BGP AS Path Filter Example

In this tutorial we’ll take a look at BGP AS path filtering. Using the AS path filter we can permit or deny prefixes from certain autonomous systems. You can use this for things like:

  • Accept only prefixes from directly connected autonomous systems
  • Accept only prefixes from directly connected autonomous systems AND one autonomous system behind the first one.
  • Deny certain transit autonomous systems
  • And more

To create rules like the examples above we need a flexible way so that we can “match” on certain autonomous systems. This can be done with regular expressions. If you have no clue how regular expressions work then please read my regexp tutorial first.

Having said that, let’s look at some examples. I will use a BGP looking glass server for this.

A looking glass server is a router on the Internet that has a (full) internet routing table. You can use telnet to one and use show commands to view the BGP table. It’s a great way to practice regular expressions since there’s plenty of prefixes to play with.

You can find a looking glass server on BGP4.as, I picked one that is close to me:

route-server.tinet.net

Once I connect to it through telnet this is what I see:

+--------------------------------------------------------------------+
|                                                                    |
|                    GTT Route Monitor - AS3257                      |
|                                                                    |
|   This system is solely for internet operational purposes. Any     |
|   misuse is strictly prohibited. All connections to this router    |
|   are logged.                                                      |
|                                                                    |
|   This server provides a view on the Tinet legacy routing table    |
|   that is used in Frankfurt/Germany. If you are interested in      |
|   other regions of the backbone check out http://www.as3257.net/   |
|                                                                    |
|                Please report problems to noc@gtt.net               |
|                                                                    |
+--------------------------------------------------------------------+

route-server.as3257.net>

Let’s see what we find in the BGP table:

route-server.as3257.net>show ip bgp
BGP table version is 4491321, local router ID is 213.200.87.253
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
*> 1.0.0.0/24       213.200.64.93            0             0 3257 15169 i
*> 1.0.4.0/24       213.200.64.93            0             0 3257 6453 7545 56203 i
*> 1.0.5.0/24       213.200.64.93            0             0 3257 6453 7545 56203 i
*> 1.0.6.0/24       213.200.64.93            0             0 3257 174 4826 38803 56203 i
*> 1.0.7.0/24       213.200.64.93            0             0 3257 174 4826 38803 56203 i
*> 1.0.20.0/23      213.200.64.93         1551             0 3257 2516 2519 i
*> 1.0.22.0/23      213.200.64.93         1551             0 3257 2516 2519 i
*> 1.0.24.0/23      213.200.64.93         1551             0 3257 2516 2519 i
*> 1.0.26.0/23      213.200.64.93         1551             0 3257 2516 2519 i
*> 1.0.28.0/22      213.200.64.93         1551             0 3257 2516 2519 i
*> 1.0.38.0/24      213.200.64.93          815             0 3257 9304 24155 i
*> 1.0.41.0/24      213.200.64.93          815             0 3257 9304 24155 i
*> 1.0.43.0/24      213.200.64.93          815             0 3257 9304 24155 i
*> 1.0.46.0/24      213.200.64.93          815             0 3257 9304 24155 i
*> 1.0.48.0/24      213.200.64.93          815             0 3257 9304 24155 i
*> 1.0.64.0/18      213.200.64.93         1551             0 3257 2516 7670 18144 i
*> 1.0.128.0/18     213.200.64.93            0             0 3257 174 38040 9737 i
*> 1.0.128.0/17     213.200.64.93            0             0 3257 38040 9737 9737 i
*> 1.0.129.0/24     213.200.64.93            0             0 3257 4651 9737 9737 23969 i
*> 1.0.130.0/24     213.200.64.93            0             0 3257 6453 4651 9737 9737 9737 23969 i
*> 1.0.131.0/24     213.200.64.93            0             0 3257 6453 4651 9737 9737 9737 23969 i
*> 1.0.142.0/23     213.200.64.93            0             0 3257 6453 4651 9737 9737 9737 23969 i
*> 1.0.160.0/19     213.200.64.93           18             0 3257 2914 38040 9737 i
*> 1.0.192.0/21     213.200.64.93            0             0 3257 6453 4651 9737 9737 9737 23969 i

Plenty of prefixes to play with…let’s try a couple of examples now shall we?

