ip prefix-list

ip prefix-list provides the most powerful prefix based filtering mechanism

Here is a quick little tutorial on Prefix-lists for you.

A normal access-list CANNOT check the subnet mask of a network. It can only check bits to make sure they match, nothing more. A prefix-list has an advantage over an access-list in that it CAN check BOTH bits and subnet mask - both would have to match for the network to be either permitted or denied.

For checking bits a prefix list ALWAYS goes from left to right and CANNOT skip any bits. A basic example would be this:

172.16.8.0/24

If there is only a / after the network (no le or ge) then the number after the / is BOTH bits checked and subnet mask. So in this case it will check the 24 bits from left to right (won't care about the last 8
bits) AND it will make sure that it has a 24 bit mask. BOTH the 24 bits checked and the 24 bit subnet mask must match for the network to be permitted or denied.

No we can do a range of subnet masks also that could be permitted or
denyed:

172.16.8.0/24 ge 25

If we use either the le or ge (or both le and ge) after the /, then the number directly after the / becomes ONLY bits checked and the number after the ge or le (or both) is the subnet mask. So in this case we are still going to check the first 24 bits of the network from left to right. If those match we are then going to check the subnet mask, which in this case can be GREATER THAN OR EQUAL TO 25 bits - meaning that as long as the first 24 bits of the network match the subnet mask could be 25,26,27,28,29,30,31,or 32 bits. They would all match.

We can also do:

172.16.8.0/24 le 28

Again this will check the first 24 bits of the network to make sure that they match. Then it will check to make sure that the subnet mask is LESS THAN OR EQUAL TO 28 bits. Now this isn't going to be 28 bits down to 0 bits, the subnet mask can't be any lower than the bits we are checking. So the valid range of subnet masks for this one would be 28 bits down to 24 bits (24,25,26,27,and 28). All of those would match.

We can also do both ge and le:

172.16.8.0/24 ge 25 le 27

Here again we are checking the first 24 bits to make sure they match.
Then our subnet mask must be GREATER THAN OR EQUAL TO 25 bits LESS THAN OR EQUAL TO 27 bits. Meaning that 25,26,and 27 bit subnet masks would match.

Now for a couple of examples:

If we have the following networks:

172.16.8.0/28
172.16.8.16/28
172.16.8.32/28
172.16.8.48/28
172.16.8.64/28

We could permit all of these networks with on prefix-list statement:

172.16.8.0/24 ge 28 le 28

This will check the first 24 bits to make sure they match. All of these networks have 172.16.8 as the first 24 bits, and it won't care what is in the last 8 bits. Then it will check to make sure that the subnet mask is GREATER THAN OR EQUAL TO 28 bits LESS THAN OR EQUAL TO 28 bits - the only number that works for this is 28 bits. So the first 24 bits in the network must match and it has to have a 28 bit subnet mask. All 5 of our networks would match for this.

We could be even more precise with this and use:

172.16.8.0/25 ge 28 le 28

If we take a look at our 4th octects we will see that for all of them the 128 bit is off so we can check that bit also (25 bits total we are checking).

0 -- 0 0 0 0 0 0 0 0
16 - 0 0 0 1 0 0 0 0
32 - 0 0 1 0 0 0 0 0
48 - 0 0 1 1 0 0 0 0
64 - 0 1 0 0 0 0 0 0

This would be closer to permitting the 5 networks that we have.

We could also permit only the classful networks. The first thing that we need to do is figure out exactly what a classful network is.

For a class A network we know that it has to have an 8 bit mask and must be between 0 and 127 in the first octect. If we break down 0 and 127 we
get:

0 --- 0 0 0 0 0 0 0 0
127 - 0 1 1 1 1 1 1 1

For the first octect of a class A network the first bit has to be a 0, it must be off. So we can do a prefix-list like this:

0.0.0.0/1 ge 8 le 8

In our first octet the first bit is a 0 (which is what it would need to be to be class A), with the /1 we have we are ONLY checking the first bit to make sure it's a 0 (meaning it would be a class A network 0 - 127). We are then making sure that this class A network actually has a class A subnet mask of 8 bits, and only 8 bits would match.

For the class B's we need to make sure that they have a 16 bit subnet mask and that they are in the range of 128 - 191 in the first octet. If we break down 128 and 191 we get:

128 - 1 0 0 0 0 0 0 0
191 - 1 0 1 1 1 1 1 1

The first two bits are what we are going to care about. We need to make sure that the first two bits in the first octet are 1 0 . The first number that we can use as our standard we are checking against is 128 -
128 has a 1 0 as the first two bits in its first octet.

128.0.0.0/2 ge 16 le 16

So we are checking the first two bits to make sure the network has a 1 0, meaning that it must be in the range of 128 - 191. We are then going to check to make sure that it has the classful 16 bit mask, and ONLY a
16 bit mask.

Finally we have the class C networks. Class C networks are in the range of 192 - 223 and they must have a 24 bit mask. If we break down 192 and
223 we get:

192 - 1 1 0 0 0 0 0 0
223 - 1 1 0 1 1 1 1 1

The first 3 bits in the first octet are what we care about. 192 would be the first number we can put in that first octect that will have 1 1 0 as its first 3 bits.

192.0.0.0/3 ge 24 le 24

We are going to check the first 3 bits of the octet and make sure that its 1 1 0 meaning that it has to be in the range of 192 - 223 being class C, then we are going to check to make sure it has a class C classful subnet of 24 bits.

Finally how to permit or deny any could be very helpful since a Prefix-list just like an Access-list has an implicit deny at the end:

0.0.0.0/0 le 32

This is 'any' for a prefix-list. It says check 0 bits; I don't care what any of the bits are. It also says that the subnet mask can be 32 bits or less (down to the number of bits we are checking) down to 0. So we aren't going to check any bits and the network can have a subnet mask of anything between 0 and 32 bits. This would be 'any'.

