BGP · Route Filtering

Extended ACL Route Filtering

Read the network-address and mask fields of an older BGP distribute-list filter.

Decode the four fields

For BGP route filtering, an extended ACL’s source fields describe the advertised network address, and its destination fields describe the subnet mask. They are not packet source and destination addresses in this use.

access-list 100 permit ip NETWORK ADDRESS-WILDCARD MASK MASK-WILDCARD

Field	What is tested
NETWORK + address wildcard	Bits of the destination prefix’s network address.
MASK + mask wildcard	Bits of its subnet mask, which encode prefix length.
Wildcard 0 bit	This bit must equal the configured value.
Wildcard 1 bit	Ignore this bit.

Both tests must pass within one entry. Entries run in order and an unmatched route hits the implicit deny. Prefix lists are generally clearer for new prefix policies; these examples help interpret an existing ACL or a constrained lab task.

Two-router baseline

R2 (AS 65002) originates test networks from connected loopbacks. R1 (AS 65001) applies an inbound distribute list to that one neighbor. Its next hop 192.0.2.2 remains directly connected.

Lab topologyPhysical links

Continuous solid lines are physical links. Interface addresses appear beside the link; each IPv4 link is /30 and the IPv6 link is /64. BGP uses the directly connected addresses.

Complete baseline configurations

R1

hostname R1
ip cef
interface Loopback0
 ip address 10.255.0.1 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.1 255.255.255.252
 no shutdown
exit
router bgp 65001
 bgp router-id 10.255.0.1
 no bgp default ipv4-unicast
 neighbor 192.0.2.2 remote-as 65002
 address-family ipv4 unicast
  no auto-summary
  neighbor 192.0.2.2 activate
 exit-address-family
end

R2

hostname R2
ip cef
interface Loopback0
 ip address 10.255.0.2 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.2 255.255.255.252
 no shutdown
exit
interface Loopback10
 ip address 203.0.113.1 255.255.255.0
exit
interface Loopback11
 ip address 172.16.0.1 255.255.255.0
exit
interface Loopback12
 ip address 192.168.1.1 255.255.255.0
exit
interface Loopback13
 ip address 192.168.2.1 255.255.255.128
exit
interface Loopback14
 ip address 192.168.7.1 255.255.255.248
exit
interface Loopback15
 ip address 192.168.7.9 255.255.255.248
exit
interface Loopback16
 ip address 192.168.7.17 255.255.255.252
exit
interface Loopback17
 ip address 10.1.0.1 255.255.255.0
exit
interface Loopback18
 ip address 10.2.0.1 255.255.255.128
exit
interface Loopback19
 ip address 10.2.0.129 255.255.255.128
exit
interface Loopback20
 ip address 10.3.0.1 255.255.255.192
exit
interface Loopback21
 ip address 10.4.0.1 255.255.255.224
exit
interface Loopback22
 ip address 10.5.0.1 255.255.255.240
exit
interface Loopback23
 ip address 172.16.1.1 255.255.255.192
exit
interface Loopback24
 ip address 172.16.2.1 255.255.255.224
exit
interface Loopback25
 ip address 172.16.3.1 255.255.255.240
exit
interface Loopback26
 ip address 172.16.4.1 255.255.255.248
exit
interface Loopback27
 ip address 172.16.5.1 255.255.255.252
exit
interface Loopback28
 ip address 172.16.6.1 255.255.255.255
exit
router bgp 65002
 bgp router-id 10.255.0.2
 no bgp default ipv4-unicast
 neighbor 192.0.2.1 remote-as 65001
 address-family ipv4 unicast
  no auto-summary
  neighbor 192.0.2.1 activate
  network 203.0.113.0 mask 255.255.255.0
  network 172.16.0.0 mask 255.255.255.0
  network 192.168.1.0 mask 255.255.255.0
  network 192.168.2.0 mask 255.255.255.128
  network 192.168.7.0 mask 255.255.255.248
  network 192.168.7.8 mask 255.255.255.248
  network 192.168.7.16 mask 255.255.255.252
  network 10.1.0.0 mask 255.255.255.0
  network 10.2.0.0 mask 255.255.255.128
  network 10.2.0.128 mask 255.255.255.128
  network 10.3.0.0 mask 255.255.255.192
  network 10.4.0.0 mask 255.255.255.224
  network 10.5.0.0 mask 255.255.255.240
  network 172.16.1.0 mask 255.255.255.192
  network 172.16.2.0 mask 255.255.255.224
  network 172.16.3.0 mask 255.255.255.240
  network 172.16.4.0 mask 255.255.255.248
  network 172.16.5.0 mask 255.255.255.252
  network 172.16.6.1 mask 255.255.255.255
 exit-address-family
end

Outputs are illustrative, not recorded router results. Start each independent experiment from the stated baseline. Allow routing updates to converge after a policy refresh.

