This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies. For details on cookie usage on our site, read our Privacy Policy
Online calculators don't provide for unusual wc masks like you have. I don't know of any that would make it easier in this case.
Do you know why it was set this way originally? Any reason you can't change to 0.127.255.255, which would simplify knowing what would match? Or you could create a new object that will match 10.224+
How is that object being used? You're matching on a lot of potentially unnecessary addresses.
... View more
It's not quite as easy as it may seem with the wildcard mask you're using. You need to understand how the wildcard mask works to figure out which subnets will be matched.
If your wildcard mask was 0.127.255.255, then everything from 10.128.128.0-10.255.255.255 would match. But your mask is 0.127.127.255, which means some subnets are not going to match in that range.
You'll need to do some binary comparisons to figure out what matches and what doesn't. The matching logic is opposite of subnet masking.
... View more
Does the traffic from the single server egress out ISP 1 even with the PBF in place?
Do the logs show anything interesting with rule hits, allow/deny, etc?
Any packet captures on any interfaces to track where the traffic is going?
... View more
