23

Can someone explain with an example whats the difference between an access list and prefix list.

Improve this question

7 Answers 7

Reset to default
25

Here's the history of how they came into being (and why they are the way they are):

  • In the very early days of the Internet, people started asking for packet filters (aka access lists).
  • Cisco implemented simple access lists first (filtering on destination host addresses, augmented by wildcard masks), but of course they weren't good enough to block (for example) SMTP, so they created extended access lists, which can match on source and destination IP addresses (with wildcards bits on both - these bits allow you to match whole prefixes), protocols, port numbers ...

So: access list = packet filter.

Later (but still decades ago) people started running multiple routing protocols on the same box and wanted to redistribute information between them. Not a problem, but you wouldn't want ALL the information you have propagated into the other routing protocol - you need ROUTE FILTERS. As is usually the case, everything looks like a nail if you happen to have a hammer, and thus Cisco's engineers implemented route filters with the object they already had - access lists.

At this point: access list = packet filter (and sometimes route filter)

With the advent of classless routing (yeah, it's that long ago - does anyone still remember the days of Class A, Class B and Class C addresses), people wanted to redistribute prefixes of certain size between routing protocols. For example: advertise all /24s from OSPF into BGP, but not the /32s. Impossible to do with access lists. Time for a new kludge: let's use extended access list and let's pretend the source IP address in the packet filter represents network address (actually prefix address) and the destination IP address in the same line of the packet filter represents subnet mask.

This far: access lists = packet filters. Simple access lists also serve as route filters (matching only on network addresses) and extended access lists serve as route filters matching addresses and subnet masks.

Fortunately someone retained a shred of reason at that time and started wondering what exactly the brilliant minds that decided reusing extended ACLs for route filters makes sense were smoking when they got that brilliant idea.

End result: Cisco IOS got prefix lists, which are (almost) identical in functionality to extended access lists acting as route filters, but displayed in a format that a regular human being has a chance of understanding.

Today: use access lists for packet filters and prefix lists for route filters. You can still use access lists as route filters but don't do it.

Makes sense?

Improve this answer
2
  • "For example: advertise all /24s from OSPF into BGP, but not the /32s. Impossible to do with access lists" -not impossible but tedious
    – MiniMe
    Jun 17, 2016 at 16:18
  • Impossible to do with standard access lists if you really want to match on the subnet mask. Yeah, you could pretend that matching on zero host field is the same ;)
    – ioshints
    Jun 20, 2016 at 6:23
10

Not a whole lot.

They both provide means to filter on network addresses, but there are a couple key differences:

  • Extended ACL's can filter based on "higher layer" information, ie TCP/UDP port. Prefix lists cannot.
  • Extended/Standard ACL's can use wildcard masks which allow for the specification of arbitrary addresses or ranges of addresses. Prefix lists can't do this.
  • Prefix lists can match on prefix lengths - either minimum or maximum lengths with the "ge" and "le" keywords, respectively.

For routing policy, folks will tend to prefer to use prefix lists because some feel that they're more "expressive" but there is not much to limit you to using one or the other - it will be what the situation/requirements call for.

Improve this answer
1
  • 2
    Prefix-lists are often found with BGP inbound and outbound filtering such as denying any received prefixes that are ge /24 or creating a list of local AS prefixes that will be advertised out (so as to not advertise more than you should and become a transit).
    – generalnetworkerror
    May 22, 2013 at 8:02
6

Prefix-list is used for route-filtering and route redistribution because it matches on prefixes either sent,received or present in the routing table or BGP table. They match on bits in the prefix but also on the prefix-length. ACLs can be used for a lot more features like: traffic filtering, matching traffic for QoS,matching traffic for NAT, VPN,Policy Based Routing, etc.. They can also be used for route filters and redistribution but their syntaxes is then different than when they are used for other purposes.

Improve this answer
2

In addition to what John Jensen said, I would add that ACLs are also used for security purposes (e.g. limiting remote access) while prefix-list cannot have this function by their own.

Prefix-lists stick to L3, while ACL may go one layer up, bringing additional functionality.

For a visual comparison, see this link: http://mellowd.co.uk/ccie/?p=447

Improve this answer
0

Prefix lists work very similarly to access lists; a prefix list contains one or more ordered entries which are processed sequentially.

Improve this answer
1
  • Hi and thank you for your answer. Did you intend to add two different answers? While Stack Exchange doesn't mind two different answers to the same question, most people only answer with one. If you really intended this to be an edit to your original answer, please copy this text and edit it into your other answer. Then delete this answer.
    – Mike Pennington
    Jul 6, 2014 at 9:37
-2

Prefix-lists are used to specify an address or range of address to be permit or deny in route updates...

Improve this answer
-3

Access list is for traffic filtering & prefix list is for route filtering

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.