Showing posts with label ip prefix-list. Show all posts
Showing posts with label ip prefix-list. Show all posts

Wednesday, December 23, 2009

ip prefix-list

ip prefix-list provides the most powerful prefix based filtering mechanism

Here is a quick little tutorial on Prefix-lists for you.

A normal access-list CANNOT check the subnet mask of a network. It can only check bits to make sure they match, nothing more. A prefix-list has an advantage over an access-list in that it CAN check BOTH bits and subnet mask - both would have to match for the network to be either permitted or denied.

For checking bits a prefix list ALWAYS goes from left to right and CANNOT skip any bits. A basic example would be this:

172.16.8.0/24

If there is only a / after the network (no le or ge) then the number after the / is BOTH bits checked and subnet mask. So in this case it will check the 24 bits from left to right (won't care about the last 8
bits) AND it will make sure that it has a 24 bit mask. BOTH the 24 bits checked and the 24 bit subnet mask must match for the network to be permitted or denied.

No we can do a range of subnet masks also that could be permitted or
denyed:

172.16.8.0/24 ge 25

If we use either the le or ge (or both le and ge) after the /, then the number directly after the / becomes ONLY bits checked and the number after the ge or le (or both) is the subnet mask. So in this case we are still going to check the first 24 bits of the network from left to right. If those match we are then going to check the subnet mask, which in this case can be GREATER THAN OR EQUAL TO 25 bits - meaning that as long as the first 24 bits of the network match the subnet mask could be 25,26,27,28,29,30,31,or 32 bits. They would all match.

We can also do:

172.16.8.0/24 le 28

Again this will check the first 24 bits of the network to make sure that they match. Then it will check to make sure that the subnet mask is LESS THAN OR EQUAL TO 28 bits. Now this isn't going to be 28 bits down to 0 bits, the subnet mask can't be any lower than the bits we are checking. So the valid range of subnet masks for this one would be 28 bits down to 24 bits (24,25,26,27,and 28). All of those would match.

We can also do both ge and le:

172.16.8.0/24 ge 25 le 27

Here again we are checking the first 24 bits to make sure they match.
Then our subnet mask must be GREATER THAN OR EQUAL TO 25 bits LESS THAN OR EQUAL TO 27 bits. Meaning that 25,26,and 27 bit subnet masks would match.

Now for a couple of examples:

If we have the following networks:

172.16.8.0/28
172.16.8.16/28
172.16.8.32/28
172.16.8.48/28
172.16.8.64/28

We could permit all of these networks with on prefix-list statement:

172.16.8.0/24 ge 28 le 28

This will check the first 24 bits to make sure they match. All of these networks have 172.16.8 as the first 24 bits, and it won't care what is in the last 8 bits. Then it will check to make sure that the subnet mask is GREATER THAN OR EQUAL TO 28 bits LESS THAN OR EQUAL TO 28 bits - the only number that works for this is 28 bits. So the first 24 bits in the network must match and it has to have a 28 bit subnet mask. All 5 of our networks would match for this.

We could be even more precise with this and use:

172.16.8.0/25 ge 28 le 28

If we take a look at our 4th octects we will see that for all of them the 128 bit is off so we can check that bit also (25 bits total we are checking).

0 -- 0 0 0 0 0 0 0 0
16 - 0 0 0 1 0 0 0 0
32 - 0 0 1 0 0 0 0 0
48 - 0 0 1 1 0 0 0 0
64 - 0 1 0 0 0 0 0 0

This would be closer to permitting the 5 networks that we have.

We could also permit only the classful networks. The first thing that we need to do is figure out exactly what a classful network is.

For a class A network we know that it has to have an 8 bit mask and must be between 0 and 127 in the first octect. If we break down 0 and 127 we
get:

0 --- 0 0 0 0 0 0 0 0
127 - 0 1 1 1 1 1 1 1

For the first octect of a class A network the first bit has to be a 0, it must be off. So we can do a prefix-list like this:

0.0.0.0/1 ge 8 le 8

In our first octet the first bit is a 0 (which is what it would need to be to be class A), with the /1 we have we are ONLY checking the first bit to make sure it's a 0 (meaning it would be a class A network 0 - 127). We are then making sure that this class A network actually has a class A subnet mask of 8 bits, and only 8 bits would match.

