Explain the ge and le keywords in a prefix list with examples.
Show the answer
Say this first
An entry is prefix/len plus an optional length range. The first len bits of the route must match the
prefix. With no ge or le, the route length must equal len exactly. ge n allows lengths from n to 32,
le n allows lengths from len to n, and both together give a range. The rule is len < ge <= le <= 32.
Every list ends with an implicit deny, and 0.0.0.0/0 le 32 means any route.
Go deeper
Worked examples
| Entry | Matches | Does not match |
|---|---|---|
permit 10.0.0.0/8 | 10.0.0.0/8 only | 10.20.0.0/16 |
permit 10.0.0.0/8 le 24 | 10.0.0.0/8, 10.20.0.0/16, 10.20.30.0/24 | 10.20.30.128/25, 11.0.0.0/8 |
permit 10.0.0.0/8 ge 24 | 10.20.30.0/24, 10.20.30.128/25, 10.1.1.1/32 | 10.0.0.0/8, 10.20.0.0/16 |
permit 10.0.0.0/8 ge 16 le 24 | 10.20.0.0/16, 10.20.30.0/24 | 10.0.0.0/8, 10.20.30.128/25 |
permit 192.168.0.0/16 ge 24 le 24 | every /24 inside 192.168.0.0/16 | 192.168.0.0/16, 192.168.1.0/25 |
permit 0.0.0.0/0 | the default route only | everything else |
permit 0.0.0.0/0 le 32 | every route | nothing |
deny 0.0.0.0/0 ge 25 | (denies) anything longer than /24 | /24 and shorter pass to the next line |
A real inbound filter from an ISP
ip prefix-list FROM-ISP seq 5 deny 0.0.0.0/0 ge 25
ip prefix-list FROM-ISP seq 10 deny 10.0.0.0/8 le 32
ip prefix-list FROM-ISP seq 15 deny 172.16.0.0/12 le 32
ip prefix-list FROM-ISP seq 20 deny 192.168.0.0/16 le 32
ip prefix-list FROM-ISP seq 25 permit 0.0.0.0/0 le 24
!
router bgp 64500
address-family ipv4
neighbor 203.0.113.1 prefix-list FROM-ISP inDrop anything longer than /24, drop RFC 1918 space at any length, accept the rest including the default.
Reading one entry out loud
10.0.0.0/8 ge 16 le 24: "anything inside 10/8 whose length is between 16 and 24".
They will ask next
How do you see which lines are being hit?
show ip prefix-list detail FROM-ISPlists each sequence with its hit count.Is there an IPv6 version?
Yes,
ipv6 prefix-listwith the same logic, lengths up to 128. For exampleipv6 prefix-list FROM-ISP6 seq 5 deny ::/0 ge 49drops anything longer than /48.
Traps
- Thinking
10.0.0.0/8 ge 24includes the /8. The length must be 24 or more. - Forgetting the implicit deny and losing every route not listed.