WEBVTT

1
00:00.000 --> 00:07.720
So let's jump in and begin our discussion by taking a look at route filtering.

2
00:07.720 --> 00:11.280
Now route filtering is of course a very simple concept.

3
00:11.280 --> 00:16.120
We're just going to prevent routes from either being received or sent or maybe

4
00:16.120 --> 00:16.840
even put into

5
00:16.840 --> 00:18.960
our own local routing table.

6
00:18.960 --> 00:22.950
So it's simply a matter of preventing routes from showing up where we don't

7
00:22.950 --> 00:24.440
want them to.

8
00:24.440 --> 00:27.280
And there's several reasons we may want to do that.

9
00:27.280 --> 00:31.840
We may want to do it for security, for traffic engineering, or just to make
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

9
00:27.280 --> 00:31.840
We may want to do it for security, for traffic engineering, or just to make

10
00:31.840 --> 00:32.680
sure that we

11
00:32.680 --> 00:37.070
don't leak routes to where they don't belong, such as private routes getting

12
00:37.070 --> 00:37.760
leaked out

13
00:37.760 --> 00:39.040
into the internet.

14
00:39.040 --> 00:41.800
So there's several reasons we might want to do this.

15
00:41.800 --> 00:46.560
And there's several methods we can do to accomplish route filtering.

16
00:46.560 --> 00:51.000
We can even use like administrative distance to do route filtering.

17
00:51.000 --> 00:55.940
But in this video, we're going to be focusing on two of the major methods that

18
00:55.940 --> 00:56.600
we use to

19
00:56.600 --> 01:03.590
do route filtering, the first being prefix lists, and the second being AS path
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

19
00:56.600 --> 01:03.590
do route filtering, the first being prefix lists, and the second being AS path

20
01:03.590 --> 01:04.680
filters.

21
01:04.680 --> 01:10.720
Now AS path filters are specific to BGP, but that is what we're heading to in

22
01:10.720 --> 01:11.880
this skill.

23
01:11.880 --> 01:18.760
So let's jump in and take a look at some more detail on our route filtering.

24
01:18.760 --> 01:24.410
So without filtering, we're generally going to be using one of three constructs

25
01:24.410 --> 01:24.480
.

26
01:24.480 --> 01:28.000
Now one of them is not very popular, which is ACLs.

27
01:28.000 --> 01:32.790
We're not going to spend any time talking about access control lists first
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
01:28.000 --> 01:32.790
We're not going to spend any time talking about access control lists first

28
01:32.790 --> 01:34.040
because they're,

29
01:34.040 --> 01:35.920
well, relatively well known.

30
01:35.920 --> 01:37.840
I don't think we need to cover them here.

31
01:37.840 --> 01:42.720
I'm sure they've been covered plenty in other courses that you've taken.

32
01:42.720 --> 01:48.190
The other one, however, is prefix lists, which overall is a better choice

33
01:48.190 --> 01:49.040
anyway.

34
01:49.040 --> 01:51.520
And these are a little bit less understood.

35
01:51.520 --> 01:55.560
So we will spend some time here talking about prefix lists.

36
01:55.560 --> 02:01.520
And finally, the one that is specific to BGP, your AS path filters.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

36
01:55.560 --> 02:01.520
And finally, the one that is specific to BGP, your AS path filters.

37
02:01.520 --> 02:04.440
These are also not quite as commonly understood.

38
02:04.440 --> 02:08.120
So we'll spend some time on AS path filters as well.

39
02:08.120 --> 02:13.160
Also keep in mind that although these items can be used individually, these are

40
02:13.160 --> 02:14.400
quite often

41
02:14.400 --> 02:16.840
used inside of a route map.

42
02:16.840 --> 02:22.390
So in other words, in our route map, we would match on one of these items and

43
02:22.390 --> 02:23.240
then perform

44
02:23.240 --> 02:27.080
some sort of an action on that particular route.