For the class B's we need to make sure that they have a 16 bit subnet mask and that they are in the range of 128 - 191 in the first octet. If we break down 128 and 191 we get:

128 - 1 0 0 0 0 0 0 0
191 - 1 0 1 1 1 1 1 1

The first two bits are what we are going to care about. We need to make sure that the first two bits in the first octet are 1 0 . The first number that we can use as our standard we are checking against is 128 -
128 has a 1 0 as the first two bits in its first octet.

128.0.0.0/2 ge 16 le 16

So we are checking the first two bits to make sure the network has a 1 0, meaning that it must be in the range of 128 - 191. We are then going to check to make sure that it has the classful 16 bit mask, and ONLY a
16 bit mask.

Finally we have the class C networks. Class C networks are in the range of 192 - 223 and they must have a 24 bit mask. If we break down 192 and
223 we get:

192 - 1 1 0 0 0 0 0 0
223 - 1 1 0 1 1 1 1 1

The first 3 bits in the first octet are what we care about. 192 would be the first number we can put in that first octect that will have 1 1 0 as its first 3 bits.

192.0.0.0/3 ge 24 le 24

We are going to check the first 3 bits of the octet and make sure that its 1 1 0 meaning that it has to be in the range of 192 - 223 being class C, then we are going to check to make sure it has a class C classful subnet of 24 bits.

Finally how to permit or deny any could be very helpful since a Prefix-list just like an Access-list has an implicit deny at the end:

0.0.0.0/0 le 32

This is 'any' for a prefix-list. It says check 0 bits; I don't care what any of the bits are. It also says that the subnet mask can be 32 bits or less (down to the number of bits we are checking) down to 0. So we aren't going to check any bits and the network can have a subnet mask of anything between 0 and 32 bits. This would be 'any'.

Now for your Prefix-list:

In the 3rd Octet we have 1, 4, and 5. We'll break these down to binary to see if we can summarize these into one line:

1 - 0 0 0 0 0 0 0 1
4 - 0 0 0 0 0 1 0 0
5 - 0 0 0 0 0 1 0 1

For a Prefix-list we need to go from the left to the right and we can't skip bits. So for these three networks we would need to stop at the 8 bit since it is the last bit from left to right that is the same. This would give us 3 bits that are different, or 8 possible networks. We only have 3 of the 8 possible networks and we should not permit or deny more than we actually have. We should be as specific as possible.

If we leave the 91.86.1.0/24 alone by itself it will give us a Prefix-list of:

91.86.1.0/24

This will check the first 24 bits from left to right to make sure that they match, and it will also check to make sure that it has a 24-bit subnet mask.

For the 4 and 5 networks we can permit or deny both of those with one line. If we take a look at 4 and 5 again we can see that all of the bit's match down to the 2 bit. This would leave 1 bit that doesn't match, which would give us 2 possible networks, both of which we have.
The Prefix-list to permit or deny both 4 and 5 would be:

91.86.4.0/23 ge 24 le 24

This will check the first 23 bits from left to right. The 24th bit could either be off, which would give us 4, or it could be on which would give us 5. Since we have the ge and le involved the /23 is only bits checked. The ge and le specify that our subnet mask must be greater than or equal to 24-bits and less than or equal to 24-bits which means that the subnet mask must be 24-bits for both possible networks.

thanks
ccienotes - http://ccienotes.blogspot.com/2007/08/ip-prefix-list.html
Posted by at No comments:
Labels: ,

