regular expresions, syntax of ACLs used in BGP conetxt 
Single-Character Patterns
A single-character pattern tries to match a single character. The single-character regular
expression 3 tries to match the character 3 in an input string. You can specify a range of single
characters to match against a string. Ranges are included within brackets ([]). The order in
which the characters forming the range are listed is not important. The regular expression
consisting of the range [efghEFGH], for example, tries to match any of the bracket-enclosed
characters in an input string. Given two input strings, "hello" and "there", the regular
expression matches both of these lists because they both contain the character e.
Ranges can be listed by typing the end points of a range. For example, ranges [a–z] and [0–9]
indicate any lowercase character from a to z and any numeric character between 0 and 9,
respectively.
You can also reverse or negate the pattern matching by including a caret (^) at the beginning
of the range. The range [^a–dA–D], for example, matches any character except a, b, c, d, A,
B, C, or D. Some characters have a special meaning, such as the dollar sign $ and the
underscore _ (see Table 6-4).
To list the special characters as part of an input list, precede them with a backslash (\). The
range [abc\$], for example, will match an input string that contains the characters a, b, c, and
$. Table 6-4 lists the special characters used in regular expressions.
Table 6-4. Regular Expression Special Characters
Character Symbol Special Meaning
Period . Matches any single character, including white space.
Asterisk * Matches zero or more sequences of the pattern.
Plus sign + Matches one or more sequences of the pattern.
Question mark ? Matches zero or one occurrences of the pattern.
Caret ^ Matches the beginning of the input string. Also used to negate a pattern match if used
inside the beginning of a range of characters—for example, [^range].
Dollar sign $ Matches the end of the input string.
Underscore _ Matches a comma (,), left brace ({), right brace (}), left parenthesis, right parenthesis, the
beginning of the input string, the end of the input string, or a space.
Brackets [range] Designates a range of single-character patterns.
Hyphen - Separates the end points of a range.

Multiple-Character Patterns
Multiple-character regular expressions are just an ordered sequence of single-character
patterns. The pattern is a combination of letters, numbers, any keyboard characters, and
special-meaning characters. Here is an example of a multiple-character regular expression:
100 1[0–9]. This regular expression matches any string that contains the exact sequence 100,
followed by a space, followed by a 1, followed by any number between 0 and 9. 
Any of the following input strings will match the regular expression: 123 100 10 11, or 100 19, or 19 100
11 200, and so on.
Building Complex Regular Expressions
The special characters listed in Table 6-4 can be used to build complex but very practical
regular expressions. The caret (^) and dollar sign ($) are used to match the regular expression
pattern against the beginning and end of the input string. Other characters, such as the asterisk
(*), the plus sign (+), and the question mark (?), let you repeat the patterns inside the regular
expression.
The following example matches any number of occurrences of the letter a, including none:
a* is equivalent to any of the following: (nothing), a, aa, aaa, aaaa, and so on.
The following example requires that at least one letter a be present in the string to be matched:
a+ is equivalent to a, aa, aaa, aaaa, and so on.
The following is an example of a list that may or may not contain the letter a:
ba?b is equivalent to bb or bab.
To repeat instances of multiple-character patterns, the pattern is enclosed in parentheses. For
example, the expression (ab)+ is equivalent to ab or abab.
The underscore character (_) matches the beginning of a string (^), the end of a string ($),
parentheses, space, braces, comma, or underscore. The dot character (.) matches a single
character, including a white space.
Table 6-6. Sample Table Expressions and Resulting Outcomes for Regular Expressions
Routes to Be Advertised from RTA to the
NAP Expression Path Info Outcome
Local routes only ^$ 
All routes .* All paths 
Routes that originated from directly connected customers ^300$ ^100$       AS300 and 100
Connected customer routes and their customers' routes ^300_ ^100_ 
Routes that originated in AS200 _200$ 
Routes that passed via AS100 _100_ 
The ^$ expression indicates an empty path list, which is actually the local routes. (Recall that the local AS is not
attached to the path until advertisement to an EBGP occurs, so it's null.) The ^ and $ characters define the border
of the string. The underscore, as in _200$, limits the AS number to being exactly 200 and not 1200 or 2200.

