PacketLab
Protocols/BGP/Route Filtering
BGP · Route Filtering

Preventing a Transit AS

Keep upstream routes usable locally without offering to carry traffic between providers.

Observe unintended transit

Customer R1 (AS 65001) has two upstreams: ISP1 is R2 (AS 65002), and ISP2 is R3 (AS 65003). Each router originates one test prefix. With no export restriction in this lab, R1 announces an upstream-learned route to the other upstream.

Lab topologyPhysical links
192.0.2.1 / .2192.0.2.5 / .6R1Customer · AS 65001R2ISP1 · AS 65002R3ISP2 · AS 65003
Continuous solid lines are physical links. Interface addresses appear beside the link; each IPv4 link is /30 and the IPv6 link is /64. BGP uses the directly connected addresses.
Complete baseline configurations

R1

hostname R1
ip cef
interface Loopback0
 ip address 10.255.0.1 255.255.255.255
exit
interface Loopback10
 ip address 198.51.100.1 255.255.255.0
exit
interface GigabitEthernet1
 ip address 192.0.2.1 255.255.255.252
 no shutdown
exit
interface GigabitEthernet2
 ip address 192.0.2.5 255.255.255.252
 no shutdown
exit
router bgp 65001
 bgp router-id 10.255.0.1
 no bgp default ipv4-unicast
 neighbor 192.0.2.2 remote-as 65002
 neighbor 192.0.2.6 remote-as 65003
 address-family ipv4 unicast
  no auto-summary
  neighbor 192.0.2.2 activate
  neighbor 192.0.2.6 activate
  network 198.51.100.0 mask 255.255.255.0
 exit-address-family
end

R2

hostname R2
ip cef
interface Loopback0
 ip address 10.255.0.2 255.255.255.255
exit
interface Loopback10
 ip address 203.0.113.1 255.255.255.128
exit
interface GigabitEthernet1
 ip address 192.0.2.2 255.255.255.252
 no shutdown
exit
router bgp 65002
 bgp router-id 10.255.0.2
 no bgp default ipv4-unicast
 neighbor 192.0.2.1 remote-as 65001
 address-family ipv4 unicast
  no auto-summary
  neighbor 192.0.2.1 activate
  network 203.0.113.0 mask 255.255.255.128
 exit-address-family
end

R3

hostname R3
ip cef
interface Loopback0
 ip address 10.255.0.3 255.255.255.255
exit
interface Loopback10
 ip address 203.0.113.129 255.255.255.128
exit
interface GigabitEthernet1
 ip address 192.0.2.6 255.255.255.252
 no shutdown
exit
router bgp 65003
 bgp router-id 10.255.0.3
 no bgp default ipv4-unicast
 neighbor 192.0.2.5 remote-as 65001
 address-family ipv4 unicast
  no auto-summary
  neighbor 192.0.2.5 activate
  network 203.0.113.128 mask 255.255.255.128
 exit-address-family
end
Outputs are illustrative, not recorded router results. Start each independent experiment from the stated baseline. Allow routing updates to converge after a policy refresh.
R2# show ip bgp
     Network          Next Hop        Metric LocPrf Weight Path
*>   198.51.100.0/24  192.0.2.1            0             0 65001 i
*>   203.0.113.0/25   0.0.0.0              0         32768 i
*>   203.0.113.128/25 192.0.2.1            0             0 65001 65003 i
R3# show ip bgp
     Network          Next Hop        Metric LocPrf Weight Path
*>   198.51.100.0/24  192.0.2.5            0             0 65001 i
*>   203.0.113.0/25   192.0.2.5            0             0 65001 65002 i
*>   203.0.113.128/25 0.0.0.0              0         32768 i

R2’s path to ISP2’s /25 contains 65001 65003, and R3’s path to ISP1 contains 65001 65002. Either provider could use R1 as transit for those destinations. The following four methods are independent alternatives; remove one before trying another.