IP Prefix Lists

Appendix D. IP Prefix Lists

Prefix lists became available in Cisco IOS Software Release 12.0(3)T. You can use prefix lists as a simpler alternative to standard IP access lists for routing advertisement filtering with routing protocols. Although prefix lists are most commonly put to use in Border Gateway Protocol (BGP) configurations, this appendix demonstrates other ways that you can use prefix lists to support other routing protocols such as Enhanced Interior Gateway Routing Protocol (EIGRP). Prefix lists introduce a more streamlined way to create filters for network prefix advertisements by following these rules:
  • Like access lists, prefix lists are processed sequentially from top to bottom. When a match is made, processing stops and the rest of the entries are not read.
  • Entries can be added to the prefix lists at any time.
  • An empty prefix lists permits all prefixes by default.
  • Prefix lists do not use wildcard masks like access lists; they use a subnet length mask (for instance, /24).
  • Unlike access lists, lines in prefix lists can be edited by the use of the sequence number.
  • Prefix lists contain an implicit deny any at the end of each list.
  • Sequence numbers are automatically generated; however, automatic sequence generation can be stopped.
Prefix lists are configured from global configuration mode using the following command:
ip prefix-list
list-name | list-number [sequence
sequence-value] deny | permit
network-address/length [ge
ge-value] [le
le-value]
Table D-1 shows the meaning for the prefix list syntax.

Table D-1. IP Prefix List Syntax

Command/Argument
Description
list-name | list-number
 Specifies the name or number of the prefix list.
seq sequence-value
(Optional) Sequence number. If the sequence number is not entered manually, an automatic sequence number is generated. These numbers are generated sequentially starting with 5 and incrementing by 5.
deny | permit
Specifies whether prefixes are permitted or denied upon a match.
network-address
Network address to be matched, entered in dotted-decimal format.
/length
Length of the subnet mask in bits.
ge ge-value
(Optional) Specifies the minimum range of prefixes to be matched.
le le-value
(Optional) Specifies the maximum range of prefixes to be matched.
As previously mentioned, you can use prefix lists with distribute lists in router configuration mode to filter routing advertisements. Configuration of IP prefix lists is straightforward; changes in prefix lists are simple to configure as well. Figure D-1 provides a step-by-step introduction to prefix list configuration using the network.
vt32xd01.gif Figure D-1 Artista Network
The following example shows how prefix lists can be used to filter incoming routing updates with the EIGRP routing protocol:
  1. Define your prefix lists; in this example, prefix list Internal is used to specify eight 192.168.0.0/24 network prefixes: 
    ip prefix-list Internal seq 5 deny 192.168.0.0/24
ip prefix-list Internal seq 10 deny 192.168.1.0/24
ip prefix-list Internal seq 15 deny 192.168.2.0/24
ip prefix-list Internal seq 20 deny 192.168.3.0/24
ip prefix-list Internal seq 25 deny 192.168.4.0/24
ip prefix-list Internal seq 30 deny 192.168.5.0/24
ip prefix-list Internal seq 35 deny 192.168.6.0/24
ip prefix-list Internal seq 40 deny 192.168.7.0/24
  2. Create a distribution list that specifies your previously configured prefix list: 
    router eigrp 100
distribute-list prefix Internal in
To verify that the prefix list worked, from another router issue a show ip route command. Example D-1 shows what the routing table looked like before the distribution list was configured.

Example D-1. Routing Table Prior to Distribution List

Impasto# show ip route eigrp
D    192.168.10.0/24 [90/409600] via 192.168.1.2, 00:00:03, Ethernet0/0
D    192.168.11.0/24 [90/409600] via 192.168.1.2, 00:00:03, Ethernet0/0
D    192.168.4.0/24 [90/409600] via 192.168.1.2, 00:00:47, Ethernet0/0
D    192.168.5.0/24 [90/409600] via 192.168.1.2, 00:00:47, Ethernet0/0
D    192.168.6.0/24 [90/409600] via 192.168.1.2, 00:00:47, Ethernet0/0
D    192.168.7.0/24 [90/409600] via 192.168.1.2, 00:00:47, Ethernet0/0
D    192.168.2.0/24 [90/409600] via 192.168.1.2, 00:00:47, Ethernet0/0
D    192.168.3.0/24 [90/409600] via 192.168.1.2, 00:00:47, Ethernet0/0
Example D-2 shows the same routing table after applying the distribution list and clearing the routing from the Impasto router.

Example D-2. Routing Table After Distribution List Application

Impasto# clear ip route *
Impasto# show ip route eigrp
D    192.168.10.0/24 [90/409600] via 192.168.1.2, 00:00:41, Ethernet0/0
D    192.168.11.0/24 [90/409600] via 192.168.1.2, 00:00:41, Ethernet0/0
Notice that the routes mentioned by the prefix list have been removed from the routing tables. Example D-3 shows the full configuration for the Impasto router used in this example.