Now for your Prefix-list:

In the 3rd Octet we have 1, 4, and 5. We'll break these down to binary to see if we can summarize these into one line:

1 - 0 0 0 0 0 0 0 1
4 - 0 0 0 0 0 1 0 0
5 - 0 0 0 0 0 1 0 1

For a Prefix-list we need to go from the left to the right and we can't skip bits. So for these three networks we would need to stop at the 8 bit since it is the last bit from left to right that is the same. This would give us 3 bits that are different, or 8 possible networks. We only have 3 of the 8 possible networks and we should not permit or deny more than we actually have. We should be as specific as possible.

If we leave the 91.86.1.0/24 alone by itself it will give us a Prefix-list of:

91.86.1.0/24

This will check the first 24 bits from left to right to make sure that they match, and it will also check to make sure that it has a 24-bit subnet mask.

For the 4 and 5 networks we can permit or deny both of those with one line. If we take a look at 4 and 5 again we can see that all of the bit's match down to the 2 bit. This would leave 1 bit that doesn't match, which would give us 2 possible networks, both of which we have.
The Prefix-list to permit or deny both 4 and 5 would be:

91.86.4.0/23 ge 24 le 24

This will check the first 23 bits from left to right. The 24th bit could either be off, which would give us 4, or it could be on which would give us 5. Since we have the ge and le involved the /23 is only bits checked. The ge and le specify that our subnet mask must be greater than or equal to 24-bits and less than or equal to 24-bits which means that the subnet mask must be 24-bits for both possible networks.

thanks
ccienotes - http://ccienotes.blogspot.com/2007/08/ip-prefix-list.html

IP Prefix Lists

Appendix D. IP Prefix Lists

Prefix lists became available in Cisco IOS Software Release 12.0(3)T. You can use prefix lists as a simpler alternative to standard IP access lists for routing advertisement filtering with routing protocols. Although prefix lists are most commonly put to use in Border Gateway Protocol (BGP) configurations, this appendix demonstrates other ways that you can use prefix lists to support other routing protocols such as Enhanced Interior Gateway Routing Protocol (EIGRP). Prefix lists introduce a more streamlined way to create filters for network prefix advertisements by following these rules:

• Like access lists, prefix lists are processed sequentially from top to bottom. When a match is made, processing stops and the rest of the entries are not read.
• Entries can be added to the prefix lists at any time.
• An empty prefix lists permits all prefixes by default.
• Prefix lists do not use wildcard masks like access lists; they use a subnet length mask (for instance, /24).
• Unlike access lists, lines in prefix lists can be edited by the use of the sequence number.
• Prefix lists contain an implicit deny any at the end of each list.
• Sequence numbers are automatically generated; however, automatic sequence generation can be stopped.

Prefix lists are configured from global configuration mode using the following command:

ip prefix-list
list-name | list-number [sequence
sequence-value] deny | permit
network-address/length [ge
ge-value] [le
le-value]

Table D-1 shows the meaning for the prefix list syntax.

Table D-1. IP Prefix List Syntax

Command/Argument	Description
list-name | list-number	Specifies the name or number of the prefix list.
seq sequence-value	(Optional) Sequence number. If the sequence number is not entered manually, an automatic sequence number is generated. These numbers are generated sequentially starting with 5 and incrementing by 5.
deny | permit	Specifies whether prefixes are permitted or denied upon a match.
network-address	Network address to be matched, entered in dotted-decimal format.
/length	Length of the subnet mask in bits.
ge ge-value	(Optional) Specifies the minimum range of prefixes to be matched.
le le-value	(Optional) Specifies the maximum range of prefixes to be matched.

As previously mentioned, you can use prefix lists with distribute lists in router configuration mode to filter routing advertisements. Configuration of IP prefix lists is straightforward; changes in prefix lists are simple to configure as well. Figure D-1 provides a step-by-step introduction to prefix list configuration using the network.

Figure D-1 Artista Network

The following example shows how prefix lists can be used to filter incoming routing updates with the EIGRP routing protocol:

1. Define your prefix lists; in this example, prefix list Internal is used to specify eight 192.168.0.0/24 network prefixes:

   ip prefix-list Internal seq 5 deny 192.168.0.0/24
   ip prefix-list Internal seq 10 deny 192.168.1.0/24
   ip prefix-list Internal seq 15 deny 192.168.2.0/24
   ip prefix-list Internal seq 20 deny 192.168.3.0/24
   ip prefix-list Internal seq 25 deny 192.168.4.0/24
   ip prefix-list Internal seq 30 deny 192.168.5.0/24
   ip prefix-list Internal seq 35 deny 192.168.6.0/24
   ip prefix-list Internal seq 40 deny 192.168.7.0/24

2. Create a distribution list that specifies your previously configured prefix list:

   router eigrp 100
   distribute-list prefix Internal in

To verify that the prefix list worked, from another router issue a show ip route command. Example D-1 shows what the routing table looked like before the distribution list was configured.

Example D-1. Routing Table Prior to Distribution List

Impasto# show ip route eigrp
D    192.168.10.0/24 [90/409600] via 192.168.1.2, 00:00:03, Ethernet0/0
D    192.168.11.0/24 [90/409600] via 192.168.1.2, 00:00:03, Ethernet0/0
D    192.168.4.0/24 [90/409600] via 192.168.1.2, 00:00:47, Ethernet0/0
D    192.168.5.0/24 [90/409600] via 192.168.1.2, 00:00:47, Ethernet0/0
D    192.168.6.0/24 [90/409600] via 192.168.1.2, 00:00:47, Ethernet0/0
D    192.168.7.0/24 [90/409600] via 192.168.1.2, 00:00:47, Ethernet0/0
D    192.168.2.0/24 [90/409600] via 192.168.1.2, 00:00:47, Ethernet0/0
D    192.168.3.0/24 [90/409600] via 192.168.1.2, 00:00:47, Ethernet0/0

Example D-2 shows the same routing table after applying the distribution list and clearing the routing from the Impasto router.

