Cisco CCNP Enterprise (ENCOR 350-401) · lesson 6 of 12 · 30 min
Why BGP Filtering Matters
BGP filtering is not optional — it is a security and operational necessity. Without filtering, a misconfigured router can accidentally advertise routes it shouldn’t (route leaks), accept routes it shouldn’t (route hijacks), or propagate incorrect metrics. Every BGP session should have inbound and outbound filters. BGP filtering is like customs at a border. Without it, anything can cross — legitimate goods and contraband alike. With proper filtering, you inspect everything coming in and control exactly what you send out. A route leak without filtering is like accidentally telling the whole internet to send traffic through your home network.
Prefix-Lists: The Preferred BGP Filter
IP prefix-lists are the most efficient and readable way to filter BGP routes. They match on network address AND prefix length, giving you precise control. They are processed top-down and stop at the first match (like ACLs). An implicit deny all exists at the end.
The ge/le keywords refer to the prefix LENGTH, not the address.
permit 10.0.0.0/8 ge 24
matches any /24 or longer that falls within the 10.0.0.0/8 block — like 10.1.1.0/24, 10.2.3.0/25, etc.
Applying Prefix-Lists to BGP Neighbors
AS-Path Access Lists: Filtering by AS_PATH
AS-path access lists use regular expressions to match BGP routes based on their AS_PATH attribute. This is powerful for filtering routes from specific ASes or with specific path patterns.
- AS-path filter configuration
- ip as-path access-list 1 permit ^65001$ → neighbor 10.0.0.2 filter-list 1 in
Route-Maps: The Swiss Army Knife of BGP Policy
Route-maps combine matching (match clauses) with actions (set clauses). They can filter routes AND modify attributes in a single tool. Route-maps are processed sequentially by sequence number — first match wins. An implicit deny all exists at the end.
Applying Route-Maps to BGP
A route-map with only permit clauses and no match statement at the end acts as a permit-all for unmatched routes. A route-map with no permit at the end implicitly denies everything that didn’t match — just like an ACL.
Soft Reconfiguration and Route Refresh
When you change a BGP filter, the change only applies to new updates. To apply it to existing routes without resetting the session, use:
Worked Scenario: ISP BGP Filtering Policy
Scenario
You peer with ISP-A (AS 65100). You want to: (1) only accept routes within 10.0.0.0/8 from ISP-A, (2) set LOCAL_PREF 150 on all accepted routes, (3) only advertise your own prefix 192.168.1.0/24 to ISP-A, and (4) prepend your AS once on outbound advertisements.
Step 1 — Inbound prefix-list:
ip prefix-list FROM-ISPA permit 10.0.0.0/8 le 32
Step 2 — Inbound route-map: Match the prefix-list, set LOCAL_PREF 150, permit. Add a final deny to block everything else.
Step 3 — Outbound prefix-list:
ip prefix-list TO-ISPA permit 192.168.1.0/24
Step 4 — Outbound route-map: Match the prefix-list, prepend AS once, permit. Final deny blocks all other prefixes.
Step 5 — Apply:
neighbor 65100-peer route-map FROM-ISPA-MAP in
and
neighbor 65100-peer route-map TO-ISPA-MAP out
Step 6 — Activate:
clear ip bgp 65100-peer soft
Flashcard Drill
ip prefix-list le Less than or equal — matches prefixes with length up to the specified value within the given network. ip prefix-list ge Greater than or equal — matches prefixes with length at least the specified value within the given network. AS-path access-list ^$ Matches routes with an empty AS_PATH — routes originated locally by this router. route-map permit with no match Matches all routes — acts as a permit-all catch-all at the end of a route-map. neighbor route-map in Applies a route-map to routes received from a BGP neighbor — filters and/or modifies inbound routes. clear ip bgp soft in Re-processes inbound routes with current policy without resetting the BGP session. soft-reconfiguration inbound Stores a copy of all inbound routes before filtering — required for soft reset if route-refresh not supported. set as-path prepend Route-map set clause that adds AS numbers to the AS_PATH — makes the path appear longer to influence inbound traffic.
