Module 4: BGP Policy·Lesson 4.3 (3 of 8 in this module)·25 of 43 in the BGP course
AS-path filters and regular expressions
A prefix list says which networks you accept. An AS-path filter says which networks you accept based on who sent them and who they passed through. Providers use it all the time, and it is built from a small regular expression language.
Advanced · 13 min read
You'll learn to read and write the AS-path regular expressions you meet in BGP, build an AS-path access list, apply it with filter-list, and test it before it touches a session.
Filtering by where a route came from
The AS path records every autonomous system a route crossed. That makes it a good filter key. You may want only routes your customer originated, none that passed through a particular network, or only routes from a neighbour and the networks directly behind it. A prefix list cannot express any of that, because it knows nothing about the path.
Three parts of an AS-path filter
On small screens, swipe sideways or focus the diagram and use the arrow keys.
The access list is built once and can be applied to any neighbour, inbound or outbound.
The regular expression characters
IOS reads the AS path as a line of text with the neighbour at the left and the origin at the right: 64501 64510 64511. A regular expression describes patterns in that text. Only a few characters matter for BGP.
The regular expression characters
On small screens, swipe sideways or focus the diagram and use the arrow keys.
Each item on the left, with what it means on the right.
Reading an AS-path regular expression
On small screens, swipe sideways or focus the diagram and use the arrow keys.
The path is read from the neighbour on the left to the origin on the right. ^ is the start, $ is the end, and _ matches the gap between AS numbers or either end.
Common patterns and what they select
On small screens, swipe sideways or focus the diagram and use the arrow keys.
64501 is an AS number from the documentation range.
Testing an expression before you use it
An AS-path filter decides by the path, not the prefix
On small screens, swipe sideways or focus the diagram and use the arrow keys.
The caret anchors the start of the path and the dollar sign anchors the end. Without anchors the expression matches anywhere inside the path and permits far more than intended.
Regular expressions are easy to get slightly wrong, and a wrong filter on a live session can drop your routing. Test on the BGP table first: it lists every route whose path matches.
show ip bgp regexp _64501$
show ip bgp regexp ^64501_
show ip bgp regexp ^$
Privileged EXEC mode. Each command prints only the BGP table entries whose AS path matches. Check the list is exactly what you intend to permit or deny.
Illustrative Cisco IOS XE output written for this lesson, not a router capture
R1#show ip bgp regexp _64511$
Network Next Hop Metric LocPrf Weight Path
*> 203.0.113.0 192.0.2.1 0 0 64501 64510 64511 i
*> 203.0.114.0 192.0.2.1 0 0 64501 64511 i
Both routes end in 64511, so both were originated there, however many ASes they crossed. A router that matches nothing prints no table at all.
Building and applying the access list
ip as-path access-list 10 permit ^64501_
!
router bgp 64500
address-family ipv4 unicast
neighbor 192.0.2.1 filter-list 10 in
end
clear ip bgp 192.0.2.1 soft in
R1. Accepts from ISP A only routes whose first AS is 64501, which is every route ISP A should send you. The implicit deny at the end of the list drops anything else.
Each line of the list is evaluated in order and the first match decides. The list ends with an implicit deny, so a list of deny lines on its own rejects everything. Finish a deny list with permit .*.
Four filters you will actually write
Permit-list or deny-list
On small screens, swipe sideways or focus the diagram and use the arrow keys.
A permit-list is safer for a customer. A deny-list is for removing a known bad source.
Four filters you will actually write
On small screens, swipe sideways or focus the diagram and use the arrow keys.
Each item on the left, with what it means on the right.
The last example matters in practice. A customer behind AS 64501 may prepend, which repeats the number in the path (64501 64501 64501 64520). A pattern that expects one 64501 would reject it, so the second line allows one or more repeats of the neighbour before the customer.
Technical reference: Cisco IOS XE BGP configuration guide, section on AS-path filters. Output above is illustrative.
Check your understanding
Predict · scenario 1
Which expression matches only routes originated by AS 64501?
Predict · scenario 2
You write ip as-path access-list 5 deny _64511$ and apply it. Every other route disappears. Why?
Predict · scenario 3
Why is the expression 64501 risky for matching AS 64501?
FAQ
Why does my AS-path filter match more than I expected?
Regular expressions match anywhere in the text. The pattern 64501 also matches 164501 and 645010. Anchor with underscores, as in _64501_, so the AS number must stand alone.
What does the last line of an AS-path access list do?
Like other access lists, it ends with an implicit deny. If you only deny some routes, add permit .* at the end or everything else is dropped.
Does an AS-path filter apply to routes my own AS originates?
Yes. Routes originated in your AS have an empty AS path when they are inside the AS, so the expression ^$ matches them.