IP prefix-list ip prefix-list provides the most powerful prefix based filtering mechanism Here is a quick little tutorial on Prefix-lists for you. A normal access-list CANNOT check the subnet mask of a network. It can only check bits to make sure they match, nothing more. A prefix-list has an advantage over an access-list in that it CAN check BOTH bits and subnet mask - both would have to match for the network to be either permitted or denied. For checking bits a prefix list ALWAYS goes from left to right and CANNOT skip any bits. A basic example would be this: 172.16.8.0/24 If there is only a / after the network (no le or ge) then the number after the / is BOTH bits checked and subnet mask. So in this case it will check the 24 bits from left to right (won't care about the last 8 bits) AND it will make sure that it has a 24 bit mask. BOTH the 24 bits checked and the 24 bit subnet mask must match for the network to be permitted or denied. No we can do a range of subn...