People who code: we want your input. Take the Survey
9

There are a couple ways to do this, without having to specify every single prefix that you're receiving from AS6400 in a prefix-list (I would personally advise against doing this because as you mentioned, the administrative overhead is high and the process will become exponentially more error-prone as the number of prefixes increases). 1) Tag routes you've ...


7

test policy PS-Filter-Prefix-Size 0.0.0.0/0 This should display routes passing the policy There isn't direct way to ask the opposite, but you could create policy which calls 'PS-Filter-Prefix-Size' and then rejects and accepts rest. Testing this policy would yield opposite results, showing routes not passing 'PS-Filter-Prefix-Size'. As far as I understand ...


6

As mentioned by Ron, you can use no-export (Don't advertise to any eBGP peers) or no-advertise (Don't advertise to iBGP or eBGP peers) to achieve this. However, this may strain scalability issues if bringing on another eBGP peer which you do wish to advertise these to. What I'd recommend is applying an inbound route-map/policy-statement on AS200/DUT for the ...


6

The ASA doesn't have the same filtering capabilities, unfortunately.


6

If your goal is to not transit traffic through your AS to others, all you need to do is strictly control your outbound announcements to ensure that only your routes are advertised to either upstream peer. If you are an edge AS (not a BGP-speaking ISP to your own customers) the simple way is almost exactly as you mentioned, but just using a prefix-list to ...


6

Every OSPF router in an area has a full topology map so it can calculate the shortest path to every network. If you attempt to filter routes, you break the router's ability to calculate the path. While some routers will let you filter routes (and not all do), it's a bad idea to do so. If you want to filter routes between your MPLS cloud and data center, I ...


4

If the providers can filter their updates for you, then that's fewer prefixes to be sent over your links, and fewer for you to process. A common technique is for providers to send you their AS and directly connected customer AS's, in addition to a default route. For AS's that are farther away, it may not matter which provider you use to get there. ...


4

You can specify what routes exactly you want to receive from neighbor on specific interface by using distribute-list option: (conf)# router eigrp 10 (config-router)# distribute-list 50 in Tunnel 3 access-list standard 50 permit 192.168.1.0 0.0.0.255 This short example displays how to accept only routes to network 192.168.1.0/24 from neighbors on Tunnel 3 ...


4

As a workaround, I configured Lo0 interface as a passive and advertised only passive interfaces into ISIS: RP/0/RP0/CPU0:PE2#sh run router isis lab Mon Apr 19 11:01:50.732 UTC router isis lab is-type level-2-only net 49.0000.1720.1600.0022.00 address-family ipv4 unicast advertise passive-only ! interface Loopback0 passive address-family ipv4 ...


3

Communities are usually applied to prefixes via route-maps. In your example, RouterA may have something like this: route-map to-router-b permit 10 description Tag Prefixes with Community match ip address prefix-list my-prefixes set community 65530:1234 additive The above will add an additional BGP community to the prefix on egress to RouterB (presuming ...


3

Logged a Case with Cisco and the RPL developer has confirmed you cannot only match a single part of a community string, it will always evaluate the whole community string, so can't be done.


3

What you're looking for is generally called "port isolation". On NX-OS, that's done with private vlans. Yes, at first glance, PVLAN configuration can be confusing, but Cisco has many documented examples. Here is one such document. (old, and ignore that it's for a 7000 and v5_x) vlan 3 private-vlan isolated vlan 2 private-vlan primary private-vlan ...


3

I assume you are using OpenDNS' web filtering functionality here, and it looks like that essentially involves using their DNS servers to handle lookups, rather than your own. You could define two SSIDs, associate them with different VLANs (on a single physical port) behind the APs, and then simply differentiate the settings that you provide to clients over ...


2

If you are specifically looking to speed convergence or lower CPU usage, then asking your providers if they offer a customers+peers+default route option would be the simple solution. If your full-table convergence time/CPU load is acceptable, configuring an as-path-list to limit the number of prefixes you use by AS-Path count provides you more flexibility ...


2

To use a prefix list, you have to include the word "prefix", like this: distribute-list prefix DRoute out Ref: http://www.cisco.com/c/en/us/td/docs/ios/12_2/iproute/command/reference/fiprrp_r/1rfrip.html


2

Indeed, you can't filter routes learned from Type 1 LSAs (intra-area routes). A solution would be to filter the routes to get to the rib on the cisco device. This is done with distribute lists. But I guess this is not what you're looking for. Another solution would be to make the Vyatta routers OSPF ABRs. This way you will be able to filter the Datacenter ...


2

You can place an extended ACL where you want (as long as it is in the path of the packet you want to filter of course). However, depending on the filtering parameters, it is usually better to put it close to the source. This way, undesirable traffic is denied close to the source network without crossing the network infrastructure, which limit bandwidth usage....


2

You cannot have a default route (0.0.0.0/0) be a preferred route. The route with the longest match in a routing table is always the one chosen to which a router will forward traffic. Any route with a mask length longer than 0 (any route other than a default route) that matches the destination will be chosen before the default route. It would be possible ...


1

There are well-known communities called no-export and no-advertise that you can use to tag prefixes to prevent them from being advertised to a different AS or even different internal routers. Use a route-map to tag the incoming prefixes as you want.


1

As @ronmaupin points out, this is a scenario that OSPF was not designed for and works very poorly at. OSPF was designed assuming you have full control over the network, and the only determination of the path from A to B is the cost. Every router has a full view of the network so that it can make the best path decision. BGP, on the other hand, was designed ...


1

Ping uses ICMP whereas web browsing uses HTTP (TCP port 80) and HTTPS (TCP port 443). It sounds like the two TCP ports have been blocked but ICMP has not.


1

I found what I was looking for. It is possible to filter BGP routes from entering the RIB. You just have to use the table-map command to filter using a route-map. http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_bgp/configuration/xe-3s/irg-xe-3s-book/bgp-selective_route_download.pdf Thanks anyway.


1

You may filter same way as you would filter bogon networks with prefix lists. For example: ip prefix-list rfc1918 deny 10.0.0.0/8 le 32 router bgp xxx neighbor x.x.x.x prefix-list rfc1918 in But routers with full BGP feeds should avoid default routes. Other ways to filter incoming prefixes is to use distribute lists with access-lists.


1

You could use ACLs to specifically do this, but you would need an ACL entry for each network, and any network changes would necessitate a change to the ACL. With a prefix list, you can do every current or future network of a particular size, or range of sizes, with a single line. I think this is the sort of thing that the quote meant, but you haven't ...


1

It looks like you don't want to get the full route prefix, only the host route prefix, which you want to create out of the full route prefix. I think you are confused. BGP will only get prefixes which are advertised to it. It appears that you are getting the the 192.168.151.0/24 prefix, but you wan to extract individual host prefixes from it, like 192.168....


1

I would suggest you to accept a full BGP feed from your providers since one day or another you might need to access a route which is a /24 prefix and announced by only one of your neighbours. If you just need to insure you have a full visibility of the 400k routes of the Internet here is a personal receipe I would try to reduce your router convergence time. ...


Only top voted, non community-wiki answers of a minimum length are eligible