Example D-2. Routing Table After Distribution List Application

Impasto# clear ip route *
Impasto# show ip route eigrp
D    192.168.10.0/24 [90/409600] via 192.168.1.2, 00:00:41, Ethernet0/0
D    192.168.11.0/24 [90/409600] via 192.168.1.2, 00:00:41, Ethernet0/0

Notice that the routes mentioned by the prefix list have been removed from the routing tables. Example D-3 shows the full configuration for the Impasto router used in this example.

Example D-3. Using IP Prefix Lists

interface Loopback0
 ip address 10.2.2.1 255.255.255.0
!
interface Ethernet0/0
 ip address 192.168.1.1 255.255.255.0
!
interface TokenRing0/0
 ip address 10.1.1.1 255.255.255.0
!
router eigrp 100
 network 10.0.0.0
 network 192.168.1.0
 distribute-list prefix Internal in
 no auto-summary
!
ip prefix-list Internal seq 5 deny 192.168.0.0/24
ip prefix-list Internal seq 10 deny 192.168.1.0/24
ip prefix-list Internal seq 15 deny 192.168.2.0/24
ip prefix-list Internal seq 20 deny 192.168.3.0/24
ip prefix-list Internal seq 25 deny 192.168.4.0/24
ip prefix-list Internal seq 30 deny 192.168.5.0/24
ip prefix-list Internal seq 35 deny 192.168.6.0/24
ip prefix-list Internal seq 40 deny 192.168.7.0/24
ip prefix-list Internal seq 45 permit 0.0.0.0/0 le 32

Example D-4 demonstrates how you can use the ge and le arguments to filter routes based on minimum and maximum prefix matches. For this example, you need the same two routers with the same configurations. On the Impasto, create four loopback interfaces with the addresses 11.1.1.1/24, 11.2.1.1/16, 11.30.1.1/13, and 11.200.1.1/10. The Impasto and Scumble routers will run EIGRP in autonomous system number 100; the Impasto router will advertise networks 10.0.0.0, 192.168.1.0, and 11.0.0.0; and summarization should be disabled on both routers.

Example D-4. Preparing the Impasto Router

interface Loopback0
 ip address 10.2.2.1 255.255.255.0
 no ip directed-broadcast
!
interface Loopback10
 ip address 11.1.1.1 255.255.255.0
!
interface Loopback11
 ip address 11.2.1.1 255.255.0.0
!
interface Loopback12
 ip address 11.30.1.1 255.248.0.0
!
interface Loopback13
 ip address 11.200.1.1 255.192.0.0
!
interface Ethernet0/0
 ip address 192.168.1.2 255.255.255.0
!
router eigrp 100
 network 10.0.0.0
 network 11.0.0.0
 network 192.168.1.0 0.0.0.255
 no auto

Example D-5 shows the addition of the new 11.0.0.0 networks, displaying the routing table on the Scumble router.

Example D-5. R2's Routing Table

Scumble# show ip route | include is|via
Gateway of last resort is not set
C    192.168.10.0/24 is directly connected, Loopback10
C    192.168.11.0/24 is directly connected, Loopback20
C    192.168.4.0/24 is directly connected, Loopback2
C    192.168.5.0/24 is directly connected, Loopback3
     10.0.0.0/24 is subnetted, 2 subnets
D       10.2.2.0 [90/156160] via 192.168.1.1, 00:02:02, FastEthernet0
D       10.1.1.0 [90/178688] via 192.168.1.1, 00:02:02, FastEthernet0
C    192.168.6.0/24 is directly connected, Loopback4
     11.0.0.0/8 is variably subnetted, 4 subnets, 4 masks
D       11.2.0.0/16 [90/156160] via 192.168.1.1, 00:02:02, FastEthernet0
D       11.1.1.0/24 [90/156160] via 192.168.1.1, 00:02:02, FastEthernet0
D       11.24.0.0/13 [90/156160] via 192.168.1.1, 00:02:02, FastEthernet0
D       11.192.0.0/10 [90/156160] via 192.168.1.1, 00:02:02, FastEthernet0
C    192.168.7.0/24 is directly connected, Loopback5
C    192.168.1.0/24 is directly connected, FastEthernet0
C    192.168.2.0/24 is directly connected, Loopback0
C    192.168.3.0/24 is directly connected, Loopback1

After creating the loopbacks and verifying EIGRP operation, create an IP prefix list that allows only the Impasto router to advertise the 11.1.0.0 networks with prefixes ranging from /16 to /32. Apply this prefix list to filter EIGRP routes leaving the Impasto router as shown in Example D-6.

Example D-6. Applying the IP Prefix List

ip prefix-list Trial-2 seq 5 permit 11.1.0.0/16 le 32
!
router eigrp 100
distribute-list prefix Trial-2 out

After you apply the prefix list on the Impasto router, the Scumble router's routing table will contain only the route to the 11.1.1.0/24 network. The other 11.0.0.0 networks with masks that range from 16 to 32 bits have been removed, and network 10.2.2.0/24 has also been removed, as shown in Example D-7.

