how to use BGP to partially isolate a site

[tachyon05]

I have sites that are connected to each other via BGP.  Each site BGP configuration has prefix lists that controls what routes are allowed to be learned from / advertised to BGP.  Currently all sites can communicate with each other.   What is the best / most efficient way achieve the below goals?

1. site # 3 can only talk with site # 6.
2. site # 6 can talk with all sites, including site # 3.
3. all sites (except # 3) can talk with each other.

I thought about changing site # 3 prefix list to only learn the CIDR from site # 6, this would break all return traffic back to other sites from leaving site # 3.  I suppose all apps that need some kind of handshake would not be able to function, but this method doesn't prevent other sites' traffic from reaching site # 3.

[MHM Cisco World]

You can use 

1- community for each site' abd then filter community-list to permit or deny the prefix 

2- use AS-path list to permit or deny the prefix

Remember if the router dont have prefix for remote site it cannot forward traffic to that site

MHM

[rais]

Looks like site3 is a transit for other sites. A diagram would help.

Thanks.

[paul driver]

Hello
can you elaborate more on the topology of your network- are these sites in their own bgp domain (ASN) or are that in the same ASN
What transit transport do they use to connect  -mpls-internet etc…
what internal routing process is running at each site?
do each site receive full bgp tables or partial or default route ?

[tachyon05]

Each site has their own private AS.  They connect using SDWAN.  Internal routing is a mix ranging from EIGRP to static.  Each site has BGP prefix lists that control routes learned and advertised from/to SDWAN.  Site # 3 is not a transit site - it is one of the remote offices.  I don't have community list or AS path list in use anywhere, and I am hoping to find a way to achieve the goal by just reconfiguring site # 3.  Thanks

[MHM Cisco World]

Sdwan that other story 

Are you sure site3 is not hub?

Are you sure the tloc not point to site3

MHM

[tachyon05]

Not sure what you mean by hub.  Site 3 is not the headquarter, and it is not a HUB (in a spoke - hub setup).  It is one of the remote offices, just like other remote offices we have.  I am not sure what is tloc.  The SDWAN is a managed solution, I can only control what routes are learned and advertised.