All baseline routes on R1

R1# show ip bgp
     Network          Next Hop        Metric LocPrf Weight Path
*>   203.0.113.0/24   192.0.2.2            0             0 65002 i
*>   172.16.0.0/24    192.0.2.2            0             0 65002 i
*>   192.168.1.0/24   192.0.2.2            0             0 65002 i
*>   192.168.2.0/25   192.0.2.2            0             0 65002 i
*>   192.168.7.0/29   192.0.2.2            0             0 65002 i
*>   192.168.7.8/29   192.0.2.2            0             0 65002 i
*>   192.168.7.16/30  192.0.2.2            0             0 65002 i
*>   10.1.0.0/24      192.0.2.2            0             0 65002 i
*>   10.2.0.0/25      192.0.2.2            0             0 65002 i
*>   10.2.0.128/25    192.0.2.2            0             0 65002 i
*>   10.3.0.0/26      192.0.2.2            0             0 65002 i
*>   10.4.0.0/27      192.0.2.2            0             0 65002 i
*>   10.5.0.0/28      192.0.2.2            0             0 65002 i
*>   172.16.1.0/26    192.0.2.2            0             0 65002 i
*>   172.16.2.0/27    192.0.2.2            0             0 65002 i
*>   172.16.3.0/28    192.0.2.2            0             0 65002 i
*>   172.16.4.0/29    192.0.2.2            0             0 65002 i
*>   172.16.5.0/30    192.0.2.2            0             0 65002 i
*>   172.16.6.1/32    192.0.2.2            0             0 65002 i

Each exercise replaces ACL 100 completely, rather than accumulating permits from previous exercises. Here “permit” means keep the shown routes; all other advertised lab routes are excluded.

Permit three exact prefixes

Both address and mask must match exactly. Three permit entries form an allowlist; the implicit deny excludes every other route.

no access-list 100
access-list 100 permit ip 203.0.113.0 0.0.0.0 255.255.255.0 0.0.0.0
access-list 100 permit ip 172.16.0.0 0.0.0.0 255.255.255.0 0.0.0.0
access-list 100 permit ip 192.168.1.0 0.0.0.0 255.255.255.0 0.0.0.0
router bgp 65001
 address-family ipv4 unicast
  neighbor 192.0.2.2 distribute-list 100 in
 exit-address-family

R1# clear ip bgp 192.0.2.2 soft in

R1# show ip bgp
     Network          Next Hop        Metric LocPrf Weight Path
*>   203.0.113.0/24   192.0.2.2            0             0 65002 i
*>   172.16.0.0/24    192.0.2.2            0             0 65002 i
*>   192.168.1.0/24   192.0.2.2            0             0 65002 i

3 of the 19 test prefixes pass this independent allowlist.

Equivalent prefix-list expression for canonical prefixes

ip prefix-list SAME seq 5 permit 203.0.113.0/24
ip prefix-list SAME seq 10 permit 172.16.0.0/24
ip prefix-list SAME seq 15 permit 192.168.1.0/24

Permit 192.168.x.0 at /24

The first two address octets and the last zero octet are fixed. Only the third octet varies, and the mask is exactly /24.

no access-list 100
access-list 100 permit ip 192.168.0.0 0.0.255.0 255.255.255.0 0.0.0.0
router bgp 65001
 address-family ipv4 unicast
  neighbor 192.0.2.2 distribute-list 100 in
 exit-address-family

R1# clear ip bgp 192.0.2.2 soft in

R1# show ip bgp
     Network          Next Hop        Metric LocPrf Weight Path
*>   192.168.1.0/24   192.0.2.2            0             0 65002 i

1 of the 19 test prefixes pass this independent allowlist.

Equivalent prefix-list expression for canonical prefixes

ip prefix-list SAME seq 5 permit 192.168.0.0/16 ge 24 le 24

Permit 10.x.x.0 at /24

The address must start with 10 and end in .0. An exact /24 mask excludes the /25 and longer prefixes.

no access-list 100
access-list 100 permit ip 10.0.0.0 0.255.255.0 255.255.255.0 0.0.0.0
router bgp 65001
 address-family ipv4 unicast
  neighbor 192.0.2.2 distribute-list 100 in
 exit-address-family

R1# clear ip bgp 192.0.2.2 soft in

R1# show ip bgp
     Network          Next Hop        Metric LocPrf Weight Path
*>   10.1.0.0/24      192.0.2.2            0             0 65002 i

1 of the 19 test prefixes pass this independent allowlist.

