BGP IPv6 Route Filtering on Cisco IOS


(Rene Molenaar) #1

This topic is to discuss the following lesson:


(Diego M) #2

Hi Rene,

I think that it is a errata:

This prefix-list checks the entire 2001::/16 range and permits subnets with a /64 or larger.
It should be:

This prefix-list checks the entire 2001::/16 range and permits subnets with a /64 o smaller

Thanks you


(Rene Molenaar) #3

Hi Diego,

Thanks for the message, this sentence is correct though. Take a look at the prefix-list:

ipv6 prefix-list SMALL_NETWORKS permit 2001::/16 le 64

The “le 64” part means that it will match /64, /63, /62, /61, /60, etc. All of these are “larger” subnets than /64.

Rene


(Georgi T) #4

Hi Rene
Great lesson!
you might want to fix the BGP configuration for R2

R2(config)#router bgp 1
R2(config-router)#bgp router-id 2.2.2.2
R2(config-router)#neighbor 2001:db8:0:12::1 remote-as 2
R2(config-router)#address-family ipv6
R2(config-router-af)#neighbor 2001:db8:0:12::2 activate

Thank you


(Rene Molenaar) #5

Thanks Georgi! Just fixed it.


(Diana M) #6

Hello Rene,

I was doing a LAB and I discovered something interesting and I wanted to ask you why:

which is the difference to have the next route-map here:

router bgp 21
 no synchronization
 bgp router-id 15.15.15.15
 bgp log-neighbor-changes
 neighbor 2001:DB8:12::1 remote-as 20
 neighbor 2001:DB8:12::1 route-map BLOCK_MAP in <------------
 no auto-summary
 !
 address-family ipv6
  neighbor 2001:DB8:12::1 activate
  neighbor 2001:DB8:12::1 prefix-list NET64 in
 exit-address-family

OR HERE

router bgp 21
 no synchronization
 bgp router-id 15.15.15.15
 bgp log-neighbor-changes
 neighbor 2001:DB8:12::1 remote-as 20
 no auto-summary
 !
 address-family ipv6
  neighbor 2001:DB8:12::1 activate
  neighbor 2001:DB8:12::1 prefix-list NET64 in
  neighbor 2001:DB8:12::1 route-map BLOCK_MAP in <------

Both, the router accept the commands but only with the second one works perfectly.


(Rene Molenaar) #7

Hi Diana,

I’d have to test this to confirm it but when you configure it under the main BGP process then it only applies to the IPv4 address family, even though you can establish a neighbor adjacency through IPv6.

The IPv6 address family is where you configure everything…including route-maps.

If you want to confirm this, you can advertise some IPv4 prefixes…see if the route-map matches your IPv4 routes. I think it will.

Rene


(Heng S) #8

Hello Rene
Is this order of operation apply on with IP6 filtering only?
image


(Lazaros Agapides) #9

Hello Heng.

The order of operation is the same for IPv4 as well.

I hope this has been helpful.

Laz


(Danil S) #10

Cisco documentation from 2016 provides different order for outbound filtering:

For inbound updates the order of preference is:
route-map
filter-list
prefix-list, distribute-list

For outbound updates the order of preference is:

filter-list
route-map | unsuppress-map
advertise-map (conditional-advertisement)
prefix-list|distribute-list
ORF prefix-list (a prefix-list the neighbor sends us)

(Rene Molenaar) #11

Thanks for sharing this Danil, These things sometimes change, depending on the platform and/or IOS version