Example D-7. Scumble Router's Routing Table After IP Prefix List

Scumble# show ip route | include is|via
Gateway of last resort is not set
C    192.168.10.0/24 is directly connected, Loopback10
C    192.168.11.0/24 is directly connected, Loopback20
C    192.168.4.0/24 is directly connected, Loopback2
C    192.168.5.0/24 is directly connected, Loopback3
C    192.168.6.0/24 is directly connected, Loopback4
     11.0.0.0/24 is subnetted, 1 subnets
D       11.1.1.0 [90/156160] via 192.168.1.1, 00:02:30, FastEthernet0
C    192.168.7.0/24 is directly connected, Loopback5
C    192.168.1.0/24 is directly connected, FastEthernet0
C    192.168.2.0/24 is directly connected, Loopback0
C    192.168.3.0/24 is directly connected, Loopback1

Now, remove the 11.1.1.1/24 interface and add loopback interfaces 11.1.1.0/29, 11.1.1.32/29, and 11.1.1.64/29 to the configuration on the Impasto router; check the routing table on the Scumble router again. It should look like Example D-8.

Example D-8. Experimenting with an IP Prefix List

Impasto(config)# interface loopback 11
Impasto(config-if)# ip address 11.1.1.1 255.255.255.248
Impasto(config-if)# interface loopback 14
Impasto(config-if)# ip address 11.1.1.33 255.255.255.248
Impasto(config-if)# interface loopback 15
Impasto(config-if)# ip address 11.1.1.65 255.255.255.248

Impasto# show ip route | include is|via
Gateway of last resort is not set
D    192.168.10.0/24 [90/409600] via 192.168.1.2, 00:06:53, Ethernet0/0
D    192.168.11.0/24 [90/409600] via 192.168.1.2, 00:06:53, Ethernet0/0
     10.0.0.0/24 is subnetted, 2 subnets
C       10.2.2.0 is directly connected, Loopback0
C       10.1.1.0 is directly connected, TokenRing0/0
     11.0.0.0/8 is variably subnetted, 6 subnets, 4 masks
C       11.2.0.0/16 is directly connected, Loopback11
C       11.1.1.0/29 is directly connected, Loopback10
C       11.24.0.0/13 is directly connected, Loopback12
C       11.1.1.32/29 is directly connected, Loopback14
C       11.1.1.64/29 is directly connected, Loopback15
C       11.192.0.0/10 is directly connected, Loopback13
C    192.168.1.0/24 is directly connected, Ethernet0/0

For the next part of this experiment, remove the outgoing Trial-2 prefix from EIGRP 100 and change the prefix list to any 11.1.0.0/16 network prefixes greater than 25 bits in length. (This will include the loopback interfaces that were just created in the preceding step but permit everything else.) After you have edited the prefix list, reapply it, as shown in Example D-9.

Example D-9. Experimentation Continued

router eigrp 100
 no distribute-list prefix- Trial-2 out
 
ip prefix-list Trial-2 seq 5 deny 11.1.0.0/16 ge 25
ip prefix-list Trial-2 seq 10 permit 0.0.0.0/0 le 32


router eigrp 100
distribute-list prefix- Trial-2 out

After you have applied the changes, the Scumble router's routing table should show the reappearance of the 10.0.0.0 networks and the 11.0.0.0 networks with masks greater than 16. The loopbacks created in the preceding step should have been removed, as shown in Example D-10.

Example D-10. Scumble Router's Routing Table After Changing Prefix List Trial-2

Scumble# clear ip route *
Scumble# show ip route | include is|via
Gateway of last resort is not set
C    192.168.10.0/24 is directly connected, Loopback10
C    192.168.11.0/24 is directly connected, Loopback20
C    192.168.4.0/24 is directly connected, Loopback2
C    192.168.5.0/24 is directly connected, Loopback3
     10.0.0.0/24 is subnetted, 2 subnets
D       10.2.2.0 [90/156160] via 192.168.1.1, 00:00:16, FastEthernet0
D       10.1.1.0 [90/178688] via 192.168.1.1, 00:00:16, FastEthernet0
C    192.168.6.0/24 is directly connected, Loopback4
     11.0.0.0/8 is variably subnetted, 3 subnets, 3 masks
D       11.2.0.0/16 [90/156160] via 192.168.1.1, 00:00:16, FastEthernet0
D       11.24.0.0/13 [90/156160] via 192.168.1.1, 00:00:16, FastEthernet0
D       11.192.0.0/10 [90/156160] via 192.168.1.1, 00:00:16, FastEthernet0
C    192.168.7.0/24 is directly connected, Loopback5
C    192.168.1.0/24 is directly connected, FastEthernet0
C    192.168.2.0/24 is directly connected, Loopback0
C    192.168.3.0/24 is directly connected, Loopback1

Example D-11 shows the completed configuration for the Impasto router.

Example D-11. Complete Configuration for the Impasto Router

interface Loopback0
 ip address 10.2.2.1 255.255.255.0
!
interface Loopback10
 ip address 11.1.1.1 255.255.255.248
!
interface Loopback11
 ip address 11.2.1.1 255.255.0.0
!
interface Loopback12
 ip address 11.30.1.1 255.248.0.0
!
interface Loopback13
 ip address 11.200.1.1 255.192.0.0
!
interface Loopback14
 ip address 11.1.1.33 255.255.255.248
!
interface Loopback15
 ip address 11.1.1.65 255.255.255.248
!
interface Ethernet0/0
 ip address 192.168.1.1 255.255.255.0
!
interface TokenRing0/0
 ip address 10.1.1.1 255.255.255.0
!
router eigrp 100
 network 10.0.0.0
 network 11.0.0.0
 network 192.168.1.0
 neighbor 192.168.1.2
 distribute-list prefix Trial-2 out
 distribute-list prefix Internal in
 no auto-summary
!
ip prefix-list Internal seq 5 deny 192.168.0.0/24
ip prefix-list Internal seq 10 deny 192.168.1.0/24
ip prefix-list Internal seq 15 deny 192.168.2.0/24
ip prefix-list Internal seq 20 deny 192.168.3.0/24
ip prefix-list Internal seq 25 deny 192.168.4.0/24
ip prefix-list Internal seq 30 deny 192.168.5.0/24
ip prefix-list Internal seq 35 deny 192.168.6.0/24
ip prefix-list Internal seq 40 deny 192.168.7.0/24
ip prefix-list Internal seq 45 permit 0.0.0.0/0 le 32
!
ip prefix-list Trial-2 seq 5 deny 11.1.0.0/16 ge 25
ip prefix-list Trial-2 seq 10 permit 0.0.0.0/0 le 32