Equivalent prefix-list expression for canonical prefixes

ip prefix-list SAME seq 5 permit 10.0.0.0/8 ge 24 le 24

Permit all 10/8 subnets at /25

Any canonical network address within 10/8 is eligible, but its mask must be /25. Both the .0 and .128 halves match.

no access-list 100
access-list 100 permit ip 10.0.0.0 0.255.255.255 255.255.255.128 0.0.0.0
router bgp 65001
 address-family ipv4 unicast
  neighbor 192.0.2.2 distribute-list 100 in
 exit-address-family

R1# clear ip bgp 192.0.2.2 soft in

R1# show ip bgp
     Network          Next Hop        Metric LocPrf Weight Path
*>   10.2.0.0/25      192.0.2.2            0             0 65002 i
*>   10.2.0.128/25    192.0.2.2            0             0 65002 i

2 of the 19 test prefixes pass this independent allowlist.

Equivalent prefix-list expression for canonical prefixes

ip prefix-list SAME seq 5 permit 10.0.0.0/8 ge 25 le 25

Permit 192.168.7.x network addresses at any length

The source wildcard restricts the network address to the 192.168.7.x range; all mask bits are ignored. For canonical prefixes in this range, this selects /24 and longer subnets, not a covering /23 whose address is 192.168.6.0.

no access-list 100
access-list 100 permit ip 192.168.7.0 0.0.0.255 0.0.0.0 255.255.255.255
router bgp 65001
 address-family ipv4 unicast
  neighbor 192.0.2.2 distribute-list 100 in
 exit-address-family

R1# clear ip bgp 192.0.2.2 soft in

R1# show ip bgp
     Network          Next Hop        Metric LocPrf Weight Path
*>   192.168.7.0/29   192.0.2.2            0             0 65002 i
*>   192.168.7.8/29   192.0.2.2            0             0 65002 i
*>   192.168.7.16/30  192.0.2.2            0             0 65002 i

3 of the 19 test prefixes pass this independent allowlist.

Equivalent prefix-list expression for canonical prefixes

ip prefix-list SAME seq 5 permit 192.168.7.0/24 le 32

Permit any prefix at /24 through /32

Ignore all network-address bits. Require the first 24 mask bits to be ones and ignore the last eight. Valid contiguous subnet masks therefore span /24–/32.

no access-list 100
access-list 100 permit ip 0.0.0.0 255.255.255.255 255.255.255.0 0.0.0.255
router bgp 65001
 address-family ipv4 unicast
  neighbor 192.0.2.2 distribute-list 100 in
 exit-address-family

R1# clear ip bgp 192.0.2.2 soft in

R1# show ip bgp
     Network          Next Hop        Metric LocPrf Weight Path
*>   203.0.113.0/24   192.0.2.2            0             0 65002 i
*>   172.16.0.0/24    192.0.2.2            0             0 65002 i
*>   192.168.1.0/24   192.0.2.2            0             0 65002 i
*>   192.168.2.0/25   192.0.2.2            0             0 65002 i
*>   192.168.7.0/29   192.0.2.2            0             0 65002 i
*>   192.168.7.8/29   192.0.2.2            0             0 65002 i
*>   192.168.7.16/30  192.0.2.2            0             0 65002 i
*>   10.1.0.0/24      192.0.2.2            0             0 65002 i
*>   10.2.0.0/25      192.0.2.2            0             0 65002 i
*>   10.2.0.128/25    192.0.2.2            0             0 65002 i
*>   10.3.0.0/26      192.0.2.2            0             0 65002 i
*>   10.4.0.0/27      192.0.2.2            0             0 65002 i
*>   10.5.0.0/28      192.0.2.2            0             0 65002 i
*>   172.16.1.0/26    192.0.2.2            0             0 65002 i
*>   172.16.2.0/27    192.0.2.2            0             0 65002 i
*>   172.16.3.0/28    192.0.2.2            0             0 65002 i
*>   172.16.4.0/29    192.0.2.2            0             0 65002 i
*>   172.16.5.0/30    192.0.2.2            0             0 65002 i
*>   172.16.6.1/32    192.0.2.2            0             0 65002 i

19 of the 19 test prefixes pass this independent allowlist.