Example D-3. Using IP Prefix Lists

interface Loopback0
 ip address 10.2.2.1 255.255.255.0
!
interface Ethernet0/0
 ip address 192.168.1.1 255.255.255.0
!
interface TokenRing0/0
 ip address 10.1.1.1 255.255.255.0
!
router eigrp 100
 network 10.0.0.0
 network 192.168.1.0
 distribute-list prefix Internal in
 no auto-summary
!
ip prefix-list Internal seq 5 deny 192.168.0.0/24
ip prefix-list Internal seq 10 deny 192.168.1.0/24
ip prefix-list Internal seq 15 deny 192.168.2.0/24
ip prefix-list Internal seq 20 deny 192.168.3.0/24
ip prefix-list Internal seq 25 deny 192.168.4.0/24
ip prefix-list Internal seq 30 deny 192.168.5.0/24
ip prefix-list Internal seq 35 deny 192.168.6.0/24
ip prefix-list Internal seq 40 deny 192.168.7.0/24
ip prefix-list Internal seq 45 permit 0.0.0.0/0 le 32
Example D-4 demonstrates how you can use the ge and le arguments to filter routes based on minimum and maximum prefix matches. For this example, you need the same two routers with the same configurations. On the Impasto, create four loopback interfaces with the addresses 11.1.1.1/24, 11.2.1.1/16, 11.30.1.1/13, and 11.200.1.1/10. The Impasto and Scumble routers will run EIGRP in autonomous system number 100; the Impasto router will advertise networks 10.0.0.0, 192.168.1.0, and 11.0.0.0; and summarization should be disabled on both routers.

Example D-4. Preparing the Impasto Router

interface Loopback0
 ip address 10.2.2.1 255.255.255.0
 no ip directed-broadcast
!
interface Loopback10
 ip address 11.1.1.1 255.255.255.0
!
interface Loopback11
 ip address 11.2.1.1 255.255.0.0
!
interface Loopback12
 ip address 11.30.1.1 255.248.0.0
!
interface Loopback13
 ip address 11.200.1.1 255.192.0.0
!
interface Ethernet0/0
 ip address 192.168.1.2 255.255.255.0
!
router eigrp 100
 network 10.0.0.0
 network 11.0.0.0
 network 192.168.1.0 0.0.0.255
 no auto
Example D-5 shows the addition of the new 11.0.0.0 networks, displaying the routing table on the Scumble router.

Example D-5. R2's Routing Table

Scumble# show ip route | include is|via
Gateway of last resort is not set
C    192.168.10.0/24 is directly connected, Loopback10
C    192.168.11.0/24 is directly connected, Loopback20
C    192.168.4.0/24 is directly connected, Loopback2
C    192.168.5.0/24 is directly connected, Loopback3
     10.0.0.0/24 is subnetted, 2 subnets
D       10.2.2.0 [90/156160] via 192.168.1.1, 00:02:02, FastEthernet0
D       10.1.1.0 [90/178688] via 192.168.1.1, 00:02:02, FastEthernet0
C    192.168.6.0/24 is directly connected, Loopback4
     11.0.0.0/8 is variably subnetted, 4 subnets, 4 masks
D       11.2.0.0/16 [90/156160] via 192.168.1.1, 00:02:02, FastEthernet0
D       11.1.1.0/24 [90/156160] via 192.168.1.1, 00:02:02, FastEthernet0
D       11.24.0.0/13 [90/156160] via 192.168.1.1, 00:02:02, FastEthernet0
D       11.192.0.0/10 [90/156160] via 192.168.1.1, 00:02:02, FastEthernet0
C    192.168.7.0/24 is directly connected, Loopback5
C    192.168.1.0/24 is directly connected, FastEthernet0
C    192.168.2.0/24 is directly connected, Loopback0
C    192.168.3.0/24 is directly connected, Loopback1
After creating the loopbacks and verifying EIGRP operation, create an IP prefix list that allows only the Impasto router to advertise the 11.1.0.0 networks with prefixes ranging from /16 to /32. Apply this prefix list to filter EIGRP routes leaving the Impasto router as shown in Example D-6.

