Course contents

Module 4: BGP PolicyLesson 4.2 (2 of 8 in this module)24 of 43 in the BGP course

Inbound and outbound filtering

A customer network with two ISPs can accidentally become a path between them. Filtering is what stops that: you decide what to accept, and you decide what to say.

Advanced · 14 min read

You'll learn to choose the right filter for a goal, apply it in the right direction, and stop the company AS from acting as a transit network between its two providers.

Where you can filter

Every BGP session has an inbound side and an outbound side. Inbound policy runs on routes a neighbour sends, before they enter your BGP table. Outbound policy runs on routes you are about to send. Choose the side by the goal: protect yourself with inbound, control what others learn with outbound.

Two policy points on every session, and why outbound filters matter
Two policy points on every session, and why outbound filters matterLeft: R1 and ISP A with an inbound policy that chooses what R1 accepts and an outbound policy that chooses what R1 sends. Right: without an outbound filter, routes learned from ISP A can be re-advertised to ISP B and the company becomes a transit network.Two policy points per sessionWhy outbound filters matterISP AAS 64501R1AS 64500routes receivedroutes advertisedInbound policy: what to acceptprefix list, route map, AS-path listOutbound policy: what to sendonly your own prefixesISP ACompanyISP BlearnedleakedWithout an outbound filter, routes fromISP A can be re-advertised to ISP B andthe company becomes a transit network.Fix: permit only 198.51.100.0/24out to both ISPs

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Inbound policy protects your routing table. Outbound policy protects everyone else's.

Pick the filter by what you need to match

Choose the tool by what you match
Choose the tool by what you matchPrefix lists match addresses, AS-path lists match AS numbers and route maps combine matches with actions.A prefix and lengthprefix-listThe AS pathas-path access-listA community tagcommunity-listSeveral things, plus an actionroute-map

On small screens, swipe sideways or focus the diagram and use the arrow keys.

If you need an action as well as a match, you need a route map.
Pick the filter by what you need to match
Pick the filter by what you need to matchGoal; Tool; Command. Match a network and mask length: Prefix list neighbor X prefix-list NAME in|out Match where a route came from: AS-path access list neighbor X filter-list N in|out Match and change attributes: Route map neighbor X route-map NAME in|outGoalToolCommandMatch a network andmask lengthPrefix listneighbor X prefix-list NAME in|outMatch where a routecame fromAS-path access listneighbor X filter-list N in|outMatch and changeattributesRoute mapneighbor X route-map NAME in|out

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Read each row across: the left box names the item, the others describe it.

Stop the company becoming a transit AS

The company AS should hand each ISP only its own routes. An AS-path list can say exactly that: ^$ matches an empty AS path, which is how a route looks when it originated in your own AS and has not yet left.

Without and with an outbound filter
Without and with an outbound filterWithout a filter, routes learned from one ISP can be advertised to the other. The filter allows only the company prefix.No outbound filterISP A routes advertisedto ISP BCompany becomes transitOutbound prefix listOnly 198.51.100.0/24leaves the companyvs

On small screens, swipe sideways or focus the diagram and use the arrow keys.

A transit leak sends other networks traffic through your links.
ip as-path access-list 10 permit ^$ router bgp 64500 address-family ipv4 unicast neighbor 192.0.2.1 filter-list 10 out neighbor 192.0.2.5 filter-list 10 out

R1 and R2 apply to their own provider only. Only routes with an empty AS path, meaning the company's own, are advertised.

This works together with the prefix lists from earlier lessons. The prefix list limits which networks, the AS-path list limits where they came from, and either one alone already prevents transit.

Illustrative Cisco IOS XE output written for this lesson, not a router capture
R1#show ip bgp neighbors 192.0.2.1 advertised-routes
     Network          Next Hop            Metric LocPrf Weight Path
 *>  198.51.100.0     0.0.0.0                  0         32768 i

Total number of prefixes 1
Only the company prefix is advertised. If you see an ISP B route here, the filter is missing or applied in the wrong direction.

Filter inbound as well

ip prefix-list NO-DEFAULT seq 10 deny 0.0.0.0/0 ip prefix-list NO-DEFAULT seq 20 permit 0.0.0.0/0 le 24 router bgp 64500 address-family ipv4 unicast neighbor 192.0.2.1 prefix-list NO-DEFAULT in

Reject a default route from a provider and accept anything up to /24. Adjust to what the provider has agreed to send.

To test a policy change without bringing the session down, use a soft reset. The next lesson explains why that is safe.

Inbound filters protect you
Inbound filters protect youReject what a provider should never send.Update arrivesfrom the ISPInbound filterprefix list orroute mapAcceptedenters the BGPtable

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Typical rejects: default (if unwanted), private ranges and your own prefix.

Technical reference: Cisco IOS XE BGP configuration guide. Output above is illustrative.

Check your filters

Predict · scenario 1

You want to stop the company advertising ISP A's routes to ISP B. Which filter fits best?

Predict · scenario 2

A provider mistakenly sends you a default route. Which direction should the protecting filter be applied?

Predict · scenario 3

Which command applies an AS-path access list to a neighbour?

FAQ

Why filter inbound when the ISP already filters?
You cannot rely on another network's configuration. Accepting only the prefixes you expect protects your routing table from a provider's mistake, such as a leaked default route or someone else's address space.
How does a company AS become a transit AS?
If R1 advertises routes learned from ISP A to ISP B, ISP B can send traffic for ISP A's networks through the company. Advertising only the company's own prefixes to each provider prevents it.
Prefix list or AS-path list?
Use a prefix list to match networks and an AS-path access list to match where a route came from. A common outbound pair is: only prefixes originated in my AS.