With a little practice, you might use the simpler prefix lists in place of access lists for all routing protocols, not just for BGP.

ip prefix-list

I had to look at prefix-lists again a bit more in detail and how matching is done.
There are several key words that need to be understood for mathing the right addresses.
At first the most simple match is the:
ip prefix-list PRE_20 permit 20.0.0.0/24
which does just match for the first 24 bit in the address and nothing else.
If in case you have to match more addresses, maybe a range from subnets with a specific prefix, you can match it with “ge” or “le”.
“ge” means greater or equal
“le” means less or equal
So if you want to match the following subnets:
20.0.0.0/16
20.1.0.0/16
You could create an prefix list with the following match:
ip prefix-list PRE_20 permit 20.0.0.0/15 ge 16 le 16
This means, that first the matching is done one the subnet that is the same for all subnets: 20.0.0.0/15, that can include 20.0.0.0 and 20.1.0.0.
Here we already summarized the best match for both addresses. So this part is the same for all addresses. Then, since we don’t want to match the 20.0.0.0/15 or the 20.1.0.0/15, we have to tell the prefix list, how to extend the variable match for addresse, that should be included in the match.
Se we want specially matches greater or equal /16 and maximal /16.
That means:
ip prefix-list PRE_20 permit 20.0.0.0/15 ge 16 le 16
If we want to include for example only:
20.0.0.0/24
20.0.1.0/24
20.0.2.0/24
20.0.3.0/24
ip prefix-list PRE_22 permit 20.0.0.0/22 ge 24 le 24
Another example would be to match a range of subnets with “le”
ip prefix-list 20.0.0.0/16 le 18
Would match:
20.0.0.0/16
20.0.0.0/17
20.0.0.0/18
Where the 20.0. prefix must be in all network ranges at a minimum and every address with a maximum of /18 would match if 20.0. is in the prefix.

Using Regular Expressions

AS-path Lists

You can use regular expressions when you define AS-path access lists and community lists to more easily filter routes. A regular expression uses special characters—often referred to as metacharacters—to define a pattern that is compared with an input string.

For an AS-path access list, the input string is the AS path of the routes to which the list is applied with the route-map or neighbor filter-list commands. If the AS path matches the regular expression in the access list, the route matches the access list.

Example

The following commands apply access list 1 to routes inbound from BGP peer 10.5.5.2. Access list 1 uses a regular expression to deny routes that originate in autonomous system 32.

host1(config-router)#neighbor 10.5.5.2 remote-as 32

host1(config-router)#neighbor 10.5.5.2 filter-list 1 in

host1(config-router)#exit

host1(config)#ip as-path access-list 1 deny 32$

 

Community Lists

For a community list, the input string is the community attribute of the routes to which the list is applied using a route-map command. If the community attribute matches the regular expression in the community list, the route matches the community list.

Example

The following commands apply route map 5 to routes forwarded to BGP peer 10.5.5.4. Route map 5 uses a regular expression to match community numbers ending with 305, setting the weight of matching routes to 150.

host1(config-router)#neighbor 10.5.5.4 remote-as 425

host1(config-router)#neighbor 10.5.5.4 route-map 5 out

host1(config-router)#exit

host1(config)#route-map 5 permit 10

host1(config-route-map)#match community 305$

host1(config-route-map)#set weight 150

 

 

Community Numbers

When you use a regular expression to match a community number, use the appropriate format for the community number in the community list. If you issue the ip bgp-community new-format command, the community number has the format AA:NN where AA is a number that identifies the autonomous system, and NN is a number that identifies the community within the autonomous system. Otherwise, the community number is an integer in the range 1–4294967295.

Metacharacters

Each regular expression consists of one or more metacharacters and zero or more complete or partial AS or community numbers. Table 6 describes the metacharacters supported for regular expression pattern-matching.

Table 6: Supported Regular Expression Metacharacters

Metacharacter	Description
^	Matches the beginning of the input string. Alternatively, when used as the first character within brackets—[^ ]—matches any number except the ones specified within the brackets.
$	Matches the end of the input string.
.	Matches any single character, including white space.
*	Matches zero or more sequences of the immediately previous character or pattern.
+	Matches one or more sequences of the immediately previous character or pattern.
?	Matches zero or one sequence of the immediately previous character or pattern.
()	Specifies patterns for multiple use when followed by one of the multiplier metacharacters: asterisk (*), plus sign (+), or question mark (?).
[ ]	Matches any enclosed character; specifies a range of single characters.
– (hyphen)	Used within brackets to specify a range of AS or community numbers.
_ (underscore)	Matches a ^, a $, a comma, a space, a {, or a }. Placed on either side of a string to specify a literal and disallow substring matching. Numerals enclosed by underscores can be preceded or followed by any of the characters listed above.
|	Matches characters on either side of the metacharacter; logical OR.