Allow empty AS paths

On R1, accept only an empty local AS_PATH for export to both providers. Evaluation occurs before the normal eBGP prepend of R1’s AS.

ip as-path access-list 10 permit ^$
router bgp 65001
 address-family ipv4 unicast
  neighbor 192.0.2.2 filter-list 10 out
  neighbor 192.0.2.6 filter-list 10 out
 exit-address-family
R1# clear ip bgp 192.0.2.2 soft out
R1# clear ip bgp 192.0.2.6 soft out
R1# show ip bgp
     Network          Next Hop        Metric LocPrf Weight Path
*>   198.51.100.0/24  0.0.0.0              0         32768 i
*>   203.0.113.0/25   192.0.2.2            0             0 65002 i
*>   203.0.113.128/25 192.0.2.6            0             0 65003 i
R2# show ip bgp
     Network          Next Hop        Metric LocPrf Weight Path
*>   198.51.100.0/24  192.0.2.1            0             0 65001 i
*>   203.0.113.0/25   0.0.0.0              0         32768 i
R3# show ip bgp
     Network          Next Hop        Metric LocPrf Weight Path
*>   198.51.100.0/24  192.0.2.5            0             0 65001 i
*>   203.0.113.128/25 0.0.0.0              0         32768 i

R1 still learns both upstream prefixes, but neither upstream sees the other’s prefix through R1. An empty path can also be carried over iBGP from a different originator within the same local AS; this is not a prefix-ownership check.

Tag imports No Export

Detach the preceding export filters, then tag both upstream imports. The customer-originated route is unaffected because it does not enter through either inbound policy.

router bgp 65001
 address-family ipv4 unicast
  no neighbor 192.0.2.2 filter-list 10 out
  no neighbor 192.0.2.6 filter-list 10 out
 exit-address-family
route-map UPSTREAM-IN permit 10
 set community no-export additive
exit
router bgp 65001
 address-family ipv4 unicast
  neighbor 192.0.2.2 route-map UPSTREAM-IN in
  neighbor 192.0.2.6 route-map UPSTREAM-IN in
 exit-address-family
R1# clear ip bgp 192.0.2.2 soft in
R1# clear ip bgp 192.0.2.6 soft in
R1# clear ip bgp 192.0.2.2 soft out
R1# clear ip bgp 192.0.2.6 soft out
R1# show ip bgp 203.0.113.0/25
BGP routing table entry for 203.0.113.0/25
Paths: (1 available, best #1, table default)
  65002
    192.0.2.2 from 192.0.2.2
      Origin IGP, metric 0, localpref 100, valid, external, best
      Community: no-export
R2# show ip bgp
     Network          Next Hop        Metric LocPrf Weight Path
*>   198.51.100.0/24  192.0.2.1            0             0 65001 i
*>   203.0.113.0/25   0.0.0.0              0         32768 i
R3# show ip bgp
     Network          Next Hop        Metric LocPrf Weight Path
*>   198.51.100.0/24  192.0.2.5            0             0 65001 i
*>   203.0.113.128/25 0.0.0.0              0         32768 i

R1 enforces the scope locally. In a larger customer AS, send the community over internal sessions so every border enforces it. Do not tag the customer’s own exports No Export if they must propagate globally.

Allow owned prefixes

Remove the inbound route map and refresh imports before replacing it with an explicit outbound allowlist.

router bgp 65001
 address-family ipv4 unicast
  no neighbor 192.0.2.2 route-map UPSTREAM-IN in
  no neighbor 192.0.2.6 route-map UPSTREAM-IN in
 exit-address-family
R1# clear ip bgp 192.0.2.2 soft in
R1# clear ip bgp 192.0.2.6 soft in
ip prefix-list CUSTOMER-OUT seq 5 permit 198.51.100.0/24
router bgp 65001
 address-family ipv4 unicast
  neighbor 192.0.2.2 prefix-list CUSTOMER-OUT out
  neighbor 192.0.2.6 prefix-list CUSTOMER-OUT out
 exit-address-family
R1# clear ip bgp 192.0.2.2 soft out
R1# clear ip bgp 192.0.2.6 soft out
R2# show ip bgp
     Network          Next Hop        Metric LocPrf Weight Path
*>   198.51.100.0/24  192.0.2.1            0             0 65001 i
*>   203.0.113.0/25   0.0.0.0              0         32768 i
R3# show ip bgp
     Network          Next Hop        Metric LocPrf Weight Path
*>   198.51.100.0/24  192.0.2.5            0             0 65001 i
*>   203.0.113.128/25 0.0.0.0              0         32768 i

An exact prefix list is easy to audit and permits only the customer /24. Its implicit deny suppresses both upstream /25s. Add newly authorized customer prefixes deliberately; this maintenance is a benefit when strict ownership boundaries are required.

