Access Lists; Filtering Prefixes; Figure 21: Filtering With Access Lists - Juniper JUNOSE SOFTWARE FOR E SERIES 11.3.X - BGP AND MPLS CONFIGURATION GUIDE 2010-10-12 Configuration Manual

JunosE 11.3.x BGP and MPLS Configuration Guide

Access Lists

Figure 21: Filtering with Access Lists

82
10.100.3.3/32 Bgp
10.63.42.23/32 Bgp
An access list is a sequential collection of permit and deny conditions that you can use
to filter inbound or outbound routes. You can use different kinds of access lists to filter
routes based on either the prefix or the AS path.

Filtering Prefixes

To filter routes based on the prefix, you can do any of the following:
Define an access list with the access list command and apply the list to routes received
from or passed to a neighbor with the neighbor distribute-list command.
Define a prefix list with the ip prefix-list command and apply the list to routes received
from or passed to a neighbor with the neighbor prefix-list command.
Define a prefix tree with the ip prefix-tree command and apply the list to routes received
from or passed to a neighbor with the neighbor prefix-tree command.
The router compares each route's prefix against the conditions in the list or tree one by
one. If the first match is for a permit condition, the route is accepted or passed. If the first
match is for a deny condition, the route is rejected or blocked. The order of conditions is
critical because testing stops with the first match. If no conditions match, the router
rejects or blocks the address; that is, the last action of any list is an implicit deny condition
for all routes. The implicit rule is displayed by show access-list and show configuration
commands.
You cannot selectively place conditions in or remove conditions from an access list, prefix,
list, or prefix tree. You can insert a new condition only at the end of a list or tree.
Consider the network structure in Figure 21 on page 82.
The following commands configure router Boston to apply access list reject1 to routes
inbound from router SanJose. Access list reject1 rejects routes matching 172.24.160.0/19.
host3(config)#router bgp 17
host3(config-router)#neighbor 10.5.5.4 remote-as 873
10.12.12.1 33/44
10.45.2.31 33/44
Copyright © 2010, Juniper Networks, Inc.
ATM5/1.12
ATM5/1.14