Using Metacharacters as Literal Tokens

You can remove the special meaning of a metacharacter by preceding it with a backslash (\). Such a construction denotes that the metacharacter is not treated as a metacharacter for that regular expression. It is simply a character or token with no special meaning, just as a numeral has no special meaning. The backslash applies only to the character immediately following it in the regular expression.

On an E-series router, you are likely to use the backslash only for the parentheses characters, ( or ). BGP indicates a segment of an AS path that is of type AS-confed-set or AS-confed-seq by enclosing that segment with parentheses.

Example

The following AS-path access list uses a regular expression to match routes that have an AS-path attribute that begins with any AS-confed-set or AS-confed-seq:

host1(config)#ip as-path access-list 1 permit ^\(

The following AS-path access list uses a regular expression to match routes that have an AS-path attribute that ends with any AS-confed-set or AS-confed-seq:

host1(config)#ip as-path access-list 1 permit \)$

The following AS-path access list uses a regular expression to match routes that have an AS-path attribute that includes the specific AS-confed-set or AS-confed-seq, (100 200):

host1(config)#ip as-path access-list 1 permit \(100 200\)

 

Regular Expression Examples

Table 7 lists some representative regular expressions that you might use in an AS-path access list or community list, along with sample attribute values that match or do not match the regular expression.

Table 7: Sample Regular Expressions

Regular Expression	Matched AS-Path or Community Attribute	Example
^12	Begins with 12	12 23 4212 629 121245 19 but not 58 12 7
[^12]	Includes any numeral except 1 or 2	44 73 465 69 8 but not 1145 1912 2 49
305$	Ends with 305	89 611 305305 42 30519 1305 6666:305
.5	Includes any one character followed by the numeral 5	89 611 3533 252 12 998 600:500
1.9	Includes a sequence of three characters, where the first character is numeral 1 and the third character is numeral 9	179 35 2433 252 129 48 2129 14600:2129 321:94
.*	Includes any character; matches all AS paths and community lists
42*	Includes a number that has a numeral 4 followed by zero or more instances of the numeral 2	67 42 51314 33 252 422 483142 4 339 7831422
1(37)*	Includes a sequence that has a numeral 1 followed by zero or more instances of the pattern 37	137 42 211373737 29 4 1 but not 4 3737 78
42+	Includes a number that has a numeral 4 immediately followed by one or more instances of the numeral 2	67 42 2133 252 422 48 but not 4 329 78
1(37)+	Includes a sequence that has a numeral 1 immediately followed by one or more instances of the pattern 37	1373737 29 44 37137 78 137 42 21 but not 4 372 2121 37 5 1 456 881
42?	Includes a number that has a numeral 4 followed by zero or only one instance of the numeral 2	67 42 714 359 78 but not 33 252 422 48
1(37)?	Includes a sequence that has a numeral 1 followed by zero or only one instance of the pattern 37	137 42 2153 612 49 1 but not 4 13737 78
7..	Includes a sequence of three characters, where the first character is numeral 7	600 700 10025 7771 In the following examples, the three characters are 7, space, 8: 307 800 6127 888 999
^7..	Includes a number in the range 700 – 799	6127 723 999 700 100 600 but not 25 7771307 800
^7..$	Consists only of a number in the range 700 – 799	723 700 but not 25 7771307 800 6127 723 999700 100 600
[621]	Includes any of the numerals 6, 2, or 1	60 4334 545 92 200710 86 53 The regular expression [162] has the same results.
[0-9]	Includes any number in the range 0–9
^\(22 431\)	(AS-path attribute only) Begins with the AS-confed-set or AS-confed-seq (22 431)	(22 431) 102(22 431) 55 76 but not 43 (22 431) 522 431 59
{41 19}	(AS-path attribute only) Includes the AS-set or AS-seq {41 19}	{41 19} 53 76 {41 19} 17 255 {41 19} but not 3 41 19 41 19 532
101 102 | 103 105	Includes either sequence 101 102 or sequence 103 105	43 101 102 5103 105 22 but not 19 102 101102 103
_200_	Includes the number 200 (as opposed to the pattern consisting of numeral 2, numeral 0, numeral 0) Our implementation of regular expressions is not literal. Substring matching is enabled by default. Specifying 200 (no underscores) results in a match on 200 and on 2005. The underscore metacharacter disables substring matching.	33 200 422 48^200$ ^200 500$ but not 33 20 422 48 51 2005

 

 

Extended Community Lists

The router supports the BGP extended community attribute defined in
Internet draft BGP Extended Communities Attribute— draft-ietf-idr-bgp-ext-communities-07.txt (February 2004 expiration). This attribute enables the definition of a type of IP extended community and extended community list unrelated to the community list that uses regular expressions.

Note: IETF drafts are valid for only six months from the date of issuance. They must be considered as works in progress. For the latest drafts, please see the IETF Web site at http://www.ietf.org.

BGP devices can use the extended community attribute to control routes much like they use the community attribute to determine routes that they accept, reject, or redistribute. A BGP device can append the extended community attribute to a route that does not have the attribute before it advertises the route. For routes that do have the attribute, BGP can modify the attribute.

ip extcommunity-list

• Use to create an extended community list for BGP and control access to it.
• A route can belong to any number of communities, so an extended community list can have many entries comprising many communities.
• You can specify one or more community values when you create an extended community list. A clause in a route map that includes a list that has more than one value matches only a route that has all of the values; that is, the multiple values are logical ANDed.
• Use the rt keyword to specify a route target community, which consists of one or more routers that can receive a set of routes advertised by BGP that carry the extended community attribute.
• Use the soo keyword to specify a site-of-origin community, which consists of one or more routers that inject into BGP a set of routes that carry the extended community attribute.
• Example
  

  host1(config)#ip extcommunity-list boston1 permit rt 100:2 rt 100:3 rt 100:4

  host1(config)#route-map marengo permit 10

  host1(config-route-map)#match extcommunity boston1

  
  

  A route matches this community list only if it belongs to at least all three communities in extended community list boston1: communities 100:2, 100:3, and 100:4.
  


