Unexpected AS-PATH ACL behavior

Question

4 routers, lab environment. Trying to filter out routes originating from AS2 (not that leverage AS2 as transit). The process I've followed is:

Bakers#sh ip bgp regex _2_
BGP table version is 41, local router ID is 33.33.33.33
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
*> 2.2.2.0/24       192.168.23.2             0             0 2 i
*  4.4.4.0/24       192.168.23.2                           0 2 1 i
*> 22.22.22.0/24    192.168.23.2             0             0 2 i
*  44.44.44.0/24    192.168.23.2                           0 2 1 i
*> 192.168.12.0     192.168.23.2             0             0 2 i
*  192.168.14.0     192.168.23.2                           0 2 1 i
*  192.168.23.0     192.168.23.2             0             0 2 i

Bakers#sh ip bgp regex _2$
BGP table version is 41, local router ID is 33.33.33.33
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
*> 2.2.2.0/24       192.168.23.2             0             0 2 i
*> 22.22.22.0/24    192.168.23.2             0             0 2 i
*> 192.168.12.0     192.168.23.2             0             0 2 i
*  192.168.23.0     192.168.23.2             0             0 2 i

At this point, I'm thinking, OK - have what I need to make an as-path ACL to filter out the stuff originating from AS2 since the regex searching checks out per the above. I create and apply the following:

Bakers#sh run | i as-path
ip as-path access-list 10 deny _2$
ip as-path access-list 10 permit .*
router bgp 3
 no synchronization
 bgp log-neighbor-changes
 <truncated>
 neighbor 192.168.23.2 remote-as 2
 neighbor 192.168.34.4 remote-as 4
 neighbor 192.168.34.4 filter-list 10 out
 no auto-summary

I would then expect the advertised routes to mimic the 'sh ip bgp regex 2' output from earlier (giving me the desired result), sans the routes output with the 'sh ip bgp regex _2$' routes. Unfortunately, I get this:

Bakers#sh ip bgp neigh 192.168.34.4 advertised-routes 
BGP table version is 41, local router ID is 33.33.33.33
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
*> 3.3.3.0/24       0.0.0.0                  0         32768 i
*> 33.33.33.0/24    0.0.0.0                  0         32768 i
*> 192.168.23.0     0.0.0.0                  0         32768 i
*> 192.168.34.0     0.0.0.0                  0         32768 i

It's filtering out all of the routes originating from AS1 (meaning that downstream, that router can no longer use AS3 as transit to AS1 - breaking my use case). What am I missing here?

Just a shot in the dark, but have you tried a route-map instead of a filter list? — Ron Trunk, Mar 17 '17 at 12:12
@RonTrunk - No sir, have not, but I will try that as soon as time permits. Beyond being a valid alternative, have you ever noted the filter-list behavior to vary from that of the route-map behavior? I'm thinking this may be buggy behavior. — A L, Mar 18 '17 at 13:13
Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. — Ron Maupin, Aug 09 '17 at 18:50
@AL as per @Ron's suggestion, AS path regex in IOS is applied using a route-map. For your exist as-path access-list use `route-map BLAH permit 10; match as-path 10;` — jwbensley, Mar 24 '18 at 19:36

score 3 · Accepted Answer · answered Apr 17 '18 at 03:57

What routes were being advertised before adding the filter? My BGP is very rusty, but I don't recall BGP advertising routes that aren't in the FIB (aka "best" routes.) As such, the only routes being installed from AS2 are origin AS2 (_2$); the transiting routes (_2_) aren't being installed, so aren't advertised.

Unexpected AS-PATH ACL behavior

1 Answers1