[Contents] [Prev] [Next] [Index] [Report an Error]

Filtering AS Paths with a Filter List

You can use a filter list to filter incoming and outgoing routes based on the value of the AS-path attribute. Whenever a BGP route passes through an AS, BGP prepends its AS number to the AS-path attribute. The AS-path attribute is the list of ASs that a route has passed through to reach a destination.

To filter routes based on the AS-path, define the access list with the ip as-path access-list command, and apply the list to routes received from or passed to a neighbor with the neighbor filter-list command. AS-path access lists use regular expressions to describe the AS path to be matched. A regular expression uses special characters—often referred to as metacharacters—to define a pattern that is compared with an input string. For a full discussion of regular expressions, with examples on how to use them, see JUNOSe IP Services Configuration Guide.

The router compares each route’s AS path against the conditions in the access list one by one. If the first match is for a permit condition, the route is accepted or passed. If the first match is for a deny condition, the route is rejected or blocked. The order of conditions is critical because testing stops with the first match. If no conditions match, the router rejects or blocks the route; that is, the last action of any list is an implicit deny condition for all routes.

You cannot selectively place conditions in or remove conditions from an AS-path access list. You can insert a new condition only at the end of an AS-path access list.

Example 1

Consider the network structure in Figure 23.

Figure 23: Filtering with AS-Path Access Lists

Image g013178.gif

Suppose you want router London to behave in the following way:

Accept routes originated in AS 621 only if they pass directly to router London
Accept routes originated in AS 11 only if they pass directly to router London
Forward routes from AS 282 to AS 435 only if they pass through either AS 621 or AS 11, but not both AS 621 and AS 11

The following commands configure router London to apply filters based on the AS path to routes received from router Berlin and router Paris and to routes forwarded to router Madrid.



host1(config)#router bgp 47 

host1(config-router)#neighbor 10.2.9.2 remote-as
621 

host1(config-router)#neighbor 10.2.9.2 filter-list
1 in 

host1(config-router)#neighbor 10.2.8.2 remote-as
11 

host1(config-router)#neighbor 10.2.8.2 filter-list
2 in 

host1(config-router)#neighbor 10.2.7.2 remote-as
435 

host1(config-router)#neighbor 10.2.7.2 filter-list
3 out 

host1(config-router)#exit 

host1(config)#ip as-path access-list 1 deny ^621_11$ 

host1(config)#ip as-path access-list 1 permit .* 

host1(config)#ip as-path access-list 2 deny ^11_621$ 

host1(config)#ip as-path access-list 2 permit .* 

host1(config)#ip as-path access-list 3 deny ^11_621_282 

host1(config)#ip as-path access-list 3 deny ^621_11_282 

host1(config)#ip as-path access-list 3 permit .*

AS-path access list 1 is applied to routes that router London receives from router Paris. Router London rejects routes with the AS path (621 11).

AS-path access list 2 is applied to routes that router London receives from router Berlin. Router London rejects routes with the AS path (11 621) or (621 282 11).

Router London accepts routes with the AS path (11 282), (621 282), (621 11 282), or (11 621 282). However, it applies AS-path access list 3 to routes it forwards to router Madrid, and filters out routes with the AS path (621 11 282) or (11 621 282).

Example 2

Consider the following commands used to configure router Chicago in Figure 24:



host1(config)#router bgp 293 

host1(config-router)#neighbor 10.5.5.2 remote-as
32 

host1(config-router)#neighbor 10.5.5.2 filter-list
1 in 

host1(config-router)#neighbor 10.2.2.4 remote-as
17 

host1(config-router)#exit 

host1(config)#ip as-path access-list 1 deny ^32$

Figure 24: Assigning a Filter List

Image g013179.gif

Access list 1 denies routes that originate in AS 32—and therefore routes originated by router NY—because the AS-path attribute for these routes begins with (and indeed consists only of) the value 32.

Routes originating anywhere else—such as in AS 837, AS 17, or AS 451—are permitted, because their AS-path attributes do not begin with 32.

ip as-path access-list

Use to define an AS-path access list to permit or deny routes based on the AS path.
Each access list is a set of permit or deny conditions for routes based on matching a route’s AS path with a regular expression. If the regular expression matches the representation of the AS path of the route as an ASCII string, then the permit or deny condition applies. The AS path does not contain the local AS number.
Use the neighbor filter-list command to apply the AS-path access list. You can apply access list filters to inbound and outbound BGP routes. You can assign weights to routes matching the AS-path access list.
Use the no version to remove a single access list entry if permit or deny and a path-expression are specified. Otherwise, the entire access list is removed.
See ip as-path access-list.

neighbor filter-list

Use to assign an AS-path access list to matching inbound or outbound routes with the in or out keywords.
You can specify an optional weight value with the weight keyword to assign a relative importance to incoming routes matching the AS-path access list.
The name of the access list is a string of up to 32 characters.
If you specify a BGP peer group by using the peerGroupName argument, all the members of the peer group inherit the characteristic configured with this command unless it is overridden for a specific peer. However, you cannot configure a member of a peer group to override the inherited peer group characteristic for outbound policy.
New policy values are applied to all routes that are sent (outbound policy) or received (inbound policy) after you issue the command.
To apply the new policy to routes that are already present in the BGP routing table, you must use the clear ip bgp command to perform a soft clear or hard clear of the current BGP session.

Behavior is different for outbound policies configured for peer groups for which you have enabled Adj-RIBs-Out. If you change the outbound policy for such a peer group and want to fill the Adj-RIBs-Out table for that peer group with the results of the new policy, you must use the clear ip bgp peer-group command to perform a hard clear or outbound soft clear of the peer group. You cannot merely perform a hard clear or outbound soft clear for individual peer group members because that causes BGP to resend only the contents of the Adj-RIBs-Out table.
Use the no version to disassociate the access list from a neighbor.
See neighbor filter-list.

[Contents] [Prev] [Next] [Index] [Report an Error]