• Use the no version to remove a single extended community list entry if you specify the permit or deny keyword and a path expression. Otherwise, the router removes the entire community list.


• See ip extcommunity-list.

match extcommunity

• Use to match an extended community list in a route map.
• You can specify one or more extended community list names in a match clause. If you specify more than one extended community list, the lists are logically ORed.
• Example
  

  host1(config-route-map)#match extcommunity topeka10

  
  



• Use the no version to remove the match clause from a route map or a specified value from the match clause.


• See match extcommunity.

set extcommunity

• Use to set the extended community attributes in a route map for BGP updates.
• Use the rt keyword to specify a route target community, which consists of one or more routers that can receive a set of routes advertised by BGP that carry the extended community attribute.
• Use the soo keyword to specify a site-of-origin community, which consists of one or more routers that inject into BGP a set of routes that carry the extended community attribute.
• You can specify both a route target community and a site-of-origin community at the same time in a set clause without them overwriting each other.
• Example
  

  host1(config)#route-map 1

  host1(config-route-map)#set extcommunity rt 10.10.10.2:325

  
  



• Use the no version to remove the set clause from the route map.


• See set extcommunity.

show ip extcommunity-list

• Use to display information about a specific extended community list or all extended community lists.
• Example

  host1#show ip extcommunity-list
  IP Extended Community List dresden1:
      permit soo 10.10.10.10:15
  IP Extended Community List bonn:
      deny rt 12:12 

• See show ip extcommunity-list.

Community Lists

A community is a logical group of prefixes that share some common attribute. Community members can reside on different networks and in different autonomous systems. BGP enables you to define the community to which a prefix belongs. A prefix can belong to more than one community. The community attribute lists the communities to which a prefix belongs.

You can use communities to simplify routing policies by configuring the routing information that a BGP device can accept, prefer, or distribute to other neighbors according to community membership. When a route is learned, advertised, or redistributed, a BGP device can set, append, or modify the community of a route. When routes are aggregated, the resulting BGP update contains a community attribute that contains all communities from all of the aggregated routes (if the aggregate is an AS-set aggregate).

Several well-known communities are predefined. Table 5 describes how a BGP device handles a route based on the setting of its community attribute.

Table 5: Action Based on Well-Known Community Membership

Well-Known Community	BGP Device Action
no-export	Does not advertise the route beyond the BGP confederation boundary
no-advertise	Does not advertise the route to any peers, IBGP, or EBGP
local-as (also known as no-export-subconfed)	Does not advertise the route to any external peers
internet	Advertises this route to the Internet community; by default, all prefixes are members of the Internet community

In addition to the well-known communities, you can define local-use communities, also known as private communities or general communities. These communities serve as a convenient way to categorize groups of routes to facilitate the use of routing policies. The community attribute consists of four octets, but it is common practice to designate communities in the AA:NN format. The autonomous system number (AA) comprises the higher two octets, and the community number (NN) comprises the lower two octets. Both are expressed as decimal numbers. For example, if a prefix in AS 23 belongs to community 411, the attribute could be expressed as 23:411. Use the ip bgp-community new-format command to specify that the show commands display communities in this format. You can also use a regular expression to specify the community attribute.

Use the set community command in route maps to configure the community attributes. You can add one or more communities to the attribute, or you can use the list keyword to add a list of communities to the attribute. By default, the community attribute is not sent to BGP peers. To send the community attribute to a neighbor, use the neighbor send community command.

A community list is a sequential collection of permit and deny conditions. Each condition describes the community number to be matched. If you issued the ip bgp-community new-format command, the community number is in AA:NN format; otherwise, it is in decimal format (the hexadecimal octets converted to decimal).

The router tests the community attribute of a route against each condition in a community list. The first match determines whether the router accepts (the route is permitted) or rejects (the route is denied) a route that has the specified community. Because the router stops testing conditions after the first match, the order of the conditions is critical. If no conditions match, the router rejects the route.

Consider the network structure shown in Figure 5.

Figure 5: Community Lists

Suppose you want router Albany to set metrics for routes that it forwards to router Boston based on the communities to which the routes belong. You can create community lists and filter the routes with a route map that matches on the community list. The following example configures router Albany:

host1(config)#router bgp 293

host1(config-router)#neighbor 10.5.5.2 remote-as 32

host1(config-router)#neighbor 10.2.2.1 remote-as 451

host1(config-router)#neighbor 10.2.2.4 remote-as 17

host1(config-router)#neighbor 10.2.2.4 route-map commtrc out

host1(config-router)#exit

host1(config)#route-map commtrc permit 1

host1(config-route-map)#match community 1

host1(config-route-map)#set metric 20

host1(config-route-map)#exit

host1(config)#route-map commtrc permit 2

host1(config-route-map)#match community 2

host1(config-route-map)#set metric 75

host1(config-route-map)#exit

host1(config)#route-map commtrc permit 3

host1(config-route-map)#match community 3

host1(config-route-map)#set metric 85

host1(config-route-map)#exit

host1(config)#ip community-list 1 permit 25

host1(config)#ip community-list 2 permit 62

host1(config)#ip community-list 3 permit internet

Community list 1 comprises routes with a community of 25; their metric is set to 20. Community list 2 comprises routes with a community of 62; their metric is set to 75. Community 3 catches all remaining routes by matching the Internet community; their metric is set to 85.

ip bgp-community new-format

• Use to specify that communities must be displayed in AA:NN format, where AA is a number that identifies the autonomous system and NN is a number that identifies the community within the autonomous system.
• Example
  
  

  host1(config)#ip bgp-community new-format

  
  

  
  
  
  


• Use the no version to restore the default display.




