notes: Troubleshooting BGP Filtering

1. Problem: Standard Access List Fails to Capture Subnets

debugs and verification:

R1# router bgp 1  

neighbor 131.108.1.2 remote-as 2  

neighbor 131.108.1.2 distribute-list 1 in 

!

access-list 1 permit 13.13.0.0 0.0.255.255

distribute-list 1 means that any BGP updates that come from 131.108.1.2 will be examined by access list 1.

Access list 1 has a permit statement for 13.13.0.0 with an exact match of the first two octets (13.13); it doesn't care about the last two octets (0.0).

using standard access-list doesnt care about the mask  so show ip bgp  command output shows, some subnets of 13.13.0.0  with some variable subnets.

Solution:

- use extended access-list.

access-list 101 permit ip 13.13.0.0 0.0.255.255 255.255.0.0 0.0.0.0 

The extended access list has two parts:

• The network part— 13.13.0.0 0.0.255.255, which allows 13.13.x.x, where x can any number between 0 and 255.
• The mask part— 255.255.0.0 0.0.0.0. With all 0s in wildcard, the mask can only be 255.255.0.0, meaning /16.

 2.  Problem: Extended Access Lists Fails to Capture the Correct Masked Route

To reduce the size of Internet BGP/routing tables, BGP operators are forced to advertise aggregated prefixes and suppress subnetted IP blocks. To achieve this, almost all ISPs expect their peering ISPs and customers to advertise aggregated blocks of, say, /21 (255.255.248.0) of IP blocks and will refuse to accept any prefix with a mask greater than /21. Proper BGP filtering must be in place at peering points so that prefixes with masks greater than /21 can be filtered out and only prefixes with masks less than /21 are accepted.

verification:

show ip bgp

Solution:

The two solutions are as follows:

a.  Use an extended access list.

An extended access list that would permit any IP network whose mask is /21 or lower (20, 19, and so on) is configured as follows:

access-list 101 permit ip 0.0.0.0 255.255.255.255 255.255.248.0 255.255.248.0

0.0.0.0 255.255.255.255 means any IP network.

255.255.248.0 255.255.248.0 means that a mask of this prefix can be only /21 or lower (/20, /19, and so on). Cisco IOS Software has an implicit deny at the end of each access list, so all prefixes whose masks are greater than 21 are denied.

router bgp 109 

neighbor 131.108.1.2 remote-as 110 

neighbor 131.108.1.2 distribute-list 101 Out 

b.  Use a prefix list.

Apart from distribute lists, prefix lists can be used to achieve the same goal.

You can apply the following prefix list to R1 and R2 in a similar fashion as a distribute list with both the neighbor statement and with a route map:

ip prefix-list FILTERING seq 5 permit 0.0.0.0/0 le  21 

0.0.0.0 means any prefix, and /0 le 21 means that the mask of any prefix could be from 0 and less than or equal (le) to 21. All other higher-masked prefixes (/22, /25, /26, and so on) will be denied because of an implicit deny at the end of each Cisco IOS Software filter.

The distribute list and prefix list take effect when updates come from a neighbor. If BGP updates already have been received, applying the distribute list or prefix list will have no effect. To receive updates from neighbors, routers must restart the BGP session by using the commands clear ip bgp neighbor or clear ip bgp neighbor soft in, if soft reconfiguration is enabled. Refer to the Cisco IOS Software manual for more details on this command. A recent feature of Cisco IOS Software called route refresh automatically requests fresher updates from a neighbor when any policy, such as a distribute list or a prefix list, gets applied. This feature does not require clearing of the current BGP session.

3.  Problem: AS_PATH Filtering Using Regular Expressions

All BGP updates that contain an announcement of IP prefixes have an AS_PATH field that lists all the autonomous systems that this update has traversed. BGP operators use filtering against this AS_PATH field to allow or deny IP prefixes and also to apply BGP policy based on AS_PATH filtering. This method offers greater flexibility in applying just a single line of filtering and not listing all IP prefixes, as in the case of distribute lists or prefix lists.