BGP Filtering

Sat Jan 13 08:20:18 UTC 2001

I was assiting a customer the other day who was attempting to act as
transit to us (we were filtering it thank goodness).  Now my question is
why the AS_PATH list that I gave him did not work.  His AS is (let's
say) 65000, and he has a transit AS 65001.  He is multi-homed with AS1 and
AS6347.  Here is what I gave him:

ip as-path access-list 20 deny ^.*(_6347).*$
ip as-path access-list 20 deny ^.*(_1).*$
ip as-path access-list 20 permit .*

and I then applied it as a filter-list outbound on the neighbor.  This
worked great at filtering out the routes that he was originating.  As for
the routes that HIS transit customer was advertising, it didn't work at
all - they weren't getting advertised.  I thought that the access-list may
have been defective, so i changed the second line to ^.*(_1_).*$ but that
didn't help either.  What I wound up doing as a bandaid was putting in

ip as-path access-list 20 permit ^65001$

between the second deny and the permit .*.  Now I may not understand Cisco
regular expressions, but the first access-list the desired effect was to
deny everything with AS1 or AS6347 in the as-path and permit everything
else.  Why didn't this work as intended?

AS numbers changed to protect the innocent :).