figuring out how many hosts are in a subnetted network), SO 32 - 1 = 31. The wildcard mask is 0.0.0.31. Yes, it's really that simple. All you really need to think about is the one octet that isn't a 0 or a 255. In the case of the wildcard mask being in a position other than the last octet, simply use the same formula and consider the number of hosts to be what it would be if the dividing octet were the last octet. Here's an example, using the subnet mask 255.240.0.0: 1. Replace all 0 octets with 255 and all 255 octets with 0 for a result of 0.240.255.255. 2. 240 in the last octet of a subnet mask (255.255.255.240) would yield 16 hosts. 3. 16 - 1 = 15. Replace this value for the octet not changed in step 1. The result is 0.15.255.255. 4. The wildcard mask is 0.15.255.255. The more you work with inverse masks, the easier this becomes. Try a few for yourself, and you'll quickly get the hang of it. Chapter 25: Access Lists To make things even more confusing, access lists in Cisco Adaptive Security Appliances (ASAs) don't use inverse masks, but instead use regular subnet masks. Here's a sample access list from a 5540 ASA: access-list GAD extended permit tcp any 10.0.0.0 255.255.255.0 eq WWW Here's the equivalent access list as configured in a 3750 switch: ip access-list - extended GAD permit tcp any 10.10.10.0 0.0.0.255 eq WWW Notice the section in bold italics. On the ASA, a normal subnet mask is used to define the range. On the 3750, an inverse mask is used. Luckily, you'll get an error on either device if you do it the wrong way, but it's still an annoying inconsistency. In NX-OS, access lists can use prefixes instead of subnet or inverse masks. I like this format the best and wish all platforms would adopt it: ip access-list GAD 10 permit tcp 10.10.10.0/24 any eq WWW Where to Apply Access Lists One of the most common questions I hear from junior engineers is, "Do I apply the access list inbound or outbound?" The answer is almost always inbound. Figure 25-1 shows a simple router with two interfaces, E0 and E1. I've