How do AS path access lists and regular expressions work? Give me the common patterns.
Show the answer
Say this first
An AS path access list (ip as-path access-list) matches the AS_PATH as a string using a regular expression,
and is applied with neighbor x filter-list N in|out or match as-path in a route map. The patterns everyone
uses: ^$ is my own routes (empty path), ^64496_ came in from neighbor 64496, _64496$ was originated by
64496, ^64496$ was originated by 64496 and learned directly from it, _64496_ passed through 64496
anywhere, and .* matches everything.
Go deeper
Characters
| Symbol | Meaning |
|---|---|
^ $ | Start and end of the path |
_ | Any delimiter: space, comma, brace, start or end of string |
. | Any single character |
* + ? | Zero or more, one or more, zero or one of the previous item |
[0-9] | One character from a range |
( ) ` | ` |
Patterns
| Regex | Matches |
|---|---|
^$ | Locally originated routes |
.* | Any path |
^64496$ | Originated by directly connected AS 64496 |
^64496_ | Learned from 64496 |
_64496$ | Originated by 64496, from anywhere |
_64496_ | 64496 anywhere in the path |
^64496_[0-9]+$ | One AS behind 64496: its direct customers |
^64500(_64500)*$ | Originated by 64500, with any number of prepends |
^[0-9]+$ | Originated by whichever neighbor sent it |
Test before you apply
R1# show ip bgp regexp ^64496_[0-9]+$Then apply:
ip as-path access-list 10 permit ^64496_[0-9]+$
ip as-path access-list 10 permit ^64496$
!
router bgp 64500
neighbor 192.0.2.1 filter-list 10 inLike prefix lists, AS path access lists end with an implicit deny.
Junos
Junos AS path regex works on whole AS numbers, not characters: . is any one AS, so 64496 .* means learned
from 64496.
They will ask next
Why use the underscore instead of a space?
Because the path can begin or end at that point, or contain AS_SET braces and commas.
_matches all of those, so_64496_catches 64496 at the start, middle or end.What goes wrong with
^6449?It matches any path starting with an ASN that begins with 6449: 64496, 64497, 644990 and so on. Anchor the whole number with
_or$.
Traps
- Writing
64496with no anchors, which matches 164496 or 644961 as well.