Example D-6. Applying the IP Prefix List

ip prefix-list Trial-2 seq 5 permit 11.1.0.0/16 le 32
!
router eigrp 100
distribute-list prefix Trial-2 out
After you apply the prefix list on the Impasto router, the Scumble router's routing table will contain only the route to the 11.1.1.0/24 network. The other 11.0.0.0 networks with masks that range from 16 to 32 bits have been removed, and network 10.2.2.0/24 has also been removed, as shown in Example D-7.

Example D-7. Scumble Router's Routing Table After IP Prefix List

Scumble# show ip route | include is|via
Gateway of last resort is not set
C    192.168.10.0/24 is directly connected, Loopback10
C    192.168.11.0/24 is directly connected, Loopback20
C    192.168.4.0/24 is directly connected, Loopback2
C    192.168.5.0/24 is directly connected, Loopback3
C    192.168.6.0/24 is directly connected, Loopback4
     11.0.0.0/24 is subnetted, 1 subnets
D       11.1.1.0 [90/156160] via 192.168.1.1, 00:02:30, FastEthernet0
C    192.168.7.0/24 is directly connected, Loopback5
C    192.168.1.0/24 is directly connected, FastEthernet0
C    192.168.2.0/24 is directly connected, Loopback0
C    192.168.3.0/24 is directly connected, Loopback1
Now, remove the 11.1.1.1/24 interface and add loopback interfaces 11.1.1.0/29, 11.1.1.32/29, and 11.1.1.64/29 to the configuration on the Impasto router; check the routing table on the Scumble router again. It should look like Example D-8.

Example D-8. Experimenting with an IP Prefix List

Impasto(config)# interface loopback 11
Impasto(config-if)# ip address 11.1.1.1 255.255.255.248
Impasto(config-if)# interface loopback 14
Impasto(config-if)# ip address 11.1.1.33 255.255.255.248
Impasto(config-if)# interface loopback 15
Impasto(config-if)# ip address 11.1.1.65 255.255.255.248

Impasto# show ip route | include is|via
Gateway of last resort is not set
D    192.168.10.0/24 [90/409600] via 192.168.1.2, 00:06:53, Ethernet0/0
D    192.168.11.0/24 [90/409600] via 192.168.1.2, 00:06:53, Ethernet0/0
     10.0.0.0/24 is subnetted, 2 subnets
C       10.2.2.0 is directly connected, Loopback0
C       10.1.1.0 is directly connected, TokenRing0/0
     11.0.0.0/8 is variably subnetted, 6 subnets, 4 masks
C       11.2.0.0/16 is directly connected, Loopback11
C       11.1.1.0/29 is directly connected, Loopback10
C       11.24.0.0/13 is directly connected, Loopback12
C       11.1.1.32/29 is directly connected, Loopback14
C       11.1.1.64/29 is directly connected, Loopback15
C       11.192.0.0/10 is directly connected, Loopback13
C    192.168.1.0/24 is directly connected, Ethernet0/0
For the next part of this experiment, remove the outgoing Trial-2 prefix from EIGRP 100 and change the prefix list to any 11.1.0.0/16 network prefixes greater than 25 bits in length. (This will include the loopback interfaces that were just created in the preceding step but permit everything else.) After you have edited the prefix list, reapply it, as shown in Example D-9.

Example D-9. Experimentation Continued

router eigrp 100
 no distribute-list prefix- Trial-2 out
 
ip prefix-list Trial-2 seq 5 deny 11.1.0.0/16 ge 25
ip prefix-list Trial-2 seq 10 permit 0.0.0.0/0 le 32


router eigrp 100
distribute-list prefix- Trial-2 out
After you have applied the changes, the Scumble router's routing table should show the reappearance of the 10.0.0.0 networks and the 11.0.0.0 networks with masks greater than 16. The loopbacks created in the preceding step should have been removed, as shown in Example D-10.

