Route filtering with BGP

Route filtering can be done with "ACL","prefix-list" and "offset-list" with a  combination of "route-map",here i am using the BGP as a routing protocol between different autonomous systems.i apply the route filtering at router R2 which it going to effect the R4 routing table.This filtering can be applied any where depends up on our requirement.

let me show you the BGP routing table of R4 without a route filtering configured at R2
i shutdown the interface between the R0 and R4 to make R4 to reach the other networks via R2, so when we see the routing table of R4 with "show ip  bgp" command.

2.2.2.2 is the R2's loopback address and 4.4.4.4 is the R4's loopback address.As we observe R4 can reach all the networks of 10.2.0.0/30,119.227.0.0/30,128.0.0.0/30 via 2.2.2.2 and 10.0.0.0/30 is a local network to R4

Now i will the configure the route filtering on R2.Here my policy is to prevent R4 to learn about 10.2.0.0/30 network.so my configuration on R2 as follows.

First create an access-list in global configuration mode which should match 10.2.0.0/30 network

access-list 1 permit 10.2.0.0 0.0.0.3

Then create an route-map with name "DENY" with "deny" clause and sequence number "10" which deny's the 10.2.0.0/30 network.

route-map DENY deny 10

match ip address 1

now to accept the remaining routes, create a permit clause with same name with different sequence number

route-map DENY permit 15


Apply this route-map in R2's BGP configuration as

 neighbor 4.4.4.4 route-map DENY out

i configured the route-map for neighbor 4.4.4.4 as "out" because the routes are advertising by R2 to R4

now most important command when applying route filtering in BGP  is
clear ip bgp 4.4.4.4 if we don't clear the bgp process for R4 the route filtering configuration wont take effect in BGP

If we observe the routing table of R4

the route for 10.2.0.0/30 is filtered and remaining are allowed.

This can be done with prefix-list also so i am going to post that in other post with explanation of route redistribution when different routing protocols are used in the network.

Policy based routing

In this post im going to explain policy based routing with "ospf" as a protocol in the below topology,i configured ospf on all the routers to get the full reachability between all the routers, Generally routing decisions by router is based on the routing table but when we configure the policy based routing then the decisions are taken based on the policy based routing configuration.when a packet arrives at particular interface of a router,the incoming packet actually arrives encapsulated inside a data link layer frame then the router strips of the frame and looks into the L3 packet. considering the information in the packet the router thus takes the forwarding decisions by comparing with the routing table.

when the PBR is configured,it intercepts the router's natural destination based forwarding address logic.PBR takes decision by using the matching logic defined through a route map,which in turn refers to the IP ACL.


The router "5.5.5.5" can reach the "12.0.1.0 network" via two routers "4.4.4.4" and "12.12.12.12", take a look at the routing table of "5.5.5.5"



now if we see the R6 path to reach the destination of "12.0.1.1" using traceroute.





the path is via "5.5.5.5" to "12.12.12.12" and to the "12.0.1.1" , now think that we want the traffic to be routed via 4.4.4.4 instead via 12.12.12.12  then configure the policy on 5.5.5.5 router , first create the "route-map" with "ACL" and apply that route-map on the interface.The packets from R6 reach to s0/1 of 5.5.5.5 ,apply the policy on this incoming interface.

interface Serial0/1
 ip address 11.2.0.6 255.255.255.252
 ip policy route-map ROUTE

now create the route-map with name as "ROUTE" with permit clause and set the next hop as follows

route-map ROUTE permit 10
 match ip address 110
 set ip next-hop 11.1.0.1

In the above command 110 refers to the access-list that i created, create the access-list as

access-list 110 permit ip host 11.2.0.5 12.0.1.0 0.0.0.3

the above configuration exactly matches the frames coming from source 11.2.0.5 to the destination 12.0.1.0/30 network so all the traffic will route through 11.1.0.1

Observe the Result,all the traffic from 11.2.0.5 routed via 11.1.0.1

Result: