This is the mask paired with cienaCesAclRuleOuterVid, letting a rule match a range of outer VLAN IDs (such as all VLANs in a numeric block assigned to one department or tenant) rather than a single exact VLAN, and it's similarly inert unless cienaCesAclRuleMatchOuterVid is true. An admin uses a mask here to write one rule that applies across a contiguous or bit-pattern-defined range of service VLANs, rather than needing a separate rule per individual VLAN ID in that range. For example, if outer VLANs 100-103 are all assigned to one customer, an admin might construct a mask that matches all four of those VLAN IDs with a single rule rather than four.