45
02:27.080 --> 02:31.580
So again, yes, we can use them by themselves, but they are quite commonly used
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

45
02:27.080 --> 02:31.580
So again, yes, we can use them by themselves, but they are quite commonly used

46
02:31.580 --> 02:32.400
with a route

47
02:32.400 --> 02:33.920
map.

48
02:33.920 --> 02:38.280
Also as we mentioned, ACLs are really not the best choice for this.

49
02:38.280 --> 02:43.080
The reason is there's no good way to match on the prefix length.

50
02:43.080 --> 02:45.360
In other words, the subnet mask.

51
02:45.360 --> 02:50.080
We can certainly match on the network itself, but matching on the mask.

52
02:50.080 --> 02:53.080
It can be done using an extended ACL.

53
02:53.080 --> 02:58.360
But again, this is really not a great choice, particularly when we have prefix

54
02:58.360 --> 02:59.240
lists right

55
02:59.240 --> 03:03.720
here that were designed for this specific purpose.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

55
02:59.240 --> 03:03.720
here that were designed for this specific purpose.

56
03:03.720 --> 03:08.400
So on that note, let's jump in and talk a little bit about these prefix lists.

57
03:08.400 --> 03:15.170
This gives us the ability to match on the prefix and the mask or the prefix

58
03:15.170 --> 03:16.280
length.

59
03:16.280 --> 03:22.160
So this is of course already a big improvement over access lists.

60
03:22.160 --> 03:28.310
Also this can match on either a single route or it can match on a range of

61
03:28.310 --> 03:29.400
routes.

62
03:29.400 --> 03:35.160
So why don't we take a look at some examples of how these prefix lists work.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

62
03:29.400 --> 03:35.160
So why don't we take a look at some examples of how these prefix lists work.

63
03:35.160 --> 03:41.320
So for our first example here, we have a standard prefix list named PL_Filter

64
03:41.320 --> 03:41.840
and we're doing

65
03:41.840 --> 03:43.480
a permit.

66
03:43.480 --> 03:45.920
All of our examples are going to begin like this.

67
03:45.920 --> 03:51.120
We're going to be focusing on what we're matching with our permit statement.

68
03:51.120 --> 03:57.840
And in this case, we're matching on 0.0.0/0.

69
03:57.840 --> 04:03.090
Now this particular example does not have any greater than or equal to or less
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

69
03:57.840 --> 04:03.090
Now this particular example does not have any greater than or equal to or less

70
04:03.090 --> 04:03.500
than

71
04:03.500 --> 04:07.600
or equal to statements out here at the end.

72
04:07.600 --> 04:11.520
Therefore, this is going to be an exact match.

73
04:11.520 --> 04:15.320
This is not a range of matches or anything like that.

74
04:15.320 --> 04:20.610
So in this case, it's going to be a precise match on that exact route, which is

75
04:20.610 --> 04:21.360
of course

76
04:21.360 --> 04:23.280
the default route.

77
04:23.280 --> 04:26.760
So this would only permit the default route.

78
04:26.760 --> 04:35.220
Next example, here we're matching on a 204.186.19.0/24.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

78
04:26.760 --> 04:35.220
Next example, here we're matching on a 204.186.19.0/24.

79
04:35.220 --> 04:39.110
So in this case, once again, we have no greater than or equal to or less than

80
04:39.110 --> 04:39.900
or equal to.

81
04:39.900 --> 04:42.460
So it's again going to be an exact match.

82
04:42.460 --> 04:48.700
This will literally match on that single route and that single route only.

83
04:48.700 --> 04:55.820
Next example, we're matching on that same network address 204.186.19.0.

84
04:55.820 --> 05:03.920
We still have the slash 24, but now we have a greater than or equal to 28.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

84
04:55.820 --> 05:03.920
We still have the slash 24, but now we have a greater than or equal to 28.

85
05:03.920 --> 05:08.850
So now this gets a little bit interesting because since we have a greater than

86
05:08.850 --> 05:10.920
or equal to,

87
05:10.920 --> 05:15.040
first thing that does is to find the range of our mask.