Knowledge Check — 12 Questions
BGP Filtering: Prefix-Lists & Route-Maps
Which prefix-list entry matches any prefix within 10.0.0.0/8 with a length between 16 and 24?
- permit 10.0.0.0/8
- permit 10.0.0.0/8 ge 16 le 24
- permit 10.0.0.0/16 le 24
- permit 10.0.0.0/8 le 16 ge 24
Answer: permit 10.0.0.0/8 ge 16 le 24
ge 16 le 24 means prefix length must be between 16 and 24 bits, and the prefix must fall within 10.0.0.0/8.
Which AS-path regex matches routes that originated in AS 65001?
- ^65001$
- ^65001_
- _65001$
- 65001
Answer: _65001$
_65001$ matches routes where 65001 is the LAST AS in the path — meaning the route originated in AS 65001.
What does a route-map deny clause do to matching routes?
- Drops the route from the BGP table
- Filters the route — it is not advertised or accepted
- Sets the metric to infinity
- Sends a BGP NOTIFICATION
Answer: Filters the route — it is not advertised or accepted
A route-map deny clause filters matching routes. They are not installed in the routing table (inbound) or not advertised (outbound).
To re-process inbound BGP routes without resetting the session, use: clear ip bgp x.x.x.x soft _____.
Answer: in
clear ip bgp x.x.x.x soft in re-processes inbound routes with the current policy without dropping the BGP session.
Which command applies a route-map to routes advertised to a BGP neighbor?
- neighbor x.x.x.x route-map MAP in
- neighbor x.x.x.x route-map MAP out
- neighbor x.x.x.x prefix-list MAP out
- ip bgp route-map MAP out
Answer: neighbor x.x.x.x route-map MAP out
The out keyword applies the route-map to routes being advertised to the neighbor.
What is the implicit action at the end of a prefix-list?
- Permit all
- Deny all
- Forward to next list
- Log and permit
Answer: Deny all
Like ACLs, prefix-lists have an implicit deny all at the end. Any prefix not explicitly permitted is denied.
Which route-map set clause is used to influence inbound traffic from remote ASes?
- set local-preference
- set weight
- set as-path prepend
- set metric
Answer: set as-path prepend
AS_PATH prepend makes your path appear longer to remote ASes, causing them to prefer a shorter path to reach you — influencing inbound traffic.
A route-map with only permit clauses and no match statement at the end denies all unmatched routes.
- True
- False
Answer: False
A route-map permit clause with no match statement matches ALL routes — it acts as a permit-all catch-all.
Which prefix-list entry matches ONLY the exact prefix 192.168.1.0/24?
- permit 192.168.1.0/24 le 32
- permit 192.168.1.0/24 ge 24
- permit 192.168.1.0/24
- permit 192.168.0.0/16 ge 24 le 24
Answer: permit 192.168.1.0/24
Without ge or le, a prefix-list entry matches only the exact prefix and length specified.
What does soft-reconfiguration inbound enable?
- Automatic BGP session reset on policy change
- Storage of pre-filter inbound routes for soft reset
- Route reflection to iBGP peers
- Inbound MED comparison
Answer: Storage of pre-filter inbound routes for soft reset
soft-reconfiguration inbound stores a copy of all inbound routes before filtering. This allows soft reset (clear bgp soft in) without route-refresh capability.
Which AS-path regex matches ALL routes?
- ^$
- ^.*$
- .*
- .*
Answer: .
. matches any sequence of characters (including empty) — it matches all AS_PATH values.
Route-map sequence numbers are processed in which order?
- Highest to lowest
- Lowest to highest
- Random
- Alphabetical
Answer: Lowest to highest
Route-map sequence numbers are processed from lowest to highest. The first matching sequence wins.
Previous lesson: BGP path selection: weight, local preference, AS-path, MED, origin; attributes
Back to Cisco CCNP Enterprise (ENCOR 350-401)
Next lesson: Advanced STP: RSTP, MST (802.1s), loop prevention (BPDU guard, root guard, loop guard)