to write better, more efficient, and more powerful access lists. When you're creating access lists (or any configuration, for that matter), it's a good idea to create them first in a text editor, and then, once you've worked out all the details, try them in a lab environment. Anytime you're working on filters, you risk causing an outage. Named Versus Numbered Access lists on many Cisco devices can be either named or numbered. Named access lists are referenced with a name such as GAD or Repel lInvaders. Numbered access lists are the older method, where each ACL is defined by a number such as 101. Where possible, you should get in the habit of using named access lists. Some devices such as certain Nexus switches don't support numbered access lists at all. Wildcard Masks Wildcard masks (also called inverse masks) are used in many devices for creating access lists. These masks can be confusing, because they're the opposite, in binary, of normal subnet masks. In other words, the wildcard mask you would use to match a range that is described with a subnet mask of 255.255.255.0 would be 0.0.0.255. Here's a simple rule that will solve most of the subnet/wildcard mask problems you'll Replace all Os with 255s, and all 255s with Os. Table 25-1 shows how class A, B, and C subnet masks are written as wildcard masks. Table 25-1. Classful wildcard masks Subnet mask Matching wildcard mask 255.0.0.0 0.255.255.255 255.255.0.0 0.0.255.255 255.255.255.0 0.0.0.255 While this may seem obvious, in the real world, networks are not often designed on classful boundaries. To illustrate my point, consider a subnet mask of 255.255.255.224. The equivalent wildcard mask works out to be 0.0.0.31. Luckily, there is a trick to figuring out all wildcard masks, and it's easier than you might think. Here it is: The wildcard mask will be a derivative of the number of host addresses provided by the subnet mask minus one. In the preceding example (the subnet mask 255.255.255.224), there are eight networks with 32 hosts in each (see Chapter 36 for help 