1. © 2005 Cisco Systems, Inc. All rights reserved. BGP v3.2—3-1 Route Selection Using Policy Controls Employing AS-Path Filters

2. © 2005 Cisco Systems, Inc. All rights reserved. BGP v3.2—3-2 Outline Overview AS-Path Filtering Scenarios AS-Path Regular Expressions String Matching Applying AS-Path Filters Configuring BGP AS-Path Filters Monitoring AS-Path Filters Summary

3. © 2005 Cisco Systems, Inc. All rights reserved. BGP v3.2—3-3 AS-Path Filtering Scenarios Several scenarios require BGP route filtering based on AS path. –Announce only local routes to the ISP—AS path needs to be empty –Select routes based on a specific AS number in the AS path –Accept routes for specific AS only from some BGP neighbors AS-path filters use regular expressions.

4. © 2005 Cisco Systems, Inc. All rights reserved. BGP v3.2—3-4 AS-Path Regular Expressions 273131723223 | 27 31 23 317 223 | AS-path converted to string ip as-path access-list 1 permit31 String matched with regexp

5. © 2005 Cisco Systems, Inc. All rights reserved. BGP v3.2—3-5 String Matching―Regular Expressions A string of characters in a regular expression matches any equivalent substring in the AS path. How many times does 31 match? |213 317 2316 31| Answer: |213 317 2316 31|

6. © 2005 Cisco Systems, Inc. All rights reserved. BGP v3.2—3-6 String Matching―Alternatives Expression expr1|expr2 matches the string if either subexpression matches the string. How many times does 21|31 match? |213 317 2316 31| Answer: |213 317 2316 31|

7. © 2005 Cisco Systems, Inc. All rights reserved. BGP v3.2—3-7 String Matching―Ranges and Wildcard Characters A range of characters matches any single character in the range. Examples: [1234] or [1-4] Dot (.) matches any single character How many times does [1-3].[34] match? |213 317 2316 31| Answer: |213 317 2316 31| |213 317 2316 31|

8. © 2005 Cisco Systems, Inc. All rights reserved. BGP v3.2—3-8 String Matching―Matching Delimiters ^Matches beginning of string $Matches end of string _Matches any delimiter (beginning, end, white space, tab, comma) How many times does ^21, 31$, _31_ match? |213 317 218 31 731| Answer: |213 317 218 31 731|

9. © 2005 Cisco Systems, Inc. All rights reserved. BGP v3.2—3-9 String Matching―Grouping Parentheses can be used to group smaller regular expressions into larger expressions. How many times does (213|218)_31 match? |213 317 1218 316 31| Answer: |213 317 1218 316 31|

10. © 2005 Cisco Systems, Inc. All rights reserved. BGP v3.2—3-10 String Matching―Special Characters \To use the special characters as single-character patterns, remove the special meaning by preceding each character with a backslash (\). How do you match AS 213 in the beginning of the string? |(213 317) 1218 316 31| Answer: ^\(213_

11. © 2005 Cisco Systems, Inc. All rights reserved. BGP v3.2—3-11 String Matching―Repeating Operators *Matches zero or more atoms ?Matches zero or one atom +Matches one or more atoms An atom is a single character or a grouping. How do you match AS sequences “23 45” and “23 78 45” in a single regular expression? Answer: _23(_78)?_45_

12. © 2005 Cisco Systems, Inc. All rights reserved. BGP v3.2—3-12 String Matching―Sample Regular Expressions _100_ ^100$ _100$ ^100_. ^ [0-9]+$ ^([0-9]+)(_\1)*$ ^$.* Going through AS 100 Directly connected to AS 100 Originated in AS 100 Networks behind AS 100 AS paths one AS long Prepending performed in neighboring originating AS Networks originated in local AS Matches everything

13. © 2005 Cisco Systems, Inc. All rights reserved. BGP v3.2—3-13 Commonly Used Characters in Expressions. Any single character, including a space * Zero or more sequence of pattern +One or more sequence of pattern ?Zero or one occurrence of pattern ^Beginning of string $End of string _Match any delimiter (including beginning, end, space, tab, comma) \Remove special meaning of character that follows [ ]Match one character in a range |Logical OR

14. © 2005 Cisco Systems, Inc. All rights reserved. BGP v3.2—3-14 Applying AS-Path Filters

15. © 2005 Cisco Systems, Inc. All rights reserved. BGP v3.2—3-15 Configuring BGP AS-Path Filters ip as-path access-list number {permit|deny} regexp router(config)# Configures AS-path access-list neighbor ip-address filter-list as-path-filter {in|out} router(config-router)# Configures inbound or outbound AS-path filter for specified BGP neighbor

16. © 2005 Cisco Systems, Inc. All rights reserved. BGP v3.2—3-16 Configuring BGP AS-Path Filters (Cont.)

17. © 2005 Cisco Systems, Inc. All rights reserved. BGP v3.2—3-17 router# Displays all routes in the BGP table matching regular- expression in one or all filter-lists Monitoring AS-Path Filters show ip as-path-access-list [filter list] router# Displays one or all filter-lists show ip bgp filter-list access-list-number router# Displays all routes in the BGP table permitted by the specified AS-path access-list show ip bgp regexp regular-expression

18. © 2005 Cisco Systems, Inc. All rights reserved. BGP v3.2—3-18 The show ip as-path-access-list Command Displaying configured filters:

19. © 2005 Cisco Systems, Inc. All rights reserved. BGP v3.2—3-19 The show ip bgp regexp Command Routes matched by an expression:

20. © 2005 Cisco Systems, Inc. All rights reserved. BGP v3.2—3-20 The show ip bgp filter-list Command Routes matched by a filter-list:

21. © 2005 Cisco Systems, Inc. All rights reserved. BGP v3.2—3-21 Summary Several scenarios require BGP route filtering based on AS path, including announcing only local routes to the ISP (AS path needs to be empty), selecting routes based on a specific AS number in the AS path, and accepting routes for a specific AS only from some BGP neighbors. By applying specific selection criteria to the contents of the AS-path attribute, routers can select a subset of routes from the total set of routes that are received. Cisco IOS software internally translates the AS-path encoding, which is carried with all BGP routes into a character string. This string is then tested against the regular expression. String matching operates when you are using AS-path regular expressions to match BGP routes.

22. © 2005 Cisco Systems, Inc. All rights reserved. BGP v3.2—3-22 Summary (Cont.) You can use AS-path filters to select those routes that will be allowed. An AS-path filter is created by an AS-path access-list, which is applied to a set of routes from which to select a subset. The ip as-path access-list global configuration command defines a BGP AS-path access-list, and the neighbor filter-list router configuration command sets up a BGP filter. There are a number of Cisco IOS commands that are required to monitor the operation of configured AS-path filters, including show ip as-path-access-list, show ip bgp regexp, and show ip bgp filter-list.

23. © 2005 Cisco Systems, Inc. All rights reserved. BGP v3.2—3-23