Why use a prefix list instead of an ACL to filter routes?
Show the answer
Say this first
An ACL used for route filtering only looks at the network address, so it cannot tell 10.1.0.0/16 from 10.1.0.0/24. A prefix list matches the address and the prefix length, with ge and le for length ranges. It is also easier to read, editable by sequence number and built for this job. ACLs remain the tool for filtering packets; prefix lists never touch traffic.
Go deeper
Same intent, different results
access-list 10 permit 10.0.0.0 0.255.255.255
ip prefix-list ONLY-SLASH8 seq 5 permit 10.0.0.0/8
ip prefix-list ALL-OF-10 seq 5 permit 10.0.0.0/8 le 32| Route | ACL 10 | ONLY-SLASH8 | ALL-OF-10 |
|---|---|---|---|
| 10.0.0.0/8 | match | match | match |
| 10.1.0.0/16 | match | no | match |
| 10.1.0.0/24 | match | no | match |
| 172.16.0.0/16 | no | no | no |
Why prefix lists win for routes
- They match length, which is what you usually care about (block anything longer than /24 from an ISP).
- Sequence numbers let you insert and delete single lines.
show ip prefix-list detailshows hit counts per line.
The old workaround
In BGP and redistribution, an extended ACL can match length by using the source field for the network and the destination field for the mask. It works, nobody can read it, and prefix lists replaced it.
They will ask next
Can a prefix list filter packets on an interface?
No. Prefix lists only match routes. For traffic you use ACLs, and a route-map for PBR matches packets with an ACL.
Traps
- Saying ACLs are faster or more capable for route filtering. They lack the length check.
How did you do?Book 3.4 Routing