Problem with PREFIX-LIST and route-map BGP

[axelhauguel]

Hello,

In my BGP configuration, I would like to filter what peers send me but the concern is that it seems that my prefix list does not block everything.

Everything works in IPv4 but not in IPv6.

ipv6 prefix-list PFX-AS212815FRR-IRR-V6 seq 12 permit 2a10:4640::/48 
ipv6 prefix-list PFX-AS212815FRR-IRR-V6 seq 25 permit 2a10:4646:16::/48 
ipv6 prefix-list PFX-AS212815FRR-IRR-V6 seq 26 permit 2a10:4646:3::/48 
ipv6 prefix-list PFX-AS212815FRR-IRR-V6 seq 30 permit 2a10:4646:15::/48 
ipv6 prefix-list PFX-AS212815FRR-IRR-V6 seq 31 permit 2a10:4646:11::/48 
ipv6 prefix-list PFX-AS212815FRR-IRR-V6 seq 32 permit 2a10:4646:60::/44 
ipv6 prefix-list PFX-AS212815FRR-IRR-V6 seq 33 permit 2a10:4646:10::/48 
ipv6 prefix-list PFX-AS212815FRR-IRR-V6 seq 34 permit 2a10:4646:7::/48 
ipv6 prefix-list PFX-AS212815FRR-IRR-V6 seq 35 permit 2a10:4646:9::/48 
ipv6 prefix-list PFX-AS212815FRR-IRR-V6 seq 36 permit 2a10:4647::/48 
ipv6 prefix-list PFX-AS212815FRR-IRR-V6 seq 37 permit 2a10:4647:1::/48 
ipv6 prefix-list PFX-AS212815FRR-IRR-V6 seq 38 permit 2a10:4646:50::/44 
ipv6 prefix-list PFX-AS212815FRR-IRR-V6 seq 95 permit 0::/0 ge 128 
ipv6 prefix-list PFX-AS212815FRR-IRR-V6 seq 100 deny 0::/0 le 128 

route-map RPL-AS212815FRR-CUST-IN-V6 permit 100
  match ip address prefix-list PFX-AS212815FRR-IRR-V6 
route-map RPL-AS212815FRR-CUST-OUT-V6 permit 100

  template peer NBRGRP-AS212815FRR-CUST-V6
    remote-as 212815
    remove-private-as
    address-family ipv6 unicast
      send-community
      route-map RPL-AS212815FRR-CUST-IN-V6 in
      route-map RPL-AS212815FRR-CUST-OUT-V6 out
      maximum-prefix 12
      next-hop-self
      soft-reconfiguration inbound always

PAR-N9K-1(config-router)# sh ipv6 bgp neighbors 2a10:4640:1::3 received-routes 

Peer 2a10:4640:1::3 routes for address family IPv6 Unicast:
BGP table version is 272264, Local Router ID is 193.38.250.1
Status: s-suppressed, x-deleted, S-stale, d-dampened, h-history, *-valid, >-best
Path type: i-internal, e-external, c-confed, l-local, a-aggregate, r-redist, I-injected
Origin codes: i - IGP, e - EGP, ? - incomplete, | - multipath, & - backup, 2 - best2

   Network            Next Hop            Metric     LocPrf     Weight Path
*>i2a10:4646:3::/48   2a10:4640:1:cafe::1a
                                               0        100          0 42101 i
*>i2a10:4646:11::/48  2a10:4640:1:cafe::12
                                               0        100          0 212106 i
*>i2a10:4646:15::/48  2a10:4640:1:cafe::16
                                               1        100          0 212066 ?
*>i2a10:4646:16::/48  2a10:4640:1:cafe::17
                                               0        100          0 212022 i
*>i2a10:4646:18::/48  2a10:4640:1:cafe::1b
                                                        100          0 211812 i
*>i2a10:4646:60::/44  2a10:4640:1:cafe::12
                                               0        100          0 212106 i
*>i2a10:4647::/48     2a10:4640:1:cafe::13
                                               0        100          0 50046 i
*>i2a10:4647:1::/48   2a10:4640:1:cafe::13
                                               0        100          0 50046 i
*>i2a10:4647:2::/48   2a10:4640:1:cafe::13
                                               0        100          0 50046 i
*>i2a10:4647:66::/48  2a10:4640:1:cafe::13
                                               0        100          0 50046 i

PAR-N9K-1(config-router)# 

For example, I get the prefix "2a10:4647:2::/48" when I did not allow it. if I remove the route-map, it doesn't allow any prefixes anymore, so I don't think I made any spelling mistakes. 

An idea?

Thanks !

Axel

[Harold Ritter · Accepted solution]

Hi Axel,

Your route-map is incorrect, as you match on ip rather than on ipv6. Change it as follow:

route-map RPL-AS212815FRR-CUST-IN-V6 permit 100
  match ipv6 address prefix-list PFX-AS212815FRR-IRR-V6 

Regards,

[axelhauguel]

Thanks a lot @Harold Ritter ! My mistake :((

If you have a few time, can you check my other issue ? : Error: Hw Trie full(201)

Thanks

[Harold Ritter]

Hi Axel,

I just replied in the other thread.

Regards,