Equivalent prefix-list expression for canonical prefixes

ip prefix-list SAME seq 5 permit 0.0.0.0/0 ge 24 le 32

Permit any prefix at /26 through /32

The mask check fixes the first 26 bits to ones. Its remaining six bits can vary, giving valid lengths /26–/32.

no access-list 100
access-list 100 permit ip 0.0.0.0 255.255.255.255 255.255.255.192 0.0.0.63
router bgp 65001
 address-family ipv4 unicast
  neighbor 192.0.2.2 distribute-list 100 in
 exit-address-family

R1# clear ip bgp 192.0.2.2 soft in

R1# show ip bgp
     Network          Next Hop        Metric LocPrf Weight Path
*>   192.168.7.0/29   192.0.2.2            0             0 65002 i
*>   192.168.7.8/29   192.0.2.2            0             0 65002 i
*>   192.168.7.16/30  192.0.2.2            0             0 65002 i
*>   10.3.0.0/26      192.0.2.2            0             0 65002 i
*>   10.4.0.0/27      192.0.2.2            0             0 65002 i
*>   10.5.0.0/28      192.0.2.2            0             0 65002 i
*>   172.16.1.0/26    192.0.2.2            0             0 65002 i
*>   172.16.2.0/27    192.0.2.2            0             0 65002 i
*>   172.16.3.0/28    192.0.2.2            0             0 65002 i
*>   172.16.4.0/29    192.0.2.2            0             0 65002 i
*>   172.16.5.0/30    192.0.2.2            0             0 65002 i
*>   172.16.6.1/32    192.0.2.2            0             0 65002 i

12 of the 19 test prefixes pass this independent allowlist.

Equivalent prefix-list expression for canonical prefixes

ip prefix-list SAME seq 5 permit 0.0.0.0/0 ge 26 le 32

Permit 172.16/16 subnets at /27 through /32

Combine an address-range constraint with a mask constraint. The first two address octets identify 172.16/16; the first 27 mask bits must be ones.

no access-list 100
access-list 100 permit ip 172.16.0.0 0.0.255.255 255.255.255.224 0.0.0.31
router bgp 65001
 address-family ipv4 unicast
  neighbor 192.0.2.2 distribute-list 100 in
 exit-address-family

R1# clear ip bgp 192.0.2.2 soft in

R1# show ip bgp
     Network          Next Hop        Metric LocPrf Weight Path
*>   172.16.2.0/27    192.0.2.2            0             0 65002 i
*>   172.16.3.0/28    192.0.2.2            0             0 65002 i
*>   172.16.4.0/29    192.0.2.2            0             0 65002 i
*>   172.16.5.0/30    192.0.2.2            0             0 65002 i
*>   172.16.6.1/32    192.0.2.2            0             0 65002 i

5 of the 19 test prefixes pass this independent allowlist.

Equivalent prefix-list expression for canonical prefixes

ip prefix-list SAME seq 5 permit 172.16.0.0/16 ge 27 le 32

Restore and verify

router bgp 65001
 address-family ipv4 unicast
  no neighbor 192.0.2.2 distribute-list 100 in
 exit-address-family

R1# clear ip bgp 192.0.2.2 soft in

R1# show ip bgp | include 203.0.113.0|172.16.0.0|192.168.1.0
     Network          Next Hop        Metric LocPrf Weight Path
*>   203.0.113.0/24   192.0.2.2            0             0 65002 i
*>   172.16.0.0/24    192.0.2.2            0             0 65002 i
*>   192.168.1.0/24   192.0.2.2            0             0 65002 i

R1# show ip route 203.0.113.0
Routing entry for 203.0.113.0/24
  Known via "bgp 65001", distance 20, metric 0
  * 192.0.2.2, via GigabitEthernet1

The unfiltered advertisements return. Check the IP route independently: a best BGP entry does not by itself prove installation. A RIB-failure on a particular software image needs its own diagnosis; do not infer from it that all BGP ACLs must permit the neighbor address as a destination prefix.

Key Takeaways

For BGP distribute lists, extended ACL fields test prefix network and subnet mask.
Zero wildcard bits require equality; one bits are ignored.
Address and mask tests must both pass within an entry.
A mask wildcard can select a range of valid prefix lengths.
Independent experiments must replace the previous ACL instead of accumulating permits.

Protocol and command references

AS-path regular expressions · Prefix and access-list route filters · Policy processing order · Router-symbol attribution.

← AS Path Filtering Route Dampening →