2 .44 .22 .38 .48 .75 .99 Configuration Guide for the Cisco Secure PIX Firewall Version 5.76 .34 .66 .15 .54 .40 .41 .74 .83 .249 Ending Host Address Broadcast Address .79 .246 .13 .55 .4 .73 .53 .47 .241 .93 .61 .36 .32 .3 D-6 78-12111-01 .82 .98 .28 .29 .248 Network Mask Addresses (continued) Network Subnet Number Address 31 32 .86 .69 .63 .78 .88 .7 .62 .31 .23 .16 .43 .252 Mask Subnet Masking and Addressing Table D-6 . This mask permits up to 64 subnets with enough host addresses for 2 hosts per subnet.81 .39 .84 .26 .9 .80 .91 .248 Starting Host Address .254 .30 .45 .33 .97 Ending Host Address Broadcast Address .92 .252 Mask Table D-7 lists valid addresses for the .94 .96 Starting Host Address .72 .70 .3 .58 .252 subnet mask.64 .24 .50 .87 .67 .5 .255 Addresses in the .60 .14 .20 .51 .11 .59 .25 .49 . Table D-7 .52 .8 .37 .12 .68 .10 .65 .95 .Appendix D Addresses in the .6 .85 .77 .247 .0 .21 .240 .1 .17 .57 .46 .35 .19 .89 .56 .27 .42 .18 .252 Network Mask Addresses Network Subnet Number Address 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 .71 . 180 .252 Mask Table D-7 .112 .130 .199 .173 .106 .143 .145 .175 .131 .120 .146 .132 .135 .228 .219 .101 .174 .166 .123 .151 .171 .136 .113 .187 .119 .154 .204 .126 .209 .205 .148 .169 .170 .181 .129 .155 .3 78-12111-01 D-7 .156 .193 .235 .140 .142 .115 .165 .214 .137 .229 .238 .164 .226 .176 .107 .114 .109 .Appendix D Subnet Masking and Addressing Addresses in the .190 .108 .195 .138 .203 .223 .157 .121 .133 .182 .158 .217 .122 .184 .188 .100 .225 .185 .202 .104 .206 .224 .149 .168 .150 .189 .194 .134 .237 Ending Host Address Broadcast Address .210 .116 .178 .239 Configuration Guide for the Cisco Secure PIX Firewall Version 5.141 .167 .201 .117 .218 .127 .124 .220 .200 .159 .213 .111 .191 .221 .139 .172 .147 .110 .103 .232 .215 .233 .125 .160 .236 Starting Host Address .102 .252 Network Mask Addresses (continued) Network Subnet Number Address 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 .231 .207 .118 .144 .197 .162 .196 .183 .192 .153 .227 .198 .211 .230 .208 .212 .105 .163 .128 .152 .234 .177 .216 .186 .179 .222 .161 . 254 .253 Ending Host Address Broadcast Address .245 .242 .3 D-8 78-12111-01 .255 Configuration Guide for the Cisco Secure PIX Firewall Version 5.248 .250 .241 .252 Starting Host Address .243 .249 .247 .246 .252 Network Mask Addresses (continued) Network Subnet Number Address 61 62 63 64 .252 Mask Subnet Masking and Addressing Table D-7 .240 .244 .251 .Appendix D Addresses in the .