> access-list XXX deny ip any 0.0.0.255 255.255.255.0 You must be kidding. Why not access-list XXX deny ip any 0.0.0.42 255.255.255.0 randy