Course contents

Module 4: BGP PolicyLesson 4.1 (1 of 8 in this module)23 of 43 in the BGP course

Prefix lists and route maps for BGP

Every BGP policy is built from two tools. A prefix list answers the question: is this the network I mean? A route map answers: what should I do with it? Once you read both fluently, the rest of BGP policy is combinations.

Advanced · 13 min read

You'll learn to write prefix lists with ge and le, build route maps with match and set clauses, and predict what a route map permits using sequence order and the implicit deny.

Match first, then act

BGP gives you plenty of places to change what is accepted or advertised. All of them use the same two building blocks. A prefix list matches networks by address and mask length. A route map is a numbered list of rules, each with optional match lines and set lines.

Match, then act
Match, then actEvery policy tool has a match part and an action part.Matchaddress, length,AS path, communityDecisionpermit or denyActionset attributes

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Prefix lists only match. Route maps match and then permit, deny or set.

Prefix lists: address plus a length range

An entry says permit or deny a network, optionally with ge (greater than or equal to) and le (less than or equal to) limits on the prefix length. With neither, only the exact length matches.

Prefix lengths matched by three entries for 198.51.100.0/24
Prefix lengths matched by three entries for 198.51.100.0/24A row for each of three prefix-list entries on 198.51.100.0/24 and a column for each prefix length from 24 to 32. With no ge or le only length 24 matches. With le 26 lengths 24 to 26 match. With ge 25 le 26 lengths 25 and 26 match.Prefix length of the route/24/25/26/27/28/29/30/31/32exact (no ge or le)matchnonononononononole 26matchmatchmatchnonononononoge 25 le 26nomatchmatchnonononononopermit 198.51.100.0/24, permit ... le 26, permit ... ge 25 le 26

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Every entry only matches routes inside 198.51.100.0/24. The ge and le keywords widen the allowed prefix lengths, not the address block.
ip prefix-list COMPANY-ONLY seq 10 permit 198.51.100.0/24 ip prefix-list SMALL-SUBNETS seq 10 permit 198.51.100.0/24 ge 25 le 28 ip prefix-list ANY-DEFAULT seq 10 permit 0.0.0.0/0 ip prefix-list ANYTHING seq 10 permit 0.0.0.0/0 le 32

Global configuration mode. The first matches only the /24. The second matches /25 to /28 inside it, not the /24 itself. The third is the default route alone. The last matches every route.

Entries are checked in sequence order and the first match wins. Anything that matches no entry meets an implicit deny. Leave gaps in the sequence numbers (10, 20, 30) so you can insert entries later.

Illustrative Cisco IOS XE output written for this lesson, not a router capture
R1#show ip prefix-list
ip prefix-list COMPANY-ONLY: 1 entries
   seq 10 permit 198.51.100.0/24
ip prefix-list SMALL-SUBNETS: 1 entries
   seq 10 permit 198.51.100.0/24 ge 25 le 28
Use this to read what is configured. show ip prefix-list detail adds hit counts, which tells you whether a route ever matched an entry.

Route maps: ordered rules

How a route map evaluates one route
How a route map evaluates one routeA route arrives. Sequence 10 checks for a match. If it matches, the set actions run and the route is permitted. If not, sequence 20 is checked, and a match there denies the route. If nothing matches, the implicit deny rejects it.Route arrivesSequence 10Does the route match?yesset local-preference 200route permittednoSequence 20Does the route match?yesdeny sequenceroute rejectednoNo sequence matchedimplicit deny: route rejectedAdd a final permit sequence with no match line to let everything else through.

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Sequences are checked in order and the first match decides. A route that matches nothing is rejected by the implicit deny at the end.

Each route is tested against the sequences in order. The first sequence whose match lines all pass decides: permit accepts it and applies the set lines, deny rejects it. A sequence with no match line matches every route. If no sequence matches, the implicit deny at the end rejects the route.

route-map ISPA-IN permit 10 match ip address prefix-list PROVIDER-ONLY set local-preference 200 route-map ISPA-IN permit 20 set local-preference 100

Sequence 10 raises the preference of the expected provider prefix. Sequence 20 has no match, so it catches everything else and keeps the default. Remove 20 and everything except the provider prefix would be dropped.

Illustrative Cisco IOS XE output written for this lesson, not a router capture
R1#show route-map ISPA-IN
route-map ISPA-IN, permit, sequence 10
  Match clauses:
    ip address prefix-lists: PROVIDER-ONLY
  Set clauses:
    local-preference 200
  Policy routing matches: 0 packets, 0 bytes
route-map ISPA-IN, permit, sequence 20
  Match clauses:
  Set clauses:
    local-preference 100
This is the quickest way to confirm that what you typed became what you meant. An empty match section means the sequence matches every route.

Technical reference: Cisco IOS XE prefix list and route map configuration. Output above is illustrative.

Check your reading

Predict · scenario 1

ip prefix-list P seq 10 permit 198.51.100.0/24 ge 25. Does it match 198.51.100.0/24?

Predict · scenario 2

A route map has one sequence, permit 10, that matches a prefix list. A route does not match. What happens to it?

Predict · scenario 3

You need to match every route with a mask from /24 to /28 inside 198.51.100.0/24, but not the /24 itself. Which entry?

FAQ

What does ge 24 le 26 mean?
The prefix list matches routes inside the stated network whose mask length is between 24 and 26 inclusive. Without ge or le, only the exact length written in the entry matches.
What happens when a route matches no sequence of a route map?
It meets the implicit deny at the end and is rejected. Add a final permit sequence with no match to let everything else through unchanged.
Prefix list or access list for BGP?
Prefix lists compare both the network and its mask length, so they are the right tool for routes. Standard access lists compare only the address, which cannot express length ranges.