BGP Policy 基于 AS path, community 或者prefix, 使用BGP路由策略的目的是为了拒绝/接受选定的路由,通过对属性 attributes的设置来影响选路。常用的工具有:
Prefix-list (filters prefixes)
Filter-list (filters ASes)
Route-maps and communities
一、先说prefix list, 基于网络(IP地址/掩码)的格式,可以应用与Inbound和Outbound,思科的prefix-list结束默认是deny。 顺便说一句, ACL方式(access-list)在思科的IOS里早就弃用了。
语法如下:
[no] ip[v6] prefix-list list-name [seq value] permit|deny
network/len [ge value] [le value]
network/len: The prefix and its length
ge value: “greater than or equal to”
le value: “less than or equal to”
Both “ge” and “le” are optional
--Used to specify the range of the prefix length to be matched for prefixes that are more specific than network/len
Sequence number is also optional
--[no] ip[v6]prefix-listsequence-number to disable display of sequence numbers
写几个示例:
1、拒绝IPV4/IPV6默认路由
ip prefix-list EG deny 0.0.0.0/0
ipv6 prefix-list EG-v6 deny ::/0
2、允许网络 36.0.0.0/8, IPV6网络 2001:DD8::/32
ip prefix-list EG permit 36.0.0.0/8
ipv6 prefix-list EG-v6 permit 2001:DD8::/32
3、拒绝网络 172.16.0.0/12 IPV6 3FFE::16
ip prefix-list EG deny 172.16.0.0/12
ipv6 prefix-list EG-v6 deny 3FFE::/16
4、允许192/8以上 /24以下网络 (除掩码/25,/26,/26,/28,/29,/30,/31,/32以外所有掩码高于192.0.0.0/8的网络)
允许IPV6 2000::/3 到 /48
ip prefix-list EG permit 192.0.0.0/8 le 24
ipv6 prefix-list EG-v6 permit 2000::/3 le 48
5、允许193/8 网络里从/12到 /20的网络 (允许 /12,/13,/14,/15,/16,/17,/18,/19,/20)
ip prefix-list EG permit 193.0.0.0/8 ge 12 le 20
6、允许所有
ip prefix-list EG permit 0.0.0.0/0 le 32
贴一段配置案例:
router bgp 100
address-family ipv4
network 105.7.0.0 mask 255.255.0.0
neighbor 102.1