BGP · Route Filtering

IPv6 Route Filtering

Match destination prefixes, AS paths and route-map clauses inside the IPv6 address family.

Establish the baseline

R1 (AS 65001) sends four loopback networks to R2 (AS 65002): three /64s and one /96. Use IPv6 unicast activation explicitly; enabling a neighbor globally does not activate every address family.

Lab topologyPhysical links

Continuous solid lines are physical links. Interface addresses appear beside the link; each IPv4 link is /30 and the IPv6 link is /64. BGP uses the directly connected addresses.

Complete baseline configurations

R1

hostname R1
ipv6 unicast-routing
interface GigabitEthernet1
 ipv6 address 2001:db8:0:12::1/64
 ipv6 address FE80::1 link-local
 no shutdown
exit
interface Loopback10
 ipv6 address 2001:db8:0:1::1/64
exit
interface Loopback11
 ipv6 address 2001:db8:0:11::1/64
exit
interface Loopback12
 ipv6 address 2001:db8:0:111::1/64
exit
interface Loopback13
 ipv6 address 2001:db8:0:1111::1/96
exit
router bgp 65001
 bgp router-id 10.255.0.1
 no bgp default ipv4-unicast
 neighbor 2001:db8:0:12::2 remote-as 65002
 address-family ipv6 unicast
  neighbor 2001:db8:0:12::2 activate
  network 2001:db8:0:1::/64
  network 2001:db8:0:11::/64
  network 2001:db8:0:111::/64
  network 2001:db8:0:1111::/96
 exit-address-family
end

R2

hostname R2
ipv6 unicast-routing
interface GigabitEthernet1
 ipv6 address 2001:db8:0:12::2/64
 ipv6 address FE80::2 link-local
 no shutdown
exit
router bgp 65002
 bgp router-id 10.255.0.2
 no bgp default ipv4-unicast
 neighbor 2001:db8:0:12::1 remote-as 65001
 address-family ipv6 unicast
  neighbor 2001:db8:0:12::1 activate
 exit-address-family
end

Outputs are illustrative, not recorded router results. Start each independent experiment from the stated baseline. Allow routing updates to converge after a policy refresh.

R2# show bgp ipv6 unicast
     Network                         Next Hop                  Path
*>   2001:db8:0:1::/64               2001:db8:0:12::1          65001 i
*>   2001:db8:0:11::/64              2001:db8:0:12::1          65001 i
*>   2001:db8:0:111::/64             2001:db8:0:12::1          65001 i
*>   2001:db8:0:1111::/96            2001:db8:0:12::1          65001 i

R2# show ipv6 route bgp
B   2001:DB8:0:1::/64 [20/0]
     via FE80::1, GigabitEthernet1
B   2001:DB8:0:11::/64 [20/0]
     via FE80::1, GigabitEthernet1
B   2001:DB8:0:111::/64 [20/0]
     via FE80::1, GigabitEthernet1
B   2001:DB8:0:1111::/96 [20/0]
     via FE80::1, GigabitEthernet1

The BGP and forwarding views can display global and link-local next hops differently. The explicitly configured link-local address makes the illustrated forwarding output reproducible.

Limit accepted prefix lengths

On R2, permit subnets of the documentation /32 whose lengths run from /32 through /64. The /96 is more specific and fails the maximum-length test.

ipv6 prefix-list UPSTREAM-LENGTH seq 5 permit 2001:db8::/32 le 64

router bgp 65002
 address-family ipv6 unicast
  neighbor 2001:db8:0:12::1 prefix-list UPSTREAM-LENGTH in
 exit-address-family

R2# clear bgp ipv6 unicast 2001:db8:0:12::1 soft in

R2# show bgp ipv6 unicast
     Network                         Next Hop                  Path
*>   2001:db8:0:1::/64               2001:db8:0:12::1          65001 i
*>   2001:db8:0:11::/64              2001:db8:0:12::1          65001 i
*>   2001:db8:0:111::/64             2001:db8:0:12::1          65001 i

Without ge/le, a prefix-list permit is an exact network-and-length match. With le 64, smaller numerical lengths through 64 are permitted within the base; /96 is not.