ip as-path access-list 10 permit ^$
ip as-path access-list 4 permit ^1 6$
ip as-path access-list 4 permit ^1$
access-list 101 permit ip 193.78.0.0 0.0.255.255 255.255.0.0
0.0.0.0
route-map SET_OUTBOUND_TRAFFIC permit 10
match ip address 101
set local-preference 250
route-map SET_OUTBOUND_TRAFFIC permit 20
match as-path 4
set local-preference 250
Note that this route map will allow only partial routes (AS1 and AS6) to be injected into AS3 
by specifying the AS_PATH to be either AS1 (^1$) or AS6 (^1 6$).
Instead of listing all the customers of AS1 one by one as was done in AS path access
list 4, a regular expression of the form ^1 ?[0-9]*$ could have been used to identify all
the AS paths that start with 1 and that are of length 2—that is, AS1 and its direct
customers. The form of the access list would have been ip as-path access-list 4
permit ^1 ?[0-9]*$ (to enter the ?, press Ctrl-V first). Be careful, though. In the case
where AS1 is directly connected to another major provider with a direct link (rather
than via a NAP), the preceding regular expression would also give you the local routes
of that second provider.
Parentheses for Recall
As shown in the "Multipliers" section, you use parentheses with multiple-character regular expressions to multiply the occurrence of a pattern. You can also use parentheses around a single- or multiple-character pattern to instruct the IOS software to remember a pattern for use elsewhere in the regular expression.
To create a regular expression that recalls a previous pattern, you use parentheses to instruct memory of a specific pattern and a backslash (\) followed by an integer to reuse the remembered pattern. The integer specifies the occurrence of a parentheses in the regular expression pattern. If you have more than one remembered pattern in your regular expression, then \1 uses the first remembered pattern and \2 uses the second remembered pattern, and so on.
The following regular expression uses parentheses for recall:
a(.)bc(.)\1\2 
This regular expression matches the letter a followed by any character (call it character #1) followed by bc, followed by any character (character #2), followed by character #1 again, followed by character #2 again. In this way, the regular expression can match aZbcTZT. The software identifies character #1 as Z and character #2 as T and then uses Z and T again later in the regular expression.
The parentheses do not change the pattern; they only instruct the software to recall that part of the matched string. The regular expression (a)b still matches the input string ab, and (^3107) still matches a string beginning with 3107, but now the Cisco IOS software can recall the a of the ab string and the starting 3107 of another string for use later.

ACLs:
Using access lists to filter supernets or ranges of updates is trickier. Assume, for example, that
RTF in Figure 11-2 has different subnets of 172.16.X.X, and you want to advertise an
aggregate of the form 172.16.0.0/16 only. The following standard access list:
access-list 1 permit 172.16.0.0 0.0.255.255
would not work because it permits more than is desired. The standard access list looks at the
source IP address only and cannot check the length of the network mask. The preceding
access list will permit 172.16.0.0/16, 172.16.0.0/17, 172.16.0.0/18, 172.16.1.0/24, and so on.
To restrict the update to 172.16.0.0/16 only, you have to use an extended access list of this
form:
access-list access-list-number {deny | permit} protocol source sourcewildcard
destination destination-wildcard | mask mask-wildcard
This defines an extended access list that matches on a source destination or a source mask
tuple to permit or deny a specific routing update. The access list number falls between 100
and 199. In the case where the protocol is IP and you are checking on a source/mask tuple,
this would translate into the following:
access-list access-list-number permit ip network-number network-do-notcare-
bits mask mask-do-not-care-bits
For example:
access-list 101 permit ip 172.16.0.0 0.0.255.255 255.255.0.0 0.0.0.0
A 0 is an exact match bit, and a 1 is a do-not-care bit.

The preceding extended access list indicates that aggregate 172.16.0.0/16 is to be sent only
because you have indicated that the mask should match 255.255.0.0 exactly. An update of the
form 172.16.0.0/17 will not be allowed.
You could also accomplish this a couple of other ways. For example:
access-list 101 permit ip host 172.16.0.0 host 255.255.0.0
Or you could use a prefix list:
ip prefix-list 1 seq 5 permit 172.16.0.0/16
Remember that an ending implicit deny is assumed unless it is explicitly overridden.

Prefix Lists:
Example 11-13. RTA Prefix Filter
router bgp 3
no synchronization
neighbor 172.16.1.2 remote-as 3
neighbor 172.16.20.1 remote-as 1
neighbor 172.16.20.1 prefix-list 1 out
no auto-summary
!
ip prefix-list 1 seq 5 deny 192.68.10.0/24
ip prefix-list 1 seq 10 permit 0.0.0.0/0 le 32
In Example 11-13, the combination of the neighbor prefix-list router configuration command
and prefix list 1 prevents RTA from propagating prefix 192.68.10.0/24 to AS1. The prefix list
portion of the configuration identifies the prefixes, and when used in conjunction with the
BGP neighbor subcommand, it applies the filtering on the outgoing updates associated with
the specified neighbor (note the out keyword). Note that prefix list 1 ends with a logic that
permits all updates (permit 0.0.0.0/0 le 32). When you use prefix lists or access lists for
filtering, if no action is specified at the end of the access list statements, the logic of "deny
everything else" applies implicitly. This means that anything that did not match any of the
preceding instances will be denied. This is why it is important to specify the default action; in
this example, 192.68.10.0/24 will be denied, and everything else will be allowed. For this
reason, explicitly configuring the "deny everything else" – if you actually intend to– could
save you some headaches down the road.

Filter List:
neighbor 172.16.20.1 filter-list 10 out
no auto-summary
ip classless
ip as-path access-list 10 permit ^$