Use a distribute list

Detach the prefix list, then demonstrate the older address-based alternative. A standard ACL checks the network address without independently checking prefix length.

router bgp 65001
 address-family ipv4 unicast
  no neighbor 192.0.2.2 prefix-list CUSTOMER-OUT out
  no neighbor 192.0.2.6 prefix-list CUSTOMER-OUT out
 exit-address-family
ip access-list standard CUSTOMER-ADDRESS
 permit host 198.51.100.0
exit
router bgp 65001
 address-family ipv4 unicast
  neighbor 192.0.2.2 distribute-list CUSTOMER-ADDRESS out
  neighbor 192.0.2.6 distribute-list CUSTOMER-ADDRESS out
 exit-address-family
R1# clear ip bgp 192.0.2.2 soft out
R1# clear ip bgp 192.0.2.6 soft out
R2# show ip bgp
     Network          Next Hop        Metric LocPrf Weight Path
*>   198.51.100.0/24  192.0.2.1            0             0 65001 i
*>   203.0.113.0/25   0.0.0.0              0         32768 i
R3# show ip bgp
     Network          Next Hop        Metric LocPrf Weight Path
*>   198.51.100.0/24  192.0.2.5            0             0 65001 i
*>   203.0.113.128/25 0.0.0.0              0         32768 i

This works for this dataset, but also matches another prefix length with the same network address. A prefix list expresses an exact length more clearly.

Compare and restore

MethodWhat it selects
Empty-path filterAS-path scope; does not validate owned prefixes.
No Export on importReceived upstream routes stay internal.
Prefix allowlistExplicit authorized network and prefix length.
Standard distribute listNetwork address; less precise length control.

For the lab only, detach the final method to return to the intentionally permissive baseline.

router bgp 65001
 address-family ipv4 unicast
  no neighbor 192.0.2.2 distribute-list CUSTOMER-ADDRESS out
  no neighbor 192.0.2.6 distribute-list CUSTOMER-ADDRESS out
 exit-address-family
R1# clear ip bgp 192.0.2.2 soft out
R1# clear ip bgp 192.0.2.6 soft out
R2# show ip bgp
     Network          Next Hop        Metric LocPrf Weight Path
*>   198.51.100.0/24  192.0.2.1            0             0 65001 i
*>   203.0.113.0/25   0.0.0.0              0         32768 i
*>   203.0.113.128/25 192.0.2.1            0             0 65001 65003 i
R3# show ip bgp
     Network          Next Hop        Metric LocPrf Weight Path
*>   198.51.100.0/24  192.0.2.5            0             0 65001 i
*>   203.0.113.0/25   192.0.2.5            0             0 65001 65002 i
*>   203.0.113.128/25 0.0.0.0              0         32768 i

Both transit paths return. A production customer should retain its intended export policy; this restore step is an experiment, not an operational recommendation.

Key Takeaways

  • Unrestricted export between two upstreams can make a customer an unintended transit AS.
  • Apply export constraints toward both upstreams.
  • An empty-path filter limits export by path scope rather than explicit ownership.
  • No Export on upstream imports keeps those routes usable internally.
  • A prefix allowlist gives exact address-and-length control; a standard ACL does not.

Prevent Transit Quiz

Six questions · four options each · select one answer per question. Submit all answers to see your score and explanations.

1. Which path on ISP1 demonstrates transit through R1?
2. Where is the empty-path filter attached?
3. Do upstream routes remain on R1 after an export-only filter?
4. What receives No Export in the inbound alternative?
5. What does a standard distribute-list ACL fail to express independently?
6. Is an empty AS path proof of authorized prefix ownership?
Protocol and command references

AS-path regular expressions · Prefix and access-list route filters · Policy processing order · Router-symbol attribution.

← BGP Regular ExpressionsIPv6 Route Filtering →