BGP Filters

[fmugambi]

Hello Family,

I have applied prefix-list and route-maps as below,

ip prefix-list MEB-IN seq 15 permit 10.251.0.10/32
ip prefix-list MEB-IN seq 20 permit 10.251.0.11/32
ip prefix-list MEB-IN seq 25 permit 10.251.0.13/32
ip prefix-list MEB-IN seq 30 permit 10.251.0.14/32
match ip address prefix-list MEB-IN
route-map MEB-IN permit 10
match ip address prefix-list MEB-IN

Why am i still learning more those prefixes, to be exact 110 from the neighbor have applied the route map in direction?

[M02@rt37]

Hello @fmugambi 

where are you apply this route-map ?

ip prefix-list MEB-IN seq 15 permit 10.251.0.10/32
ip prefix-list MEB-IN seq 20 permit 10.251.0.11/32
ip prefix-list MEB-IN seq 25 permit 10.251.0.13/32
ip prefix-list MEB-IN seq 30 permit 10.251.0.14/32

route-map MEB-IN permit 10
match ip address prefix-list MEB-IN

route-map MEB-IN deny 20

[fmugambi]

neighbor 172.30.129.37 activate
neighbor 172.30.129.37 soft-reconfiguration inbound
neighbor 172.30.129.37 route-map MEB-IN in
neighbor 172.30.129.37 route-map ISL-PREFIX-LIST out
neighbor 172.30.138.145 activate
neighbor 172.30.138.145 weight 100
neighbor 172.30.138.145 soft-reconfiguration inbound
neighbor 172.30.138.145 route-map MEB-IN in
neighbor 172.30.138.145 route-map ISL-PREFIX-LIST out

[Harold Ritter]

Hi @fmugambi ,

Make sure you do a "clear bgp ipv4 uni * soft in" to force the updates from the neighbor to be processed by the new routing policy.

[fmugambi]

i had run this,
clear ip bgp * soft in

its on cisco 4431 isr router

was that not sufficient?

[Harold Ritter]

Hi @fmugambi ,

Bear in mind that since you have "soft-reconfiguration inbound" configured, BGP will keep all the routes received from the neighbours. The state of the routes rejected by the route-map should be "received only".  These prefixes will not be used by BGP for its best path selection and they will not be installed in the RIB.

[fmugambi]

If don't need to learn them at all, i disable inbound soft configuration?

[Harold Ritter]

Yes, you can definitely disable the "soft-reconfiguration inbound". The only difference when disabling this feature it that when you do a "clear ip bgp * soft in" or "clear bgp ipv4 uni * soft in" , BGP will send a refresh message to the neighbor in order for the neighbor to resend all of the routes. 

[MHM Cisco World]

Are this issue still not solve ?

MHM

[fmugambi]

Hi, I was looking for a solution that did not involve disabling soft inbound configuration.

[Harold Ritter]

Hi @fmugambi ,

There is no need to disable the soft reconfiguration inbound feature. If you keep enabled, all prefixes received by the neighbor are kept locally. They are processed through the routing policy and only the prefixes accepted by that policy are considered for the BGP best path selection algorithm. 

[fmugambi]

noted,
question; whats then the difference of having the prefix-list and route-map with just the "match prefix-list " statement alone?

[Harold Ritter]

Hi @fmugambi ,

The purpose of the soft reconfiguration inbound feature is as mentioned previously to keep a local copy of all the updates sent by the peer. It is useful for two things. 

1. See what are the updates that are received from the peer before any routing policy is applied.

 2. Allows to reprocessed all the updates sent by peer without resetting the session. Note that this was very useful before the route refresh capability was added to bgp. With the addition of this capability, you can perform a "clear bgp ipv4 uni * soft in" without the "soft reconfiguration inbound" being configured. When a "clear bgp ipv4 uni * soft in" is issued on the local peer, a bgp route refresh message is sent to the remote peer asking this peer to sent all the reset all the updates.

Note that one disadvantage of the "soft reconfiguration inbound" is that it can consume a lot of additional memory if you receive lots of routes from your peer, but you only accept a few with your routing policy. An extreme example of that would be receiving the full internet routing table and the default route from the peer and only accepting the default route. I have unfortunately seen this mistake being made in the past.

[MHM Cisco World]

Prefix-list permit/deny prefix only 

Route-map permit/deny prefix with modify some attribute.

For soft' check if the both peer support 

Route Refresh >> show ip bgp neighbors' check the capability

MHM

[Harold Ritter]

Hi @MHM Cisco World ,

> Route Refresh >> show ip bgp neighbors' check the capability

This capability is defined by RFC2918, which is 25 years old. So very likely that it is supported on all devices used these days.

https://datatracker.ietf.org/doc/html/rfc2918