How do prefix lists work for BGP filtering, and what do ge and le mean?
Show the answer
Say this first
A prefix list matches both the network bits and the prefix length, which is why it beats an ACL for routes.
permit 10.0.0.0/8 matches exactly that /8. le 24 extends the match to longer prefixes inside the range, up
to /24; ge 25 sets a minimum length. Entries are checked in sequence order, the first match wins, and an
implicit deny sits at the end. I apply them with neighbor x prefix-list NAME in|out or inside a route map.
Go deeper
| Entry | Matches |
|---|---|
permit 0.0.0.0/0 | The default route only |
permit 0.0.0.0/0 le 32 | Everything |
permit 0.0.0.0/0 le 24 | Everything from /0 to /24: a typical internet filter |
deny 10.0.0.0/8 le 32 | 10.0.0.0/8 and every subnet of it |
permit 203.0.113.0/24 ge 25 le 26 | The /25s and /26s inside 203.0.113.0/24, not the /24 itself |
The lengths must satisfy: prefix length < ge <= le <= 32.
Inbound bogon filter (start of one)
ip prefix-list FROM-ISP seq 5 deny 0.0.0.0/8 le 32
ip prefix-list FROM-ISP seq 10 deny 10.0.0.0/8 le 32
ip prefix-list FROM-ISP seq 15 deny 100.64.0.0/10 le 32
ip prefix-list FROM-ISP seq 20 deny 127.0.0.0/8 le 32
ip prefix-list FROM-ISP seq 25 deny 169.254.0.0/16 le 32
ip prefix-list FROM-ISP seq 30 deny 172.16.0.0/12 le 32
ip prefix-list FROM-ISP seq 35 deny 192.168.0.0/16 le 32
ip prefix-list FROM-ISP seq 40 deny 224.0.0.0/3 le 32
ip prefix-list FROM-ISP seq 100 permit 0.0.0.0/0 le 24224.0.0.0/3 covers multicast and the old class E space. In production, the list also covers the documentation ranges that these examples use as if they were real.
After changing a prefix list on IOS, run clear ip bgp 192.0.2.1 soft in so it is applied to routes already
received.
They will ask next
Why not use an access list to filter routes?
A standard ACL matches only the network bits, so it cannot tell 10.0.0.0/8 from 10.0.0.0/24. Extended ACLs can be bent to match the mask too, but it is awkward. Prefix lists were made for this.
How do you filter on where a route came from instead of what it is?
With an AS path access list matched by regular expression, applied with
filter-listormatch as-path.
Traps
- Thinking
le 24alone means "exactly /24". It means any length from the prefix length up to 24. - Forgetting the implicit deny when you add a list meant only to block a few prefixes.