Example D-10. Scumble Router's Routing Table After Changing Prefix List Trial-2

Scumble# clear ip route *
Scumble# show ip route | include is|via
Gateway of last resort is not set
C    192.168.10.0/24 is directly connected, Loopback10
C    192.168.11.0/24 is directly connected, Loopback20
C    192.168.4.0/24 is directly connected, Loopback2
C    192.168.5.0/24 is directly connected, Loopback3
     10.0.0.0/24 is subnetted, 2 subnets
D       10.2.2.0 [90/156160] via 192.168.1.1, 00:00:16, FastEthernet0
D       10.1.1.0 [90/178688] via 192.168.1.1, 00:00:16, FastEthernet0
C    192.168.6.0/24 is directly connected, Loopback4
     11.0.0.0/8 is variably subnetted, 3 subnets, 3 masks
D       11.2.0.0/16 [90/156160] via 192.168.1.1, 00:00:16, FastEthernet0
D       11.24.0.0/13 [90/156160] via 192.168.1.1, 00:00:16, FastEthernet0
D       11.192.0.0/10 [90/156160] via 192.168.1.1, 00:00:16, FastEthernet0
C    192.168.7.0/24 is directly connected, Loopback5
C    192.168.1.0/24 is directly connected, FastEthernet0
C    192.168.2.0/24 is directly connected, Loopback0
C    192.168.3.0/24 is directly connected, Loopback1
Example D-11 shows the completed configuration for the Impasto router.

Example D-11. Complete Configuration for the Impasto Router

interface Loopback0
 ip address 10.2.2.1 255.255.255.0
!
interface Loopback10
 ip address 11.1.1.1 255.255.255.248
!
interface Loopback11
 ip address 11.2.1.1 255.255.0.0
!
interface Loopback12
 ip address 11.30.1.1 255.248.0.0
!
interface Loopback13
 ip address 11.200.1.1 255.192.0.0
!
interface Loopback14
 ip address 11.1.1.33 255.255.255.248
!
interface Loopback15
 ip address 11.1.1.65 255.255.255.248
!
interface Ethernet0/0
 ip address 192.168.1.1 255.255.255.0
!
interface TokenRing0/0
 ip address 10.1.1.1 255.255.255.0
!
router eigrp 100
 network 10.0.0.0
 network 11.0.0.0
 network 192.168.1.0
 neighbor 192.168.1.2
 distribute-list prefix Trial-2 out
 distribute-list prefix Internal in
 no auto-summary
!
ip prefix-list Internal seq 5 deny 192.168.0.0/24
ip prefix-list Internal seq 10 deny 192.168.1.0/24
ip prefix-list Internal seq 15 deny 192.168.2.0/24
ip prefix-list Internal seq 20 deny 192.168.3.0/24
ip prefix-list Internal seq 25 deny 192.168.4.0/24
ip prefix-list Internal seq 30 deny 192.168.5.0/24
ip prefix-list Internal seq 35 deny 192.168.6.0/24
ip prefix-list Internal seq 40 deny 192.168.7.0/24
ip prefix-list Internal seq 45 permit 0.0.0.0/0 le 32
!
ip prefix-list Trial-2 seq 5 deny 11.1.0.0/16 ge 25
ip prefix-list Trial-2 seq 10 permit 0.0.0.0/0 le 32

With a little practice, you might use the simpler prefix lists in place of access lists for all routing protocols, not just for BGP.
Posted by at No comments:
Labels: ,

ip prefix-list

I had to look at prefix-lists again a bit more in detail and how matching is done.
There are several key words that need to be understood for mathing the right addresses.
At first the most simple match is the:
ip prefix-list PRE_20 permit 20.0.0.0/24
which does just match for the first 24 bit in the address and nothing else.
If in case you have to match more addresses, maybe a range from subnets with a specific prefix, you can match it with “ge” or “le”.
“ge” means greater or equal
“le” means less or equal
So if you want to match the following subnets:
20.0.0.0/16
20.1.0.0/16
You could create an prefix list with the following match:
ip prefix-list PRE_20 permit 20.0.0.0/15 ge 16 le 16
This means, that first the matching is done one the subnet that is the same for all subnets: 20.0.0.0/15, that can include 20.0.0.0 and 20.1.0.0.
Here we already summarized the best match for both addresses. So this part is the same for all addresses. Then, since we don’t want to match the 20.0.0.0/15 or the 20.1.0.0/15, we have to tell the prefix list, how to extend the variable match for addresse, that should be included in the match.
Se we want specially matches greater or equal /16 and maximal /16.
That means:
ip prefix-list PRE_20 permit 20.0.0.0/15 ge 16 le 16
If we want to include for example only:
20.0.0.0/24
20.0.1.0/24
20.0.2.0/24
20.0.3.0/24
ip prefix-list PRE_22 permit 20.0.0.0/22 ge 24 le 24
Another example would be to match a range of subnets with “le”
ip prefix-list 20.0.0.0/16 le 18
Would match:
20.0.0.0/16
20.0.0.0/17
20.0.0.0/18
Where the 20.0. prefix must be in all network ranges at a minimum and every address with a maximum of /18 would match if 20.0. is in the prefix.
Posted by at No comments:
Labels: ,

