access-list for bgp

[annayuzhao]

the following is the configration from tcp/ip volume II

router bgp 100

aggregate-address 192.168.192.0 255.255.248.0

redistribute eigrp 100

neighbor 192.168.1.253 remote-as 200

neighbor 192.168.1.253 send-community

neighbor 192.168.1.253 route-map yu out

access-list 101 permit ip host 192.168.192.0 host 255.255.248.0

route-map yu permit 10

match ip address 101

set community none

route-map yu permit 20

set community no-export

Can anyone explain this statment "access-list 101 permit ip host 192.168.192.0 host 255.255.248.0"

thank you!

[Harold Ritter]

The behavior of an ACL entry is a bit different in a route-map context. This ACL entry that you use in your configuration will match if the prefix is exactly 192.168.192.0 and the mask is exactly 255.255.248.0.

Any other combinaison would not match.

Hope this helps,

[leowchongwei]

Hi hritter,

meaning to say hosts in the segment 192.168.193.0 will not be matched?

[Harold Ritter · Accepted solution]

The host keyword in this context indicates that all bit have to match. Bear in mind that this ACL has for purpose to filter routes not traffic. In this context, the first pair of refers to the prefix that you want to filter. The second pair refers to the subnet mask.

access-list 101 permit ip host 192.168.192.0 host 255.255.248.0

is equivalent to

access-list 101 permit ip 192.168.192.0 0.0.0.0.0 255.255.248.0 0.0.0.0.0

so the only prefix that will match the ACL is 192.168.192.0/21

192.168.192.0/24 would not match even though the prefix matches since the prefix lenght doesn't.

Hope this helps,

[libincisco]

it is the same as the prefix-list command

ip prefix-list a permit 192.168.192.0/21