Routing policy tools: wildcard bits, prefix lists, distribute lists, offset lists and route-maps

Wildcard bits

ACLs and some routing commands use a wildcard mask rather than a subnet mask. A 0 bit means "this bit must match" and a 1 bit means "ignore this bit". For a whole subnet the wildcard is the inverse of the mask: 192.168.10.0 0.0.0.255 matches 192.168.10.0/24. Because wildcards do not have to be contiguous, they can also match patterns. For example, 192.168.1.0 0.0.254.255 matches the third octets 1, 3, 5 and so on: every odd-numbered /24 between 192.168.1.0 and 192.168.255.0. Try values with the wildcard mask calculator.

The weakness of ACLs for route filtering is that they match the network address but not the prefix length cleanly. That is where prefix lists come in.

Prefix lists

A prefix list matches a network and a range of prefix lengths. Each entry is checked in sequence order and the list ends with an implicit deny.

ip prefix-list BRANCH-LANS seq 5 permit 10.20.0.0/16 ge 24 le 24
ip prefix-list NO-DEFAULT seq 5 deny 0.0.0.0/0
ip prefix-list NO-DEFAULT seq 10 permit 0.0.0.0/0 le 32
show ip prefix-list

The first list matches every /24 inside 10.20.0.0/16, but not the /16 itself or smaller subnets. ge (greater or equal) and le (less or equal) set the range of lengths; without them only the exact prefix matches. The second list blocks the default route and permits everything else, because 0.0.0.0/0 le 32 matches any route.

Distribute lists and offset lists

A distribute list applies an ACL or prefix list to routing updates under a routing process, either inbound (which routes are accepted into the table) or outbound (which are advertised).

router eigrp 100
 distribute-list prefix BRANCH-LANS in GigabitEthernet0/1
router ospf 1
 distribute-list prefix NO-DEFAULT in

Distance vector protocols such as EIGRP and RIP filter the updates themselves. OSPF is different: every router in an area must hold the same link-state database, so an inbound distribute list only stops routes entering the routing table, not the database. Filtering OSPF properly is done between areas or at redistribution points.

An offset list adds a value to the metric of selected routes for RIP or EIGRP, making a path less attractive without removing it. It is a simple way to prefer one link over another for some networks.

access-list 10 permit 10.30.0.0 0.0.255.255
router eigrp 100
 offset-list 10 in 50000 GigabitEthernet0/2

Route-maps

A route-map is an ordered set of statements, each with a sequence number, a permit or deny action, optional match conditions and optional set actions. It is used for redistribution, BGP policy, policy-based routing and more.

route-map OSPF-TO-EIGRP deny 10
 match tag 200
route-map OSPF-TO-EIGRP permit 20
 match ip address prefix-list BRANCH-LANS
 set tag 100
 set metric 100000 100 255 1 1500
route-map OSPF-TO-EIGRP permit 30

Rules to remember: several conditions in one match line are OR; separate match lines in one statement are AND; a statement with no match matches everything; and anything that matches no statement is denied. In a deny statement the route is filtered and set lines are ignored. Check hit counts with show route-map.

Real-world example: keeping a supplier's routes tidy

A construction company connected a supplier's network with EIGRP so their stock systems could talk. Soon the company's routers held a default route from the supplier, and some internet traffic began flowing through the supplier's firewall. The engineer created a prefix list that permitted only the supplier's two /24 networks and applied it as an inbound distribute list on the link. Outbound, a second prefix list advertised only the stock server subnet. The default route disappeared, internet traffic returned to the company's own firewall, and the supplier could no longer see any internal networks.