5

how can I filter all the routes from one AS?

enter image description here

I want to filter all routes from AS 6400 towards AS1000, how can I filter whole routes from one AS to another?

I do not want to be used as transit AS so I need to do that, I Googled and got some stuff about using prefix-list + route-map but the thing is AS6400 is an actual Internet active AS which hosts some 500000 plus routes, and it does not sound reasonable to write prefix list for that amount of route, so what should I do?

9

There are a couple ways to do this, without having to specify every single prefix that you're receiving from AS6400 in a prefix-list (I would personally advise against doing this because as you mentioned, the administrative overhead is high and the process will become exponentially more error-prone as the number of prefixes increases).

1) Tag routes you've received from AS6400 with the no export community. You would do this within a route-map:

route-map RECEIVE-FROM-6400 permit 5
  set community no-export additive

This will tell R3 to not advertise the routes learned from AS6400 to AS1000 via the eBGP session to R1. This is your simplest option (note here that this will need to be an inbound filter applied on R4 on the eBGP session to R2/AS6400).

2) You could use an AS Path access list to determine which prefixes have an AS path that begins with 6400 and then you could use it on a BGP neighbor statement with a filter list, or you could use it in a route-map to deny advertising the prefixes on R3. This is less simple because it requires knowledge of regex (to be fair, the regex required here is somewhat simple) and it also depends on no one doing anything funny with their AS path, of which there's no real guarantee. Using a route-map, the configuration to implement would look something like this (assuming IOS):

ip as-path access-list 10 permit ^6400_[0-9]*$

route-map ANNOUNCE-TO-1000 deny 5
  match as-path 10

route-map ANNOUNCE-TO-1000 permit 10

Note that the above will need to be configured as an outbound filter on R3 for the eBGP session with AS1000.

Using the well-known 'no export' community is likely going to be your best bet, along with being very judicious with your outbound announcements to AS1000 and AS6400.

  • thanks as an example could you please tell me how to utilize Regex in this simple diagram? what should be like the As-path ACl for this example? – user7741 Oct 25 '14 at 6:22
  • See edited answer for an example. – John Jensen Oct 25 '14 at 21:29
  • instead of ^6400_[0-9]*$ can I use just 6400 which matches AS 6400 everywhere possible in path? the ^6400_[0-9]*$ means at the beginning of line match AS 6400 plus any number to the end of the line, am I right? – user7741 Oct 27 '14 at 14:11
  • I used (underscore6400underscore) but that showed up as just 6400 cause underscore works as a metacharacter in this box! – user7741 Oct 27 '14 at 14:13
6

If your goal is to not transit traffic through your AS to others, all you need to do is strictly control your outbound announcements to ensure that only your routes are advertised to either upstream peer.

If you are an edge AS (not a BGP-speaking ISP to your own customers) the simple way is almost exactly as you mentioned, but just using a prefix-list to control route announcements to peers. Define all of your prefixes exactly as you want to announce them to the peers, then apply that prefix-list outbound toward both peers. There is a great example of this (among other good BGP practices) on the Team Cymru Secure BGP Template.

Their example shows the following:

router bgp ###
neighbor x.x.x.x remote-as ****
neighbor x.x.x.x prefix-list announce out

ip prefix-list announce description Our allowed routing announcements
ip prefix-list announce seq 5 permit 192.0.2.0/24
ip prefix-list announce seq 10 deny 0.0.0.0/0 le 32

This causes the 192.0.2.0/24 network to be matched exactly and permitted, while the next line matches all other prefixes (mask length is 0, but match length is less-than/equal-to 32) and denies them.

  • This is a good, practical way, but for 512 K routes, that sounds a little impossible to do,am i right? – user7741 Oct 25 '14 at 6:26
  • 2
    No - @cpt_fink is suggesting to use a prefix-list for your outbound announcements. This will essentially prevent you from re-advertising prefixes learned from AS6400 to AS1000 because your originated prefixes will usually rarely change. You should be originating the same prefixes no matter who you're peering with - using a prefix-list for this further enforces what you're announcing, preventing AS1000 and AS6400 from using your AS as a transit AS. – John Jensen Oct 25 '14 at 21:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.