BGP · Route Filtering

AS Path Filtering

Turn a tested AS-path expression into an explicit neighbor acceptance policy.

Inspect the path dataset

R1 (AS 65001) receives the following constructed routes from a neighbor in AS 65020 at 192.0.2.2. The sample stands in for a looking-glass table: it is not a claim about current public routes. The policies below run inbound on R1, and each experiment replaces the previous one.

R1# show ip bgp
     Network          Next Hop        Metric LocPrf Weight Path
*>   198.51.100.0/26  192.0.2.2            0             0 65020 i
*>   198.51.100.64/26 192.0.2.2            0             0 65020 65030 i
*>   198.51.100.128/26
                      192.0.2.2            0             0 65020 65030 65040 i
*>   198.51.100.192/26
                      192.0.2.2            0             0 65020 65040 i
*>   203.0.113.0/25   192.0.2.2            0             0 65020 65020 i
*>   203.0.113.128/25 192.0.2.2            0             0 65020 65030 65040 65040 i

An AS-path access list uses first-match processing and an implicit final deny. In a route-map match clause, an ACL deny means “this clause did not match”; later route-map clauses may still accept that route. The examples deliberately contain only the matching permit clause.

Permit an exact single-AS path

no ip as-path access-list 10
ip as-path access-list 10 permit ^65020$
route-map PATH-IN permit 10
 match as-path 10
exit
router bgp 65001
 address-family ipv4 unicast
  neighbor 192.0.2.2 route-map PATH-IN in
 exit-address-family

R1# clear ip bgp 192.0.2.2 soft in

R1# show ip bgp regexp ^65020$
     Network          Next Hop        Metric LocPrf Weight Path
*>   198.51.100.0/26  192.0.2.2            0             0 65020 i

Only the one-token path survives. This is stricter than “origin AS 65020”: the prepended 65020 65020 route also originates there but fails the exact expression. An origin-only search would use _65020$.

Match an AS anywhere

no ip as-path access-list 10
ip as-path access-list 10 permit _65030_
route-map PATH-IN permit 10
 match as-path 10
exit
router bgp 65001
 address-family ipv4 unicast
  neighbor 192.0.2.2 route-map PATH-IN in
 exit-address-family

R1# clear ip bgp 192.0.2.2 soft in

R1# show ip bgp
     Network          Next Hop        Metric LocPrf Weight Path
*>   198.51.100.64/26 192.0.2.2            0             0 65020 65030 i
*>   198.51.100.128/26
                      192.0.2.2            0             0 65020 65030 65040 i
*>   203.0.113.128/25 192.0.2.2            0             0 65020 65030 65040 65040 i

The three accepted paths contain a complete 65030 token. No anchor restricts its position. This rule does not match a partial number such as 165030.

Reject one origin

no ip as-path access-list 10
ip as-path access-list 10 deny _65040$
ip as-path access-list 10 permit .*
route-map PATH-IN permit 10
 match as-path 10
exit
router bgp 65001
 address-family ipv4 unicast
  neighbor 192.0.2.2 route-map PATH-IN in
 exit-address-family

R1# clear ip bgp 192.0.2.2 soft in

R1# show ip bgp
     Network          Next Hop        Metric LocPrf Weight Path
*>   198.51.100.0/26  192.0.2.2            0             0 65020 i
*>   198.51.100.64/26 192.0.2.2            0             0 65020 65030 i
*>   203.0.113.0/25   192.0.2.2            0             0 65020 65020 i

Reject paths ending in origin 65040, including the prepended origin. Permit everything else explicitly; omitting the final permit would deny all remaining paths as well.

Limit path depth

no ip as-path access-list 10
ip as-path access-list 10 permit ^65020$
ip as-path access-list 10 permit ^65020_[0-9]+$
route-map PATH-IN permit 10
 match as-path 10
exit
router bgp 65001
 address-family ipv4 unicast
  neighbor 192.0.2.2 route-map PATH-IN in
 exit-address-family

R1# clear ip bgp 192.0.2.2 soft in

R1# show ip bgp
     Network          Next Hop        Metric LocPrf Weight Path
*>   198.51.100.0/26  192.0.2.2            0             0 65020 i
*>   198.51.100.64/26 192.0.2.2            0             0 65020 65030 i
*>   198.51.100.192/26
                      192.0.2.2            0             0 65020 65040 i
*>   203.0.113.0/25   192.0.2.2            0             0 65020 65020 i

Accept a one-token path or exactly one token after 65020. The prepended 65020 65020 path fits this text pattern too. Thus two tokens do not necessarily mean two distinct networks, and this rule is not a cryptographic assertion of a commercial customer relationship.

Restore baseline policy

router bgp 65001
 address-family ipv4 unicast
  no neighbor 192.0.2.2 route-map PATH-IN in
 exit-address-family

R1# clear ip bgp 192.0.2.2 soft in

R1# show ip bgp
     Network          Next Hop        Metric LocPrf Weight Path
*>   198.51.100.0/26  192.0.2.2            0             0 65020 i
*>   198.51.100.64/26 192.0.2.2            0             0 65020 65030 i
*>   198.51.100.128/26
                      192.0.2.2            0             0 65020 65030 65040 i
*>   198.51.100.192/26
                      192.0.2.2            0             0 65020 65040 i
*>   203.0.113.0/25   192.0.2.2            0             0 65020 65020 i
*>   203.0.113.128/25 192.0.2.2            0             0 65020 65030 65040 65040 i

The policy detaches cleanly and the six sample routes return after a successful route refresh. A show regexp query alone would never have removed them.

Key Takeaways

Test expressions against representative paths before attaching a neighbor policy.
An AS-path list uses ordered matching and a final implicit deny.
Origin-only and exact single-token matching are different.
A deny in a route-map match list is not itself an immediate global rejection.
Token count does not establish the number of distinct ASes or a business relationship.

Protocol and command references

AS-path regular expressions · Prefix and access-list route filters · Policy processing order · Router-symbol attribution.

← IPv6 Route Filtering Extended ACL Route Filtering →