88
05:15.040 --> 05:20.070
Since it's greater than or equal to 28, that means that it's going to be 28

89
05:20.070 --> 05:22.080
through 32.

90
05:22.080 --> 05:24.560
That becomes the range of the subnet mask.

91
05:24.560 --> 05:30.680
Well, then that sort of begs the question, what are we doing with this slash 24
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

91
05:24.560 --> 05:30.680
Well, then that sort of begs the question, what are we doing with this slash 24

92
05:30.680 --> 05:31.940
here then?

93
05:31.940 --> 05:38.460
Well, now the slash 24 is not indicating the length of the mask because of the

94
05:38.460 --> 05:38.900
length of

95
05:38.900 --> 05:41.980
the mask is the 28 to 32.

96
05:41.980 --> 05:47.750
So instead, what this 24 is doing is indicating how many bits out of the

97
05:47.750 --> 05:49.260
network address we

98
05:49.260 --> 05:51.260
have to match on.

99
05:51.260 --> 05:59.720
So here we're saying match on 24 bits of the 204.186.19.0 and match on a mask

100
05:59.720 --> 06:00.320
that is
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

100
05:59.720 --> 06:00.320
that is

101
06:00.320 --> 06:04.520
between 28 and 32 bits.

102
06:04.520 --> 06:11.360
In our next example, we're now doing less than or equal to 28.

103
06:11.360 --> 06:15.870
The less than or equal to is going to act a little bit differently as does the

104
06:15.870 --> 06:18.120
slash 24.

105
06:18.120 --> 06:23.860
Now the slash 24 does still indicate how many bits of the address we're looking

106
06:23.860 --> 06:24.700
at, but

107
06:24.700 --> 06:30.320
it also acts as the lower threshold for our mask.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

107
06:24.700 --> 06:30.320
it also acts as the lower threshold for our mask.

108
06:30.320 --> 06:38.900
So when this says less than or equal to 28, the range now becomes 24 to 28.

109
06:38.900 --> 06:44.240
So the 24 acts like the bottom of the threshold and the 28 acts as the top.

110
06:44.240 --> 06:49.340
Of course, another choice is to combine a greater than or equal to and a less

111
06:49.340 --> 06:49.840
than or

112
06:49.840 --> 06:51.520
equal to.

113
06:51.520 --> 06:56.050
Once again, we still have this slash 24 and it is still, of course, dictating

114
06:56.050 --> 06:56.400
how many

115
06:56.400 --> 06:59.160
bits of that address that we're looking at.

116
06:59.160 --> 07:06.690
However, the range now becomes 28 to 30 for the mask because it has to be
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

116
06:59.160 --> 07:06.690
However, the range now becomes 28 to 30 for the mask because it has to be

117
07:06.690 --> 07:07.720
greater than

118
07:07.720 --> 07:12.040
or equal to 28 or less than or equal to 30.

119
07:12.040 --> 07:15.560
One more example, we want to change this up just a little bit.

120
07:15.560 --> 07:21.160
So now what we've done, we've changed this to a slash 16, which means now we're

121
07:21.160 --> 07:21.560
only

122
07:21.560 --> 07:25.760
looking at the first 16 bits of this address.

123
07:25.760 --> 07:33.520
And now our range is going to be 30 to 32 for the length of the mask.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

123
07:25.760 --> 07:33.520
And now our range is going to be 30 to 32 for the length of the mask.

124
07:33.520 --> 07:39.890
So hopefully this clarifies a bit for you how prefix lists operate when we have

125
07:39.890 --> 07:40.520
either

126
07:40.520 --> 07:44.860
no greater than or equal to no less than or equal to, or if we have just one or

127
07:44.860 --> 07:45.760
the other

128
07:45.760 --> 07:47.080
or if we have both.

129
07:47.080 --> 07:54.740
[BLANK_AUDIO]