You can also use the secondary element to specify an exception for a range of IP addresses that are within (rather than at the end) a larger range defined by the primary element, to carving out a list of denied addresses. This approach also requires use of partial segment masking.
- You can deny access to IP addresses 48 through 63 (instead of the IP addresses 192 through 255 shown in Example: Secondary Element Processing—Address Range Exception) using the following deny element:
<deny ip=”192.0.2.20/28”/>
This deny element is equivalent to the following binary IP and mask:
11000000.00000000.00000010.00010100 (192.0.2.20) 11111111.11111110.11111111.11110000 (255.255.255.240 or /28"/>) ____________________________________________________________________ 11000000.00000000.00000010.00110000 (192.0.2.48) - The result of ANDing the IP and mask indicates (in bold) that only the first four bits of the fourth segment are considered for denial within the 192.0.2.20 subnet. These bits must match exactly for an address to be denied. The deny element has the following effects:
- Addresses 192.0.2.64 through 192.0.2.255 all have a value of 1 for one or both of the first two bits, which causes them to not match the deny mask, and not be denied.
- Addresses 192.0.35.1 through 192.0.35.47 have a zero value for either the third or fourth bit, and are also not denied.
- Addresses 192.0.35.48 through 192.0.35.63 all have 0011 for the first four bits, and are denied.Because the restriction processes masks from left to right, in binary notation, you cannot isolate some addresses with a carve out type of mask, for example, 192.0.2.51 through 192.0.35.62. Carve out exceptions always affect all addresses that contain the mask value of the IP filter.