Lab 12 — BGP Prefix Filtering — Prefix-List, ORF, and Distribute-List

Active Nodes

Active routers: BORDER-1, BORDER-2, EDGE-1, EDGE-4

Key Concepts

Prefix-List vs Distribute-List

Prefix-lists match based on both the network address and prefix length range (le/ge operators), making them more powerful than access-lists for BGP filtering. Example: permit 10.0.0.0/8 ge 24 le 28 matches any /24 through /28 subnet within 10.0.0.0/8. Distribute-lists using access-lists can only match on the network address bits, not the prefix length — prefix-lists should always be preferred for BGP filtering. Processing order matters: prefix-lists are evaluated sequentially, stopping at the first match.

Outbound Route Filtering (ORF)

ORF allows a BGP receiver to push its inbound prefix-list to the sender, which then applies the filter before transmitting. This reduces bandwidth and CPU on both sides — the sender only transmits prefixes the receiver will accept. ORF requires capability negotiation: both routers must support it. Configure with neighbor X capability orf prefix-list both. The "both" keyword means this router can send and receive ORF entries. Verify with show ip bgp neighbors X | include ORF.

BGP Maximum-Prefix Safety

The maximum-prefix N [warning-percentage] [warning-only | restart M] command protects against prefix leaks. When a neighbor advertises more than N prefixes, the session is torn down (or warned, or restarted after M minutes). In the CCIE context, this is a critical security and stability control — a single misconfigured CE advertising a full Internet routing table into the MPLS VPN can exhaust PE memory. Always configure maximum-prefix with an appropriate limit per VRF neighbor.

Filtering Configuration

BORDER-1Inbound/outbound prefix filtering + ORF

ip prefix-list CORP-OUT permit 10.255.0.0/16 le 32
ip prefix-list CORP-OUT permit 192.168.0.0/16 le 24

ip prefix-list ISP1-IN deny 10.0.0.0/8 le 32
ip prefix-list ISP1-IN deny 172.16.0.0/12 le 32
ip prefix-list ISP1-IN deny 192.168.0.0/16 le 32
ip prefix-list ISP1-IN permit 0.0.0.0/0 ge 0 le 24

router bgp 65001
 address-family ipv4
  neighbor 198.51.100.2 prefix-list ISP1-IN in
  neighbor 198.51.100.2 prefix-list CORP-OUT out
  neighbor 198.51.100.2 maximum-prefix 750000 80 warning-only
  neighbor 198.51.100.2 capability orf prefix-list both

Verification

show ip bgp neighbors 198.51.100.2 received-routes

Expected: Only routes passing prefix-list ISP1-IN shown. Private address space (RFC1918) should be absent.

show ip bgp neighbors 198.51.100.2 | include ORF

Expected: "Outbound Route Filter (ORF) capability" negotiated. Prefix-list sent to peer visible.

show ip bgp neighbors 198.51.100.2 prefix-list CORP-OUT

Expected: Only corporate prefix ranges advertised outbound — no internal subnets leaked to ISP.

Research and direction by Ioannis (John) Konstas; compiled and finalized with AI assistance.