IPX access-list and summary addressing cheatsheet.  See www.boson.com for updates.
	Copyright (c) 1999 by Boson Software
	Written by dave@boson.com

-----------

The first part of this document covers Hex addressing for IPX in general.
The middle part of this document walks you through an access-list inverted mask in Hex.
The last part of this document walks you through an NLSP standard mask in Hex.

-----------

IPX access-list Route Filter and Packet Filter format is INVERTED just like TCP/IP.
However, TCP/IP is figured out using a dotted decimal-to-binary conversion while
IPX/SPX uses a dotted hex-to-binary conversion.  Once in binary format, IP & IPX
are both computed the exact same way.  First, a review of IPX addressing:

IPX Network Address rules:
	* There are 32 bits in the network, which are 8 Hex characters.
	* Hex addresses can have the leading 0's dropped from the output.
	  Example: 000000C1 becomes C1.
IPX Node Address rules:
	* There are 48 bits in the node, which are 12 Hex characters in a
	  4-Hex characters per dotted group format.

-----------

For example, you are given the following IPX addresses and are asked, "How do I list
all of these IPX addresses in a single access-list statement?"

10.0000.0000.0000, 11.0000.0000.0000, 12.0000.0000.0000,
13.0000.0000.0000, 14.0000.0000.0000, 15.0000.0000.0000.

What do you tell this guy?  You cannot wildcard these 6 addresses into a single statement,
this range must be broken into two statements!

Here is why:

-----------

We have been given the following networks to group into an inverted access-list mask:

00000010
00000011
00000012
00000013
00000014
00000015

We do not care about the host Hex digits (.0000.0000.0000) so we can ignore them.
Just like IP inverted masks in binary, a 1 means "don't care", and 0 means "check this bit"
IPX is always listed in Hex.  Each Hex character is 4 bits in binary (0-15 in decimal).
For example, to igore a complete Hex character, all 4 binary bits are 1111 (or F in Hex).

So, when .0000.0000.0000 is converted to "I don't care about Host digits" our mask is:
"????????.FFFF.FFFF.FFFF"

-----------

To be on one of these networks, you must start at "00000010" (Hex).
Notice the first 7 characters are the same?  We need to match those bits.
To check bits, use 0 in hex (0000 per character in binary) for each character:
"0000000?.FFFF.FFFF.FFFF"

Where did we get this from?  Remember, 0 is to check what the character is.
This means that the first 7 out of 8 characters must match, in our case 0000001?.

Because the first 7 characters are always the same in our example number, we can just
use 0 to match it in all 7 character cases for our final access-list statement.

The last character changes each time (0-5), so we will look at what to do with it.

-----------

Now we only have one character left to concern ourselves with, it can be
0 hex - 0000 binary
1 hex - 0001 binary
2 hex - 0010 binary
3 hex - 0011 binary
4 hex - 0100 binary
5 hex - 0101 binary

All of these have the first binary bit in common, which is "0"
We must match this first "0" binary bit and ignore the rest.
Remember, to check a bit is '0', and to igore is '1'

So, to check the first 1 bit and ignore the last 3 bits is 0111 binary (or 7 in Hex):
"00000007.FFFF.FFFF.FFFF"

However, this also includes these last 2 Hex net numbers, which are NOT in the group
that we wanted to create an inverted access-list mask for:
6 - 0110
7 - 0111

Unfortunately, that means it is impossible to do this inverted mask in a single command.

-----------

Ok, so how do you do this??  You must use two commands:

Step 1/2: Notice the first 2 bits in binary are all "00" and MATCH.
This matches the FIRST 2 bits, but not the LAST 2 bits for the first step.
This inverted mask will match the following 4 Hex addresses:
0 hex - (00)00 binary
1 hex - (00)01 binary
2 hex - (00)10 binary
3 hex - (00)11 binary  (this will check the first 2 bits, ignore the last 2 bits)

Network "00000010.0000.0000.0000" will use inverted mask "00000003.FFFF.FFFF.FFFF"
That statement will summarize Hex networks 00000010 through 00000013.
Reminder: Access-lists and routing update filters are inverted 1=ignore, 0=check.

-----------

Step 2/2: Notice the first 3 bits in binary are both "010" and MATCH.
This matches the FIRST 3 bits, but not the LAST 1 bit for the second step.
This inverted mask will match the following 2 Hex addresses:
4 hex - (010)0 binary
5 hex - (010)1 binary
1 hex - (000)1 binary  (this will check the first 3 bits, ignore the last 1 bit)

Network "00000014.0000.0000.0000" will use inverted mask "00000001.FFFF.FFFF.FFFF"
That statement will summarize Hex networks 00000014 through 00000015.
Reminder: Access-lists and routing update filters are inverted 1=ignore, 0=check.

-----------
-----------  End access-list discussion, start NSLP discussion:
-----------

To create an NLSP route aggregation:

NLSP route summaries do NOT use an inverted mask like access-lists do.
NLSP route summaries are similar to other IP-related routing protocols, like OSPF.

The route summary binary bits will be the exact opposite to an access-list (not inverted).
Just like IP route summaries in binary, a 1 means "check this bit", 
and 0 means "don't care".  THIS IS BACKWARDS FROM ACCESS-LISTS.

Ok, so let's go through this with the same numbers as above!
Again, you must use two commands to summarize Hex networks 0-5.

-----------

Step 1/2: Notice the first 2 bits in binary are all "11" and MATCH.
This matches the FIRST 2 bits, but not the LAST 2 bits for the first step.
This standard mask will match the following 4 Hex addresses:

0 hex - (00)00 binary
1 hex - (00)01 binary
2 hex - (00)10 binary
3 hex - (00)11 binary
C hex - (11)00 binary   (this will check the first 2 bits, ignore the last 2 bits)

Network "00000010.0000.0000.0000" will use standard mask "FFFFFFFC.0000.0000.0000"
That statement will summarize Hex networks 00000010 through 00000013.
Reminder: Opposite of access-lists is 1=check, 0=ignore.

-----------

Step 2/2: Notice the first 3 bits in binary are all "101" and MATCH.
This matches the FIRST 3 bits, but not the LAST 1 bit for the second step.
This standard mask will match the following 2 Hex addresses:

4 hex - (010)0 binary
5 hex - (010)1 binary
E hex - (111)0 binary  (this will check the first 3 bits, ignore the last 1 bit)

Network "00000014.0000.0000.0000" will use standard mask "FFFFFFFE.0000.0000.0000"
That statement will summarize Hex networks 00000014 through 00000015.
Reminder: Opposite of access-lists is 1=check, 0=ignore.

-----------

HEXIDECIMAL TO DECIMAL TO BINARY QUICK-REFERENCE:

1 HEX = 01 DEC = 0001 BINARY
2 HEX = 02 DEC = 0010 BINARY
3 HEX = 03 DEC = 0011 BINARY
4 HEX = 04 DEC = 0100 BINARY
5 HEX = 05 DEC = 0101 BINARY
6 HEX = 06 DEC = 0110 BINARY
7 HEX = 07 DEC = 0111 BINARY
8 HEX = 08 DEC = 1000 BINARY
9 HEX = 09 DEC = 1001 BINARY
A HEX = 10 DEC = 1010 BINARY
B HEX = 11 DEC = 1011 BINARY
C HEX = 12 DEC = 1100 BINARY
D HEX = 13 DEC = 1101 BINARY
E HEX = 14 DEC = 1110 BINARY
F HEX = 15 DEC = 1111 BINARY