Using a Prefix List

Using a Prefix List

The following example creates a prefix list that permits routes with a prefix length up to 24 in the 151.0.0.0/8 network:

host1(config)#ip prefix-list abc permit 151.0.0.0/8 le 24
clear ip prefix-list
  • Use to clear all hit counts in the prefix lists or the specified entry from the specified prefix list. (The router increments the hit count by 1 each time an entry matches.)
  • Example
    host1#clear ip prefix-list abc


  • There is no no version.

  • See clear ip prefix-list.

clear ipv6 prefix-list
  • Use to clear all hit counts in the IPv6 prefix lists or the specified entry from the specified prefix list. (The router increments the hit count by 1 each time an entry matches.)
  • Example
    host1#clear ipv6 prefix-list abc


  • There is no no version.

  • See clear ipv6 prefix-list.

ip prefix-list
ipv6 prefix-list
  • Use to create a prefix list for route filtering and to specify a list entry—a deny or permit clause for a network address—to the prefix list. Use to add entries to prefix lists.
  • The prefix list name can be up to 32 characters long.
  • Specify the position of each entry in the list with the seq (sequence) keyword. If you do not specify a sequence number, the router uses the value of the last sequence number plus 5.
  • Use the ge and le keywords to specify a range of network prefixes. These keywords have the following values:
    • prefix length < ge <= 32
    • prefix length < le <= ge
  • If you do not specify either the ge or le keyword, an exact match is expected.
  • Example 1—IPv4; exact match required; the router permits only a route with a prefix length of 8 and a network address of 151.0.0.0.
    host1(config)#ip prefix-list abc permit 151.0.0.0/8


  • Example 2—IPv6; exact match required; the router permits only a route with a prefix length of 8 and a network address of 1:0:0:0:0:0:0:5.
    host1(config)#ipv6 prefix-list abc permit 1::5/8

  • Use the no version to remove the specified prefix list or the specified list entry.

  • See ip prefix-list.

  • See ipv6 prefix-list.

match ip address
  • Use to specify an access list or use with the prefix-list or prefix-tree keyword to match routes that have a destination network number address that is permitted by any specified access list, prefix list, or prefix tree.
  • Example
    host1(config-route-map)#match ip address prefix-list abc


  • Use the no version to delete the match clause from a route map or a specified value from the match clause.

  • See match ip address.

match ipv6 address
  • Use to match any route that has a destination network number address that is permitted by the specified access list or prefix list.
  • Example
    host1(config-route-map)#match ipv6 address prefix-list boston


  • Use the no version to delete all address match clauses from a route map unless you specify an access list or prefix list, in which case only the list match is removed from the route map.

  • See match ipv6 address.

match ip next-hop
  • Use with the prefix-list keyword to match routes that have a next-hop router address passed by the specified access lists, prefix lists, or prefix trees.
  • Example
    host1(config-route-map)#match ip next-hop prefix-list abc


  • Use the no version to delete the match clause from a route map or a specified value from the match clause.

  • See match ip next-hop.

match ipv6 next-hop
  • Use to match any routes that have a next-hop router address passed by the specified access list or prefix list.
  • Example
    host1(config-route-map)#match ipv6 next-hop prefix-list next1


  • Use the no version to delete all next-hop match clauses from a route map unless you specify an access list or prefix list, in which case the router removes only the list match from the route map.

  • See match ipv6 next-hop.

Posted by at No comments:
Labels: ,
Subscribe to: Posts (Atom)