• See ip bgp-community new-format.

ip community-list

• Use to create a community list for BGP and control access to it.
• The list name can be up to 32 characters long.
• A route can belong to any number of communities, so a community list can have many entries comprising many communities.
• You can specify one or more community values when you create a community list. A clause in a route map that includes a list that has more than one value matches only a route that has all of the values; that is, the multiple values are logical ANDed.
• You can specify community values with a number or a regular expression.
• Example
  
  

  host1(config)#ip community-list 1 permit 100:2 100:3 100:4

  host1(config)#route-map marengo permit 10

  host1(config-route-map)#match community 1

  
  

  A route matches this community list only if it belongs to at least all three communities in community list 1: communities 100:2, 100:3, and 100:4.
  
  
  
  
  


• Use the no version to remove the specified community list, including all list entries.




• See ip community-list.

neighbor send-community

• Use to specify that a community attribute be sent to a BGP neighbor.
• If you specify a BGP peer group by using the peer-group-name argument, all the members of the peer group inherit the characteristic configured with this command.
• Example
  
  

  host1:vr1(config-router)#neighbor 192.3.4.5 send-community standard

  
  

  
  
  
  


• Use the no version to specify that common attributes not be sent to a BGP neighbor.




• See neighbor send-community.

set community

• Use to set the community attribute in BGP updates.
• You can specify a community list number in the range 1–4294967295, or in the new community format of AA:NN, or you can specify one of the following well-known communities:
  
  • local-as—Prevents advertisement outside the local AS
  • no-advertise—Prevents advertisement to any peer
  • no-export—Prevents advertisement beyond the BGP confederation boundary
  
  
• Alternatively, you can use the list keyword to specify the name of a community list that you previously created with the ip community-list command.
• You can use this command with inbound, outbound, and redistribution route maps.
• Use the none keyword to remove the community attribute from a route.
• Example
  
  

  host1(config)#route-map 1

  host1(config-route-map)#set community no-advertise

  
  

  
  
  
  


• Use the no version to remove the set clause from a route map.




• See set community.

Using a Prefix List

The following example creates a prefix list that permits routes with a prefix length up to 24 in the 151.0.0.0/8 network:

host1(config)#ip prefix-list abc permit 151.0.0.0/8 le 24

clear ip prefix-list

• Use to clear all hit counts in the prefix lists or the specified entry from the specified prefix list. (The router increments the hit count by 1 each time an entry matches.)
• Example
  

  host1#clear ip prefix-list abc

  
  



• There is no no version.


• See clear ip prefix-list.

clear ipv6 prefix-list

• Use to clear all hit counts in the IPv6 prefix lists or the specified entry from the specified prefix list. (The router increments the hit count by 1 each time an entry matches.)
• Example
  

  host1#clear ipv6 prefix-list abc

  
  



• There is no no version.


• See clear ipv6 prefix-list.

ip prefix-list

ipv6 prefix-list

• Use to create a prefix list for route filtering and to specify a list entry—a deny or permit clause for a network address—to the prefix list. Use to add entries to prefix lists.
• The prefix list name can be up to 32 characters long.
• Specify the position of each entry in the list with the seq (sequence) keyword. If you do not specify a sequence number, the router uses the value of the last sequence number plus 5.
• Use the ge and le keywords to specify a range of network prefixes. These keywords have the following values:
  • prefix length < ge <= 32
  • prefix length < le <= ge
• If you do not specify either the ge or le keyword, an exact match is expected.
• Example 1—IPv4; exact match required; the router permits only a route with a prefix length of 8 and a network address of 151.0.0.0.
  

  host1(config)#ip prefix-list abc permit 151.0.0.0/8

  
  



• Example 2—IPv6; exact match required; the router permits only a route with a prefix length of 8 and a network address of 1:0:0:0:0:0:0:5.
  

  host1(config)#ipv6 prefix-list abc permit 1::5/8
  



• Use the no version to remove the specified prefix list or the specified list entry.


• See ip prefix-list.


• See ipv6 prefix-list.

match ip address

• Use to specify an access list or use with the prefix-list or prefix-tree keyword to match routes that have a destination network number address that is permitted by any specified access list, prefix list, or prefix tree.
• Example
  

  host1(config-route-map)#match ip address prefix-list abc

  
  



• Use the no version to delete the match clause from a route map or a specified value from the match clause.


• See match ip address.

match ipv6 address

• Use to match any route that has a destination network number address that is permitted by the specified access list or prefix list.
• Example
  

  host1(config-route-map)#match ipv6 address prefix-list boston

  
  



• Use the no version to delete all address match clauses from a route map unless you specify an access list or prefix list, in which case only the list match is removed from the route map.


• See match ipv6 address.

match ip next-hop

• Use with the prefix-list keyword to match routes that have a next-hop router address passed by the specified access lists, prefix lists, or prefix trees.
• Example
  

  host1(config-route-map)#match ip next-hop prefix-list abc

  
  



• Use the no version to delete the match clause from a route map or a specified value from the match clause.


• See match ip next-hop.

match ipv6 next-hop

• Use to match any routes that have a next-hop router address passed by the specified access list or prefix list.
• Example
  

  host1(config-route-map)#match ipv6 next-hop prefix-list next1

  
  



• Use the no version to delete all next-hop match clauses from a route map unless you specify an access list or prefix list, in which case the router removes only the list match from the route map.


• See match ipv6 next-hop.