BGP IPv6 Route Filtering on Cisco IOS

Filtering IPv6 routes in BGP is similar to IPv4 filtering.  There are 3 methods we can use:

  • Prefix-list
  • Filter-list
  • Route-map

Each of these can be applied in- or outbound. I’ll explain how you can use these for filtering, this is the topology I will use:

R1 R2 BGP IPv6 4 prefixes

R1 and R2 are using IPv6 addresses and will use MP-BGP so that R1 can advertise some prefixes on its loopback interfaces. All prefixes on the loopback interfaces are /64 subnets while loopback3 has a /96 subnet.

Configuration

Let’s start with a basic MP-BGP configuration so that R1 and R2 become eBGP neighbors:

R1 & R2#
(config)ipv6 unicast-routing
R1(config)#router bgp 1
R1(config-router)#bgp router-id 1.1.1.1
R1(config-router)#neighbor 2001:db8:0:12::2 remote-as 2
R1(config-router)#address-family ipv6
R1(config-router-af)#neighbor 2001:db8:0:12::2 activate
R1(config-router-af)#network 2001:db8:0:1::/64
R1(config-router-af)#network 2001:db8:0:11::/64
R1(config-router-af)#network 2001:db8:0:111::/64
R1(config-router-af)#network 2001:db8:0:1111::/96
R2(config)#router bgp 2
R2(config-router)#bgp router-id 2.2.2.2
R2(config-router)#neighbor 2001:db8:0:12::1 remote-as 1
R2(config-router)#address-family ipv6
R2(config-router-af)#neighbor 2001:db8:0:12::1 activate

Let’s check if R2 has learned all prefixes:

R2#show ipv6 route bgp | begin 2001
B   2001:DB8:0:1::/64 [20/0]
     via FE80::21D:A1FF:FE8B:36D0, FastEthernet0/0
B   2001:DB8:0:11::/64 [20/0]
     via FE80::21D:A1FF:FE8B:36D0, FastEthernet0/0
B   2001:DB8:0:111::/64 [20/0]
     via FE80::21D:A1FF:FE8B:36D0, FastEthernet0/0
B   2001:DB8:0:1111::/96 [20/0]
     via FE80::21D:A1FF:FE8B:36D0, FastEthernet0/0

There we go, everything is in the routing table. Now we can play with some of the filtering options…

Prefix-List Filtering

Let’s start with the prefix-list. R1 is advertising one /96 subnet. Let’s see if we can configure R2 to filter this network:

R2(config)#ipv6 prefix-list SMALL_NETWORKS permit 2001::/16 le 64

This prefix-list checks the entire 2001::/16 range and permits subnets with a /64 or larger. Anything smaller will be denied. Let’s activate it:

R2(config)#router bgp 2
R2(config-router)#address-family ipv6
R2(config-router-af)#neighbor 2001:db8:0:12::1 prefix-list SMALL_NETWORKS in

We activate the prefix-list inbound on R2 for everything that we receive from R1. Let’s reset BGP to speed things up:

R2#clear ip bgp *

Let’s check R2 to see if our prefix is gone:

R2#show ipv6 route bgp | begin 2001
B   2001:DB8:0:1::/64 [20/0]
     via FE80::21D:A1FF:FE8B:36D0, FastEthernet0/0
B   2001:DB8:0:11::/64 [20/0]
     via FE80::21D:A1FF:FE8B:36D0, FastEthernet0/0
B   2001:DB8:0:111::/64 [20/0]
     via FE80::21D:A1FF:FE8B:36D0, FastEthernet0/0

Great, it has been filtered succesfully!

Filter-List Filtering

Let’s try the filter-list. We can use this to filter prefixes from certain autonomous systems. Everything that R1 is advertising only has AS 1 in the AS path, I’ll configure AS prepending so we have something to play with:

R1(config)#ipv6 prefix-list FIRST_LOOPBACK permit 2001:db8:0:1::/64

R1(config)#route-map PREPEND permit 10
R1(config-route-map)#match ipv6 address prefix-list FIRST_LOOPBACK
R1(config-route-map)#set as-path prepend 11
R1(config)#route-map PREPEND permit 20

R1(config)#router bgp 1
R1(config-router)#address-family ipv6
R1(config-router-af)#neighbor 2001:db8:0:12::2 route-map PREPEND out

