Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

AS-Path Filtering Using BGP

I have two E3 connection to AS4788 and AS9933;

what is the configuration like if I want to do a filtering base on AS_Path? I just want to accept the ip prefixes originated from AS4788 and all the ASs that have direct connection to AS4788. The rest, I would like to block.

1 ACCEPTED SOLUTION

Accepted Solutions
Silver

Re: AS-Path Filtering Using BGP

Use the following as-path access-list

ip as-path access-list 1 permit ^4788$

ip as-path access-list 1 permit ^4788_[0-9]+$

The first line matches routes originating from AS 4788 and the second macthes an AS connected to AS 4788.

Hope this helps

5 REPLIES
New Member

Re: AS-Path Filtering Using BGP

Hi,

the filter should be like this;

ip as-path access-list 1 permit ^4788$

ip as-path access-list 1 permit _4788$

first statement permits directly connected perfixes to AS4788, second one permits prefixes those originated in AS4788. there is an implicit deny at the end, so all prefixes except you permitted above will be denied.

hope this helps

New Member

Re: AS-Path Filtering Using BGP

This was what I implemented:

ip as-path access-list 104 permit ^4788$

ip as-path access-list 104 permit _4788$

route-map itt_in-ISP permit 10

match as-path 104

!

However, when I did a sh ip bgp, I got this:

61.94.195.0/24 203.121.17.63 0 4788 701 3549 9304 7632 7713 17974 ?

*> 62.152.64.0/19 203.121.17.63 0 4788 2914 35422 13062 i

*> 64.82.192.0/18 203.121.17.63 0 4788 1239 20115 20115 20115 27419 i

*> 64.82.216.0/22 203.121.17.63 0 4788 1239 20115 20115 20115 18812 i

*> 64.82.234.0/24 203.121.17.63 0 4788 1239 20115 20115 20115 18812 i

How come I still have those ASs that have no direct connection to AS1238?

New Member

Re: AS-Path Filtering Using BGP

Please ignore the message above. In fact, when I implemented the filter, the ip prefixes just stop coming in..why is that so?

Silver

Re: AS-Path Filtering Using BGP

Since you are directly connected to AS 4788, the two lines would reduce to routes from AS4788. In your situation, I guess that the provider of AS 4788 is not advertising any of her prefixes to you.

Note the meaning of the meta charaters

^ matches the beginning of the line

$ matches the end of a line

_ (underscore) matches a comma, the beginning of a line, end of a line or a space.

Hence the first line of the access list matches route with AS path 4788. Hence originated from AS 4788.

The second line matches any AS path which ends with AS 4788 (the underscore makes it specific to AS 4788). But because you are directly connected to AS 4788, the only routes that can be mathched are routes from AS 4788 itself.

Silver

Re: AS-Path Filtering Using BGP

Use the following as-path access-list

ip as-path access-list 1 permit ^4788$

ip as-path access-list 1 permit ^4788_[0-9]+$

The first line matches routes originating from AS 4788 and the second macthes an AS connected to AS 4788.

Hope this helps

171
Views
3
Helpful
5
Replies