Only allow prefixes that originated from AS 3257

This example will only accept prefixes that originated in AS 3257, all the other prefixes won’t be permitted:

route-server.as3257.net>show ip bgp regexp ^3257$
BGP table version is 4492538, local router ID is 213.200.87.253
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
*> 2.16.0.0/23      213.200.64.93          154             0 3257 i
*> 2.16.4.0/24      213.200.64.93          230             0 3257 i
*> 2.16.5.0/24      213.200.64.93          230             0 3257 i
*> 2.16.34.0/24     213.200.64.93           80             0 3257 i

Let me explain the regular expression that I used here. The ^ symbol means that this is the beginning of the string and the $ matches the end of the string. We put 3257 in between so only “3257” matches. If you want to configure this filter on a Cisco IOS router you can do this with the as-path access-list command:

ip as-path access-list 1 permit ^3257$

route-map AS_PATH_FILTER permit 10
match as-path 1

router bgp 1
neighbor 213.200.64.93 remote-as 3257
neighbor 213.200.64.93 route-map AS_PATH_FILTER in

The as-path access-list works like the normal access-lists, there is a hidden “deny any” at the bottom. First we create the as-path access-list and then attach it to a route-map. In the BGP configuration you can attach the route-map to one of your BGP neighbors.

Let’s look at another example…

Only allow networks that passed through AS 3257

We only want to see prefixes that passed through AS 3257, here’s how:

route-server.as3257.net>show ip bgp regexp _3257_
BGP table version is 4492787, local router ID is 213.200.87.253
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
*> 1.0.0.0/24       213.200.64.93            0             0 3257 15169 i
*> 1.0.4.0/24       213.200.64.93            0             0 3257 6453 7545 56203 i
*> 1.0.5.0/24       213.200.64.93            0             0 3257 6453 7545 56203 i
*> 1.0.6.0/24       213.200.64.93            0             0 3257 174 4826 38803 56203 i
*> 1.0.7.0/24       213.200.64.93            0             0 3257 174 4826 38803 56203 i
*> 1.0.20.0/23      213.200.64.93         1551             0 3257 2516 2519 i

The regular expression starts and ends with a _ . This matches the space between the AS path numbers. I’m not using a ^or $ to indicate the start and end of the string so there can be as many autonomous systems as we want, as long as it passed through AS 3257 it will match. Here’s what it looks like on a router:

ip as-path access-list 1 permit _3257_

route-map AS_PATH_FILTER permit 10
match as-path 1

router bgp 1
neighbor 213.200.64.93 remote-as 3257
neighbor 213.200.64.93 route-map AS_PATH_FILTER in

I got a few more examples…

Deny prefixes that originated from AS 56203 and permit everything else

This one might be useful if you want to block prefixes that originated in a particular AS:

We're Sorry, Full Content Access is for Members Only...

If you like to keep on reading, Become a Member Now! Here is why:

  • Learn any CCNA, CCNP and CCIE R&S Topic. Explained As Simple As Possible.
  • Try for Just $1. The Best Dollar You've Ever Spent on Your Cisco Career!
  • Full Access to our 662 Lessons. More Lessons Added Every Week!
  • Content created by Rene Molenaar (CCIE #41726)

501 Sign Ups in the last 30 days

satisfaction-guaranteed
100% Satisfaction Guaranteed!
You may cancel your monthly membership at any time.
No Questions Asked!

Tags:


Forum Replies

  1. Hey Rene,

    I have found one of Swisscom BGP router from that expressions:

    AS path access list 1
        permit ^$
        permit 650[0-9][0-9][)]$
    

    permit ^$ : I think this one is written for locally originating routes

    I can’t get a meaning the last one’s " [)] "section ? You have an idea?
    By the way ; these ip as-path access lists , bgp filtering commands just filtering the AS’s that advertising from another BGP routers right?

    Deniz

  2. Hi A,

    Most of the looking glass servers support regular expressions so that would be the best option to get some practice. If you want to practice this “locally” then I would configure some BGP routers and use route-maps for things like AS path prepending, this can be used as a nice simulation of the Internet.

    Rene

  3. Is it abnormal not really to be real fluent with these?

    Don’t get me wrong I see the examples and as I went through lessons later on I see some of the examples come up that can be useful.

    I am good with ones like:

    ^$ which can be useful for applying to everything (you use this one when dealing with Transit issues when multi-homing and need to filter) or ^63100$ apply to an AS specifically.

    I also get and like the ones like

    //cdn-forum.networklessons.com/uploads/default/original/1X/ba8410b24c63f01693bd194e49f4b85b377d378c.PNG

    which would give every AS that

    ... Continue reading in our forum

  4. Hi Brian,

    It’s normal I think…as network engineers, we don’t use regular expressions much. If you are into programming, you’ll use them quite a lot to match strings/numbers/etc… If you want to practice these, try a site like:

    https://regexr.com/

    Paste in the output of a BGP table there and test it…it’s easier and quicker than testing regex on your router.

    I wouldn’t worry about this too much though…when you need to use them for BGP, you can always look them up…test it, then apply it to your router. No need to memorize all the different options. When you need it

    ... Continue reading in our forum

  5. Hi Nitay,

    Sometimes, there are multiple ways to achieve the same thing with regex. The _ matches the space in between the AS numbers.

    If this is what you want, I would use this regex:

    show ip bgp regex ^([0-9
    ... Continue reading in our forum

3 more replies! Ask a question or join the discussion by visiting our Community Forum