HOW to filter EIGRP with ACL

[belemdavidarmand]

Hello;

I have this configuration in my network.i want to implement filtering with ACL in EIGRP.

This is my config

HQ

router eigrp 226

network 10.10.250.8 0.0.0.7

network 172.16.32.0 0.0.0.255

redistribute static

neighbor x.y.32.253 GigabitEthernet0/0/0

neighbor x.y.32.252 GigabitEthernet0/0/0

neighbor x.y.32.251 GigabitEthernet0/0/0

  eigrp log-event-type dual xmit

!

spoke1

router eigrp 226

network w.q.8.0 0.0.0.63

network w.q.8.64 0.0.0.31

network w.q.8.96 0.0.0.7

network w.q.8.128 0.0.0.127

network x.y.32.0 0.0.0.255

network 192.168.254.0 0.0.0.7

redistribute static

neighbor x.y.32.254 GigabitEthernet0/0/0

!

spoke2

router eigrp 226

network w.q.9.0 0.0.0.63

network w.q.9.64 0.0.0.31

network w.q.9.96 0.0.0.7

network w.q.9.128 0.0.0.127

network x.y.32.0 0.0.0.255

network 192.168.254.0 0.0.0.7

redistribute static

neighbor x.y.32.254 GigabitEthernet0/0/0

!

spoke3

router eigrp 226

network w.q.10.0 0.0.0.63

network w.q.10.64 0.0.0.31

network w.q.10.96 0.0.0.7

network w.q.10.128 0.0.0.127

network x.y.32.0 0.0.0.255

network 192.168.254.0 0.0.0.7

redistribute static

neighbor x.y.32.254 GigabitEthernet0/0/0

!

Someone knows how to do?

Thanks

[MHM Cisco World]

filter what exactly ?

[belemdavidarmand]

Hello,

in my case i have a certification recommandation that oblige me to apply an ACL to filter EIRGP routes.I want to put this ACL without any changes.

Thanks

[MHM Cisco World]

EIGRP Route Filtering with Distribute List | by Anggara | Network Warrior | Medium

you can user distribute-list 

[David Ruess]

Hello,

You can try this:

http://technologyordie.com/eigrp-route-filtering-with-acls

-David

[belemdavidarmand]

Hello,

@David Ruess in my case the distribue list must be in or out on my interface gigabitethernet 0/0/0?

[David Ruess]

If you just have the in/out keyword with NO interface after then it filters the route specified in the ACL form all interfaces in or out. If you have an interface configured with it, it will only filter routers coming/going form that specific interface. So its whatever your requirement is.

-David

[belemdavidarmand]

Hello;

can i only use distribute out on the differents interfaces(that joined HQ) on spokes and also use distribute out in the interface (who joigned neihbors) ?

[MHM Cisco World]

you are not inform us what you want to filter, which prefix ?
I see that many neighbors is reachable via same interface so please config this ?

[belemdavidarmand]

Hello,

I want to just apply a permit ACL to eirgp.Just to be conform to certification

[MHM Cisco World]

Lab,
the issue with of Filter prefix in your case is the Hub-Spoke design, 
I do more than one lab and failed to filter the prefix in Hub why ? because the Hub use same interface for all neighbours, and I make fast check the EIGRP don't have per-nieghbor prefix filter. 
so I go to other solution 
in my lab the R3 advertise two prefix 3.3.3.3/32 and 33.33.33.33/32

I config distribute-list with direction IN in Spoke R2 to filter what it can get from Hub+Spoke R3
this deny 33.33.33.33 and allow all other prefix. 

hostname R1
interface FastEthernet0/0
ip address 100.0.0.1 255.255.255.0
no ip next-hop-self eigrp 100
no ip split-horizon eigrp 100
duplex half
!
router eigrp 100
network 100.0.0.0 0.0.0.255
neighbor 100.0.0.2 FastEthernet0/0
neighbor 100.0.0.3 FastEthernet0/0

hostname R3
interface Loopback0
ip address 3.3.3.3 255.255.255.255
!
!
interface Loopback10
ip address 33.33.33.33 255.255.255.255
!
!
interface FastEthernet0/0
ip address 100.0.0.3 255.255.255.0
duplex half
!
router eigrp 100
network 3.3.3.3 0.0.0.0
network 33.33.33.33 0.0.0.0
network 100.0.0.0 0.0.0.255
neighbor 100.0.0.1 FastEthernet0/0

hostname R2
!
interface FastEthernet0/0
ip address 100.0.0.2 255.255.255.0
duplex half
!
router eigrp 100
distribute-list prefix 33.33.33.33 in FastEthernet0/0
network 100.0.0.0 0.0.0.255
neighbor 100.0.0.1 FastEthernet0/0
!
ip prefix-list 33.33.33.33 seq 10 deny 33.33.33.33/32
ip prefix-list 33.33.33.33 seq 20 permit 0.0.0.0/0 le 32