Regular Expressions are used often for BGP route manipulation or filtering. In this lesson, we’ll take a look at some useful regular expressions. First, let’s take a look at the different characters that we can use:
Characters
| ? | repeats the previous character one or zero times. |
| * | repeats the previous character zero or many times. |
| + | repeats the previous character one or more times. |
| ^ | matches the beginning of a string. |
| $ | matches the end of a string. |
| [] | is a range. |
| _ | matches the space between AS numbers or the end of the AS PATH list. |
| \\ | is an escape character. You’ll need this for BGP confederations. |
The dollar sign ($) regular expression character should be placed at the end of a Border Gateway Protocol (BGP) autonomous system (AS) path filter to indicate the originating AS. Regular expressions are used to locate character strings that match a particular pattern. AS path filters are used to permit or deny routes that match the regular expression.
The $ character indicates that the preceding characters should match the end of the string. The originating router will insert its AS number into the AS path, and subsequent routers will prepend their AS numbers to the beginning of the AS path string. The last AS number in the AS path is the originating AS. For example, the ip as-path access-list 1 permit ^111_999$ command permits paths that originate from AS 999.
The caret (^) character should be placed at the beginning of a BGP AS path filter to indicate the AS from which the path was learned. The ^ character indicates that the subsequent characters should match the start of the string. The first number in an AS path indicates the AS from which the path was learned. For example, the ip aspath accesslist 1 permit ^111_999$ command permits paths that are learned from AS 111.
The underscore (_) character is used to indicate a comma, a brace, the start or end of an input string, or a space. When used between two AS path numbers, the _ character indicates that the ASes are directly connected. For example, the ip aspath accesslist 1 permit ^111_999$ command indicates that AS 111 and AS 999 should be directly connected.
The period (.) character is used to represent any single character. For example, the ip aspath accesslist 1 permit ^…_999$ command permits paths that originate from AS 999 and are learned from any threedigit AS.
The bracket (]) character is used to indicate a set of characters or a range of characters. For example, the ip aspath accesslist 1 permit ^[09]_999$ command permits paths that originate from AS 999 and are learned from any AS numbered from 0 through 9, and the ip aspath accesslist 1 permit ^[123]_999$ command permits paths that originate from AS 999 and are learned from AS 1, AS 2, or AS 3.
The asterisk (*) character indicates zero or more sequences of the previous expression. For example, the expression [09]* indicates a string of zero or more digits. Therefore, the ip aspath accesslist 1 permit ^111_ [09]*$ command permits paths that are learned from AS 111 and originate from any AS.
Examples
| ^$ | matches an empty AS PATH so it will match all prefixes from the local AS. |
| ^51_ | matches prefixes from AS 51 that is directly connected to our AS. |
| _51_ | matches prefixes that transit AS 51. |
| _51$ | matches prefixes that originated in AS 51, the $ ensures that it’s the beginning of the AS PATH. |
| ^([0-9]+)_51 | matches prefixes from AS 51 where AS 51 is behind one of our directly connected AS’es. |
| ^51_([0-9]+) | matches prefixes from the clients of directly connected AS 51. |
| ^(51_)+([0-9]+) | matches prefixes from the clients of directly connected AS 51, where AS 51 might be doing AS PATH prepending. |
| ^51_([0-9]+_)+ | matches prefixes from the clients of directly connected AS 51, where the clients might be doing AS PATH prepending. |
| ^\65200\) | matches prefixed from confederation peer 65200. |
If you need some practice for these, I would suggest using a BGP looking glass server.
Using Regular Expressions in BGP
You can use regular expressions in the ip as-path access-list command with Border Gateway Protocol (BGP). This document describes scenarios for using regular expressions. For more general information about regular expressions, see the Cisco Documentation on Regular Expressions.
Requirements
Readers of this document should be knowledgeable of the following:
- Basic BGP configuration. For more information, see the BGP Case Studies and Configuring BGP.
Components Used
The information in this document is based on the software and hardware versions:
- Cisco IOS® Software Release 12.0
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.
Conventions
For more information on document conventions, see the Cisco Technical Tips Conventions.
Network Scenarios
The following network diagram is referred to in these three scenarios.
Only Allow Networks Originating from AS 4 to Enter Router 1
If you would like for Router 1 to receive only the routes originated from AS 4 (and no Internet routes), you can apply an inbound access list on Router 1 as follows:
ip as-path access-list 1 permit ^4$ router bgp 1 neighbor 4.4.4.4 remote-as 4 neighbor 4.4.4.4 route-map foo in route-map foo permit 10 match as-path 1
This ensures only networks originated from AS 4 are allowed into Router 1.
Only Allow Networks That Have Passed Through AS 4 to Enter AS 3
If you want only the networks that have passed through AS 4 to enter AS 3 from Router 3, you can apply an inbound filter on Router 3.
ip as-path access-list 1 permit _4_ router bgp 3 neighbor 2.2.2.2 remote-as 1 neighbor 2.2.2.2 route-map foo in route-map foo permit 10 match as-path 1
You can use an underscore (_) as the input string and output string in the ip as-path access-list command. Note that in this example anchoring (for instance, there is no ^) is not used, so it does not matter what autonomous systems come before and after AS 4.
Deny Networks Originated in AS 4 to Enter AS 3 and Permit all other Networks
If you want to deny all the networks that have originated in AS 4 and permit all other routes to enter AS 3 from Router 3, you can apply an inbound filter at Router 3, as follows:
ip as-path access-list 1 deny _4$ ip as-path access-list 1 permit .* router bgp 3 neighbor 2.2.2.2 remote-as 1 neighbor 2.2.2.2 route-map foo in route-map foo permit 10 match as-path 1
Only Allow Networks Originated from AS 4, and ASs Directly Attached to AS 4, to Enter Router 1
If you want AS 1 to get networks originated from AS 4 and all directly attached ASs of AS 4, apply the following inbound filter on Router 1.
ip as-path access-list 1 permit ^4_[0-9]*$ router bgp 1 neighbor 4.4.4.4 remote-as 4 neighbor 4.4.4.4 route-map foo in route-map foo permit 10 match as-path 1
In the ip as-path access-list command, the carat (^) starts the input string and designates “AS”. The underscore (_) means there is a null string in the string that follows “AS 4”. The [0-9]* specifies that any connected AS with a valid AS number can pass the filter. The advantage of using the [0-9]* syntax is that it gives you the flexibility to add any number of ASs without modifying this command string. For additional information, see AS-Regular Expression.
Ref: https://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/13754-26.html