The above configuration will make sure that whenever R1 advertises 2001:db8:0:1::/64 it will add AS 11 to the AS path. Let’s verify this:

R2#show ip bgp all
For address family: IPv4 Unicast


For address family: IPv6 Unicast

BGP table version is 4, local router ID is 2.2.2.2
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, m multipath, b backup-path, x best-external, f RT-Filter
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
*> 2001:DB8:0:1::/64
                    2001:DB8:0:12::1
                                             0             0 1 11 i
*> 2001:DB8:0:11::/64
                    2001:DB8:0:12::1
                                             0             0 1 i
*> 2001:DB8:0:111::/64
                    2001:DB8:0:12::1
                                             0             0 1 i

For address family: IPv4 Multicast

Above you can see that 2001:DB8:0:1::/64 now has AS 11 in its AS path. Let’s configure a filter-list on R2 to get rid of this network:

R2(config)#ip as-path access-list 11 permit ^1$

R2(config)#router bgp 2
R2(config-router)#address-family ipv6
R2(config-router-af)#neighbor 2001:db8:0:12::1 filter-list 11 in

R2#clear ip bgp *

The as-path access-list above only permits prefixes from AS1, nothing else. We attach it inbound to everything we receive from R1. This is the result:

R2#show ipv6 route bgp | begin 2001
B   2001:DB8:0:11::/64 [20/0]
     via FE80::21D:A1FF:FE8B:36D0, FastEthernet0/0
B   2001:DB8:0:111::/64 [20/0]
     via FE80::21D:A1FF:FE8B:36D0, FastEthernet0/0

It’s gone from the routing table, mission accomplished.

Route-Map Filtering

Route-maps are really useful and can be used to match on many different things. I’ll use an IPv6 access-list in a route-map to filter 2001:DB8:0:11::/64:

We're Sorry, Full Content Access is for Members Only...

If you like to keep on reading, Become a Member Now! Here is why:

  • Learn any CCNA, CCNP and CCIE R&S Topic. Explained As Simple As Possible.
  • Try for Just $1. The Best Dollar You've Ever Spent on Your Cisco Career!
  • Full Access to our 654 Lessons. More Lessons Added Every Week!
  • Content created by Rene Molenaar (CCIE #41726)

540 Sign Ups in the last 30 days

satisfaction-guaranteed
100% Satisfaction Guaranteed!
You may cancel your monthly membership at any time.
No Questions Asked!

Tags:


Forum Replies

  1. Hi Rene,

    I think that it is a errata:

    This prefix-list checks the entire 2001::/16 range and permits subnets with a /64 or larger.
    It should be:

    This prefix-list checks the entire 2001::/16 range and permits subnets with a /64 o smaller

    Thanks you

  2. Cisco documentation from 2016 provides different order for outbound filtering:

    For inbound updates the order of preference is:
    route-map
    filter-list
    prefix-list, distribute-list

    For outbound updates the order of preference is:

    filter-list
    route-map | unsuppress-map
    advertise-map (conditional-advertisement)
    prefix-list|distribute-list
    ORF prefix-list (a prefix-list the neighbor sends us)
    

    https://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/5816-bgpfaq-5816.html

  3. @lagapides thank you for clearing that out. That helped me a lot. Now i have a better understanding.

  4. Hi,

    There is an error in your last configuration on R1.

    hostname R1
    !
    ipv6 unicast-routing
    !
    interface FastEthernet0/0
     ipv6 address 2001:DB8:0:12::1/64
    !
    interface Loopback0
     ipv6 address 2001:DB8:0:1::1/64
    !
    interface Loopback1
     ipv6 address 2001:DB8:0:11::1/64
    !
    interface Loopback2
     ipv6 address 2001:DB8:0:111::1/64
    !
    interface Loopback3
     ipv6 address 2001:DB8:0:1111::1/64
    !
    router bgp 1
     bgp router-id 1.1.1.1
     bgp log-neighbor-changes
     neighbor 2001:DB8:0:12::2 remote-as 2
     !
     address-family ipv4
      neighbor 2001:DB8:0:12::2 activate
      neighbor 2001:DB8:0:12
    ... Continue reading in our forum

14 more replies! Ask a question or join the discussion by visiting our Community Forum