BGP Inbound Route Filter using Prefix-List

[vantipov]

I am trying to understand why I have certain routes showing up in my BGP received-routes. 

neighbor 100.70.14.165 prefix-list ACCEPTED-FROM-VENDOR in

ip prefix-list ACCEPTED-FROM-VENDOR seq 10 permit 10.0.0.0/8
ip prefix-list ACCEPTED-FROM-VENDOR seq 30 permit 172.16.0.0/12
ip prefix-list ACCEPTED-FROM-VENDOR seq 20 permit 192.168.0.0/16

Yet I see routes advertised with 100.70.14.x subnets.  These inter-links between routers.  My thinking is that there's an explicit deny at the end of the prefix-list and 100.70.14.x doesn't match so should be rejected. 

#show ip bgp neighbors 100.70.14.165 received-routes

Network Next Hop Metric LocPrf Weight Path
* 100.70.14.160/31 100.70.14.165 0 1071 i
* 100.70.14.164/30 100.70.14.165 0 1071 i

What am I missing here?

[MHM Cisco World]

can I see how you config BGP?

MHM

[vantipov]

This is the section for this specific vendor. 

router bgp 1234
neighbor 100.70.14.165 remote-as 1071
neighbor 100.70.14.165 description VENDOR
neighbor 100.70.14.165 password xxxx
neighbor 100.70.14.165 version 4
!
address-family ipv4
neighbor 100.70.14.165 activate
neighbor 100.70.14.165 soft-reconfiguration inbound
neighbor 100.70.14.165 prefix-list ACCEPTED-FROM-VENDOR in
neighbor 100.70.14.165 prefix-list ADVERTISED-TO-VENDOR out
exit-address-family

ip prefix-list ACCEPTED-FROM-VENDOR seq 10 permit 10.0.0.0/8
ip prefix-list ACCEPTED-FROM-VENDOR seq 30 permit 172.16.0.0/12
ip prefix-list ACCEPTED-FROM-VENDOR seq 20 permit 192.168.0.0/16

ip prefix-list ADVERTISED-TO-VENDOR seq 10 permit 10.64.0.0/10

[MHM Cisco World · Accepted solution]

#show ip bgp neighbors 100.70.14.165 received-routes <<- this show prefix before filtering
show ip bgp <<- this show prefix after filtering 

MHM

[Harold Ritter]

Hi @vantipov ,

As @MHM Cisco World mentioned, the "received-routes" command show the bgp routes received from the neighbor before any inbound filtering. They are kept locally as a result of the "neighbor soft-reconfiguration inbound". 

For more information.please refer to the following document:

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_bgp/configuration/15-mt/irg-15-mt-book/irg-soft-config.html

Regards,

[Larry Sullivan]

Aside from what MHM mentioned, the command I use to get routes post filtering is "show ip bgp neighbors 100.70.14.165 routes"

[vantipov]

That makes sense.  I ran #show ip bgp | in 100.70.14.  and I do not see those routes.  I also ran #show ip bgp neighbors 100.70.14.165 routes and it shows zero routes. This helps.