Cisco Prefix-List and Route-Map Filtering for BGP

Route filtering is where BGP policy actually lives: deciding which prefixes enter your table from a customer, and which of your prefixes you advertise upstream. On Cisco IOS the clean split is prefix-lists match routes (what is allowed or targeted) while route-maps take action (permit, deny, or modify attributes like local-preference and communities). This guide shows the pattern with real configurations, including the ge/le prefix-length logic and the safe route-map ordering that prevents accidental full-table drops.

Prefix-List Basics

ip prefix-list CUSTOMER-PREFIXES seq 10 permit 203.0.113.0/24
ip prefix-list CUSTOMER-PREFIXES seq 20 permit 198.51.100.0/24

Each entry matches an exact prefix — 203.0.113.0/25 does not match 203.0.113.0/24 unless you say so. Every prefix-list ends with an implicit deny.

Matching Prefix Length Ranges: ge and le

• le — less-or-equal: sets the maximum prefix length.
• ge — greater-or-equal: sets the minimum prefix length.

! accept the /24 and anything more specific up to /28
ip prefix-list CUSTOMER-PREFIXES seq 10 permit 203.0.113.0/24 le 28
! only /25 through /28 of this block
ip prefix-list MORESPECIFICS seq 10 permit 203.0.113.0/24 ge 25 le 28
! only the default route
ip prefix-list DEFAULT seq 10 permit 0.0.0.0/0
! any IPv4 prefix at all
ip prefix-list ANY seq 10 permit 0.0.0.0/0 le 32

Route-Map Evaluation Logic

Route-maps run top-down by sequence number; the first match wins and nothing after it is evaluated. Sequence design therefore matters: put denies before broad permits.

route-map CUSTOMER-IN permit 10
 match ip address prefix-list CUSTOMER-PREFIXES
route-map CUSTOMER-IN deny 20
 match ip address prefix-list BLOCKED-PREFIXES
route-map CUSTOMER-IN permit 30

A route matching sequence 10 is permitted immediately — the deny at 20 never sees it. A broad permit early overrides later denies, which is why the safe pattern below puts the explicit blocklist first.

Recommended Safe Pattern

route-map CUSTOMER-IN deny 5
 match ip address prefix-list BLOCKED-PREFIXES

route-map CUSTOMER-IN permit 10
 match ip address prefix-list CUSTOMER-PREFIXES

route-map CUSTOMER-IN permit 100

Sequence 5 always blocks known-bad prefixes first; sequence 10 admits only approved routes; sequence 100 is the catch-all permit that stops an accidental full-table drop when new prefixes appear. For a strict allowlist-only policy, change the last clause to deny 100.

Applying the Route-Map to a Neighbor

router bgp 64500
 neighbor 192.0.2.2 remote-as 65001
 neighbor 192.0.2.2 description CUSTOMER-NAME
 neighbor 192.0.2.2 route-map CUSTOMER-IN in

Inbound route-maps filter what enters your BGP table; outbound route-maps filter what you advertise. The same match/set mechanics drive redistribution — redistribute ospf 1 route-map OSPF-TO-BGP — and route-map set clauses can prepend AS paths, tag communities or set local preference on matched prefixes.

Verification

show ip prefix-list
show ip bgp neighbor 192.0.2.2 received-routes
show route-map

Check what the neighbor actually sent versus what survived the filter. Route filtering is central to BGP operations — combine with BGP route dampening for flapping peers and review selection logic in our BGP best path explainer.

原文链接：https://blog.j2sw.com/inetarch/bgp-filtering-prefix-lists-route-maps/