1

Consider the following:

Scenario 1 (route-map PERMIT and ACL permit):

router(config)#route-map boston permit 1
router(config-route-map)#match ip address 5
router(config-route-map)#set community 120
router(config)#access-list 5 permit 10.5.1.121 0.0.0.255

Scenario 2 (route-map PERMIT and ACL deny):

router(config)#route-map boston permit 1
router(config-route-map)#match ip address 5
router(config-route-map)#set community 120
router(config)#access-list 5 deny 10.5.1.121 0.0.0.255

Scenario 3 (route-map DENY and ACL permit):

router(config)#route-map boston deny 1
router(config-route-map)#match ip address 5
router(config-route-map)#set community 120
router(config)#access-list 5 permit 10.5.1.121 0.0.0.255

Scenario 4 (route-map DENY and ACL DENY):

router(config)#route-map boston deny 1
router(config-route-map)#match ip address 5
router(config-route-map)#set community 120
router(config)#access-list 5 deny 10.5.1.121 0.0.0.255

Q: What is the difference in the four scenarios? Please clarify. For ease of understanding, is there some kind of truth table that we can construct?

Can the following truth table be applied universally?

Route-map(permit), ACL(permit)---->DO THE TASK

Route-map(permit), ACL(deny)---->DON'T DO THE TASK

Route-map(deny), ACL(permit)---->DON'T DO THE TASK

Route-map(deny), ACL(deny)---->DON'T DO THE TASK

2
  • Scenario 1: Will set the community to 120 for 10.5.1.0/24
  • Scenario 2: Will not set the community to 120 for any route
  • Scenario 3: Will not set the community to 120 for any route
  • Scenario 4: Will not set the community to 120 for any route

There is an implicit deny in the route-map statement. So if permit 1's match clause in Scenario 2 doesn't match because of the deny statement in the ACL, then the rest of the networks would not be matched either.

Consider this additional scenario:

router(config)#route-map boston permit 10
router(config-route-map)#match ip address 5
router(config-route-map)#set community 120
router(config)#access-list 5 deny 10.5.1.121 0.0.0.255
router(config)#route-map boston permit 20

In this scenario, you would be saying set the community to 120 for any route that's NOT 10.5.1.0/24.

2

Cisco has documentation for this. It may be simpler to think about the interaction with redistribution. The following example is from Defining Route Maps and an identical example in Route-Maps for IP Routing Protocol Redistribution Configuration:

Permit and Deny Clauses

Route-maps can have permit and deny clauses. In route map ospf-to-eigrp, there is one deny clause (with sequence number 10) and two permit clauses. The deny clause rejects route matches from redistribution. Therefore, these rules apply:

  • If you use an ACL in a route map permit clause, routes that are permitted by the ACL are redistributed.
  • If you use an ACL in a route map deny clause, routes that are permitted by the ACL are not redistributed.
  • If you use an ACL in a route map permit or deny clause, and the ACL denies a route, then the route map clause match is not found and the next route map clause is evaluated.

This seems to line up with the Boolean AND logic table from high school:

True  AND True  = True
True  AND False = False
False AND True  = False
False AND False = False
0

Let me improve both replies.

In the pervious example:

router(config)#route-map boston permit 10
router(config-route-map)#match ip address 5
router(config-route-map)#set community 120
router(config)#access-list 5 deny 10.5.1.121 0.0.0.255
router(config)#route-map boston permit 20

The route-map boston does nothing but permit everything becasue: seq. 10 does not match, seq 20 does not contain any set clauses.

The combination is not merely an AND operation as if ACL is deny than evaluation of route-map continues, if permit it stops as a match found.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.