BGP regular expresion match sequence

[fcardoso]

I want to block paths that contain exactly 8 consecutive repetitions of AS 64601, even if they are preceded or followed by other ASes (like in the example 5555 64601 64601 ... 66666)."

Tanks

Antonio

[M02@rt37]

Hello @fcardoso 

You want to do this on which platform and which IOS ?

[fcardoso]

Yes, in IOS XE

The platform ia a ASR 903

[M02@rt37]

Ok @fcardoso , Thanks.

Regarding this doc: https://www.cisco.com/c/en/us/td/docs/security/security_management/cs-mars/4-3/user/guide/local_controller/appreexp.html

you could use {n} regex like this:

ip as-path access-list 10 deny ^64601{8}_
ip as-path access-list 10 deny _64601{8}$
ip as-path access-list 10 deny ^64601{8}$

This entries will block any BGP path that contains exactly 8 consecutive occurences of AS 64601.

--

Apply this on a RM:

route-map FILTER_Deny-8x64601 deny 10
match as-path 10
route-map FILTER_Deny-8x64601 permit 20

router bgp #ASN#
neighbor #NEIGH.IP# route-map FILTER_Deny-8x64601 in

[fcardoso]

Hi, thanks very mutch for the help...

I did a simple text: 

#sh bgp vpnv4 unicast vrf xxx

64601 64601 64601 64601 64601 64601 64601 64601 66666

64601 64601 64601 64601 64601

then:

#sh bgp vpnv4 unicast vrf xxx regexp ^64601{8}_ 

and it didn't work, did not receive anythink....

that is, the following sequence should have appeared:

64601 64601 64601 64601 64601 64601 64601 64601 66666

the ios version16.09.04 and the platform ASR-903 (RSP3_200) maybe is not compatible with  metacharacters like {}...

Best regards

[M02@rt37 · Accepted solution]

Hello @fcardoso 

You seem to be right about that (another) limitation on that platform...

So, if you want to match 8 instances of 64601 with no shortcut with {8} quantifier ; you should list them one by one separated by _ ?

[MHM Cisco World]

I will check this point I will reply tonight.

Please confirm if you still interest for answer 

MHM

[fcardoso]

Yes I'm still interested...

thank you very much for your help..

Antonio

[MHM Cisco World]

ip as-path access-list 20 deny _64601 +64601_

Try above 

Update me 

MHM