How to Filter Prefixes with Distribute-list

Hello Brian

For access lists it is true that standard should be placed as near to the destination as possible since you are ONLY matching the destination and extended access lists as close as possible to the source since source IP is also taken into account for those. So for PURE access lists, this is the best practice.

The example that Rene has in his lesson does not follow these rules because it is not PURE ACLs that we’re configuring but distribute lists. It is true that if the distribute list was placed on the outbound Fa0/0 interface of R2, the result for the specific topology would be the same, with less overhead. However, it depends on what you want to do.

If you end up placing it on the outbound Fa0/0 interface of R2 then you are suppressing ALL advertisements of the loopback interfaces via Fa0/0. What if there are other routers connected to Fa0/0 and you want those to receive the advertisements but you don’t want R1 to receive them? Then you MUST place the distribution list on the specific router for which you want them to be filtered. There is no point in saving resources if the functionality you need is not provided for.

Yes you could use an extended access list here as well, however, you would still only indicate destination IP addresses. Extended ACLs do use more CPU and resources because they try to match more criteria.

I hope this has been helpful!

Laz

2 Likes