Module 4: BGP Policy·Lesson 4.4 (4 of 8 in this module)·26 of 43 in the BGP course
Filtering with distribute lists and extended ACLs
Before prefix lists existed, access lists filtered BGP routes, and you will still meet them in older configs and in exam tasks that forbid prefix lists. The twist is that an extended ACL used this way does not mean what it means on an interface.
Advanced · 11 min read
You'll learn to apply a distribute list to a BGP neighbour, read an extended ACL written for BGP, and convert between that ACL and a prefix list.
Where a prefix filter sits on a neighbour
On small screens, swipe sideways or focus the diagram and use the arrow keys.
In is what you accept, out is what you announce. Mixing them up is a common reason a route is missing or leaks.
Distribute lists
A distribute list applies an access list to the routes of one BGP neighbour, in or out. It is the oldest of the neighbour filters. It is configured under the address family, like a prefix list, and like every filter it only takes effect on routes processed after you reset the session softly.
access-list 10 permit 198.51.100.0 0.0.0.255
!
router bgp 64500
address-family ipv4 unicast
neighbor 192.0.2.1 distribute-list 10 out
end
clear ip bgp 192.0.2.1 soft out
R1. A standard ACL as a distribute list. It permits any prefix whose network address is in 198.51.100.0 to 198.51.100.255, whatever its length.
Which ACL type does what
On small screens, swipe sideways or focus the diagram and use the arrow keys.
Only the extended form can match the prefix length.
How an extended ACL reads when used for BGP
On an interface, an extended ACL has a source and a destination. For BGP filtering the same fields are reused with a different meaning. The source position holds the network address and the destination position holds the subnet mask of the prefix. The wildcard bits after each decide how exactly that part must match.
Same syntax, different meaning
On small screens, swipe sideways or focus the diagram and use the arrow keys.
Read the two halves of the line as network and mask, not as source and destination.
Reading five lines
On small screens, swipe sideways or focus the diagram and use the arrow keys.
A wildcard of 0.0.0.0 means that part must match exactly. A wildcard bit of 1 means anything.
The line that matches a range of lengths is the one to learn. A mask of 255.255.255.0 with a wildcard of 0.0.0.255 lets the last mask octet be anything, so lengths /24 through /32 all match. That is the access-list way to write what a prefix list calls ge 24.
access-list 100 permit ip 172.16.0.0 0.0.0.0 255.255.255.0 0.0.0.0
access-list 100 permit ip 192.168.0.0 0.0.255.0 255.255.255.0 0.0.0.0
!
router bgp 64500
address-family ipv4 unicast
neighbor 192.0.2.1 distribute-list 100 in
R1. Accepts exactly 172.16.0.0/24 and any 192.168.x.0/24 from ISP A. Everything else is dropped by the implicit deny.
Choosing the filter
Distribute list or prefix list
On small screens, swipe sideways or focus the diagram and use the arrow keys.
They cannot be combined on one neighbour and direction.
Technical reference: Cisco IOS XE BGP configuration guide on prefix filtering with distribute lists.
Check your understanding
Predict · scenario 1
In an extended ACL used as a BGP distribute list, what does the destination field hold?
Predict · scenario 2
Which ACL line permits any network with a /24 to /32 prefix length?
Predict · scenario 3
Can you configure a distribute list and a prefix list on the same neighbour and direction?
FAQ
Should I use extended ACLs for BGP filtering?
Rarely. A prefix list expresses the same match more clearly and supports ge and le. Use an ACL when a task or an older design requires it.
Can I use a distribute list and a prefix list on the same neighbour?
Not in the same direction. IOS XE allows one or the other for each neighbour and direction.
What does a standard ACL match in a distribute list?
Only the network address of the prefix. It cannot see the prefix length, so it cannot tell a /24 from a /25 that starts at the same address.