Filter an AS path

Leave the prefix-length filter active. On R1, prepend one extra copy of its own AS only to the first /64, while passing other routes unchanged.

ipv6 prefix-list FIRST seq 5 permit 2001:db8:0:1::/64
route-map PREPEND-FIRST permit 10
 match ipv6 address prefix-list FIRST
 set as-path prepend 65001
exit
route-map PREPEND-FIRST permit 20
exit

router bgp 65001
 address-family ipv6 unicast
  neighbor 2001:db8:0:12::2 route-map PREPEND-FIRST out
 exit-address-family

R1# clear bgp ipv6 unicast 2001:db8:0:12::2 soft out

R2# show bgp ipv6 unicast
     Network                         Next Hop                  Path
*>   2001:db8:0:1::/64               2001:db8:0:12::1          65001 65001 i
*>   2001:db8:0:11::/64              2001:db8:0:12::1          65001 i
*>   2001:db8:0:111::/64             2001:db8:0:12::1          65001 i

The first route now has two copies of 65001; the normal eBGP export supplies one. Restrict R2 to a single-token AS path.

ip as-path access-list 20 permit ^65001$

router bgp 65002
 address-family ipv6 unicast
  neighbor 2001:db8:0:12::1 filter-list 20 in
 exit-address-family

R2# clear bgp ipv6 unicast 2001:db8:0:12::1 soft in

R2# show bgp ipv6 unicast
     Network                         Next Hop                  Path
*>   2001:db8:0:11::/64              2001:db8:0:12::1          65001 i
*>   2001:db8:0:111::/64             2001:db8:0:12::1          65001 i

The AS-path list uses the ip as-path command even though it is attached under IPv6. The /96 remains blocked by the separate prefix-length policy.

Reject a prefix with a route map

Keep the earlier two inbound filters active. Add a third filter on R2 that rejects the second /64 and permits every other route to continue to the remaining filters.

ipv6 prefix-list SECOND seq 5 permit 2001:db8:0:11::/64
route-map V6-IN deny 10
 match ipv6 address prefix-list SECOND
exit
route-map V6-IN permit 20
exit

router bgp 65002
 address-family ipv6 unicast
  neighbor 2001:db8:0:12::1 route-map V6-IN in
 exit-address-family

R2# clear bgp ipv6 unicast 2001:db8:0:12::1 soft in

R2# show bgp ipv6 unicast
     Network                         Next Hop                  Path
*>   2001:db8:0:111::/64             2001:db8:0:12::1          65001 i

The prefix list permits a match, and the enclosing route-map deny rejects it. A deny entry inside the referenced list would instead mean that this route-map clause did not match. Only the third /64 now passes all policies.

Understand combined policies

Direction	Processing order for the example command family
Inbound	Route map → AS-path filter list → prefix list → distribute list, where supported.
Outbound	Distribute list → prefix list → AS-path filter list → route map, where supported.

All applicable gates must permit a route; a permit in one does not override a deny in another. Not every filter combination or method is supported for every address family and software release. These examples attach only the supported IPv6 route-map, filter-list and prefix-list methods. An outbound route map can change attributes after earlier outbound filters have evaluated them.

Restore all four routes

router bgp 65002
 address-family ipv6 unicast
  no neighbor 2001:db8:0:12::1 route-map V6-IN in
  no neighbor 2001:db8:0:12::1 filter-list 20 in
  no neighbor 2001:db8:0:12::1 prefix-list UPSTREAM-LENGTH in
 exit-address-family

router bgp 65001
 address-family ipv6 unicast
  no neighbor 2001:db8:0:12::2 route-map PREPEND-FIRST out
 exit-address-family

R1# clear bgp ipv6 unicast 2001:db8:0:12::2 soft out

R2# clear bgp ipv6 unicast 2001:db8:0:12::1 soft in

R2# show bgp ipv6 unicast
     Network                         Next Hop                  Path
*>   2001:db8:0:1::/64               2001:db8:0:12::1          65001 i
*>   2001:db8:0:11::/64              2001:db8:0:12::1          65001 i
*>   2001:db8:0:111::/64             2001:db8:0:12::1          65001 i
*>   2001:db8:0:1111::/96            2001:db8:0:12::1          65001 i

All four prefixes return with an ordinary single-AS path after refresh.

Key Takeaways

Activate the IPv6 unicast family before exchanging its routes.
A prefix list checks both prefix containment and allowed lengths.
AS-path access lists can be attached under the IPv6 family.
Every applicable filter must permit the route.
Route-map deny and deny inside a match list have different meanings.

Protocol and command references

AS-path regular expressions · Prefix and access-list route filters · Policy processing order · Router-symbol attribution.

← Preventing a Transit AS AS Path Filtering →