BGP Filtering Oddity

General questions
1

Hi,

Not sure if this is a bug somewhere or me misunderstanding, but I have the following config:

set policy prefix-list AS65550-OUT
set policy route-map AS65550-IN rule 10 action 'permit'

set policy prefix-list6 AS65550-OUT rule 10 action 'permit'
set policy prefix-list6 AS65550-OUT rule 10 prefix '2001:xxx:xxx::/48'

set policy route-map AS65550-OUT rule 10 action 'permit'
set policy route-map AS65550-OUT rule 10 match ip address prefix-list 'AS65550-OUT'
set policy route-map AS65550-OUT rule 10 match ipv6 address prefix-list 'AS65550-OUT'
set policy route-map AS65550-OUT rule 20 action 'deny'

set protocols bgp 65550 address-family ipv6-unicast network 2001:xxx:xxx::/48
set protocols static route6 2001:xxx:xxx::/48 blackhole distance '254'

set protocols bgp 65550 peer-group collectors_v6 address-family ipv6-unicast route-map export 'AS65550-OUT'
set protocols bgp 65550 peer-group collectors_v6 address-family ipv6-unicast route-map import 'AS65550-IN'

set protocols bgp 65550 neighbor 2001:xxx::1 address-family ipv6-unicast soft-reconfiguration inbound
set protocols bgp 65550 neighbor 2001:xxx::1 peer-group 'collectors_v6'
set protocols bgp 65550 neighbor 2001:xxx::1 remote-as '65551'

However, it’s not advertising the route - “sh ipv6 bgp neigh 2001:xxx::1 advertised-routes” is blank.

Am I doing something daft?

Also, how does the action of a route map interact with the action in a prefix list?

I am assuming that:

set policy route-map AS65550-OUT rule 10 action 'permit'
set policy route-map AS65550-OUT rule 10 match ip address prefix-list 'AS65550-OUT'
set policy route-map AS65550-OUT rule 10 match ipv6 address prefix-list 'AS65550-OUT'
set policy route-map AS65550-OUT rule 20 action 'deny'

Means, permit the prefix permitted by the prefix list and then deny everything else (which is implicit anyway?)

…but then you can still deny in the prefix list, right?

Is the action in the route map effectively the default, for prefixes not matched by the prefix list?

Thanks,

Ian

2

Don’t use ip/ipv6 prefixes in the same rule.
Just delete it

del policy route-map AS65550-OUT rule 10 match ip

Use different route-map for different afi, for example, AS65550-OUT and AS65550-OUT-V6

All works fine

set policy prefix-list6 OUTv6 rule 10 action 'permit'
set policy prefix-list6 OUTv6 rule 10 prefix '2001:db8::/64'
set policy route-map OUTv6 rule 10 action 'permit'
set policy route-map OUTv6 rule 10 match ipv6 address prefix-list 'OUTv6'

Adverised to neighbor

   Network          Next Hop            Metric LocPrf Weight Path
*> 2001:db8::/64    ::                       0         32768 i

Total number of prefixes 1
3

Yes. That’s is correct. I understand your solution now. It very helpful as well