StudyFi
Open appStart free

Summary of Cisco Route-Maps for Network Policy

Cisco Route-Maps for Network Policy: A Student Guide

SummaryKnowledge testFlashcardsPodcastMindmap

Introduction

Access lists (access-lists) are essential networking tools for filtering traffic and controlling which routes are accepted or advertised when used with routing protocols or filtering functions. In this material, we will explore how standard access lists work when combined with distribute-list filters in EIGRP and how they interact with route-maps when applying matches (match). Although examples use EIGRP, the conceptual approach is applicable to other protocols that allow for route distribution or filtering.

Definition: A standard access list is a sequence of statements that permit or deny networks based solely on the source IP address of routes or packets; it includes an explicit "deny/permit" statement per line and a final implicit deny that denies everything not explicitly mentioned.

Basic Concepts

Standard Access List Structure

  • Each entry can be permit or deny followed by a network and its wildcard mask.
  • If no entry matches, the implicit deny any is applied at the end.

Definition: A wildcard mask (wildcard bits) indicates which bits to compare; for example, the wildcard 0.0.0.255 corresponds to a /24 network for comparisons.

Route-map and match ip address

  • A route-map contains numbered sequences (10, 20, ...) with a permit or deny action.
  • The match ip address ACL_NAME clause uses the access list to determine if the sequence matches a route.
  • If the route-map sequence does not match (or all sequences are processed without permitting), the route-map's implicit deny is applied.

Definition: Route-map implicit deny means that if no permit sequence matches, the route will be rejected by default.

Practical Application: Step-by-Step Examples

Example 1 — ACL with a Single Permit Entry

  1. Create a standard ACL that permits 192.168.0.0/24:

    ip access-list standard R1_L0_PERMIT permit 192.168.0.0 0.0.0.255

  2. Create a route-map that matches this ACL:

    route-map TEST_1 permit 10 match ip address R1_L0_PERMIT

  3. Apply as a distribute-list in EIGRP (inbound):

    router eigrp 1 distribute-list route-map TEST_1 in

Observed Result: In router R2's routing table, only the 192.168.0.0/24 network from R1 appears.

Explanation:

  • The ACL explicitly permits 192.168.0.0/24 and denies everything else due to the implicit deny.
  • The route-map has a single permit sequence that only matches the permitted network; for any other route, the ACL will not match, and the route-map will not have any further permitting sequences, so the route-map's implicit deny will block those routes.

Example 2 — ACL with a Single Deny Entry

  1. Create an ACL that denies 192.168.0.0/24:

    ip access-list standard R1_L0_DENY deny 192.168.0.0 0.0.0.255

  2. Create a route-map that matches this ACL:

    route-map TEST_2 permit 10 match ip address R1_L0_DENY

  3. Apply as a distribute-list in EIGRP:

    router eigrp 1 distribute-list route-map TEST_2 in

Observed Result: No /24 routes appear in the table (everything is filtered).

Explanation:

  • The ACL contains only a deny line for the /24 and, by default, denies everything else (implicit deny). Therefore, there is no permit match in the ACL.
  • The route-map only has the permit 10 sequence, but the match condition does not match any route (the ACL doesn't offer a permit), so the route-map effectively rejects all routes due to the implicit deny.

Practical Tip: If the intention is to deny only one network and permit the rest, include a permit any entry in the ACL after the deny:

ip access-list standard R1_L0_CUSTOM deny 192.168.0.0 0.0.0.255 permit any

Example 3 — Route-map with a DENY Action

The logic is reversed: the route-map uses deny in its sequence and matches the ACL that permits 192.168.0.0/24.

route-map TEST_3 deny 10 match ip address R1_L0_PERMIT

If applied as a distribute-list, routes that match the ACL (192.168.0.0/24) will be ex

Sign up for the full summary
FlashcardsKnowledge testSummaryPodcastMindmap
Start for free

Already have an account? Sign in

Access Lists - EIGRP and Filters

Klíčové pojmy: Standard ACLs filter by source address and have an implicit deny any, An ACL requires permit entries for a route-map with a permit action to match, If an ACL only contains deny statements, no routes will be permitted without a permit any, A route-map also has an implicit deny if there is no matching permit sequence, To deny a specific network and permit all others, use a deny statement followed by a permit any in the ACL, A route-map with a deny action blocks matching routes and allows non-matching routes to proceed to subsequent sequences, Applying a distribute-list in EIGRP can cause a neighbor resync and expedite testing, Verify the routing table after making changes to confirm the effect of filtering, Use descriptive names in ACLs and route-maps for easier troubleshooting, Wildcard masks indicate which bits to compare; 0.0.0.255 is equivalent to a /24 for matching purposes

## Introduction **Access lists** (access-lists) are essential networking tools for **filtering traffic** and **controlling which routes are accepted or advertised** when used with routing protocols or filtering functions. In this material, we will explore how standard access lists work when combined with *distribute-list* filters in EIGRP and how they interact with *route-maps* when applying matches (match). Although examples use EIGRP, the conceptual approach is applicable to other protocols that allow for route distribution or filtering. > Definition: A *standard access list* is a sequence of statements that permit or deny networks based solely on the source IP address of routes or packets; it includes an explicit "deny/permit" statement per line and a final **implicit deny** that denies everything not explicitly mentioned. ## Basic Concepts ### Standard Access List Structure - Each entry can be **permit** or **deny** followed by a network and its wildcard mask. - If no entry matches, the **implicit deny any** is applied at the end. > Definition: A *wildcard mask* (wildcard bits) indicates which bits to compare; for example, the wildcard 0.0.0.255 corresponds to a /24 network for comparisons. ### Route-map and match ip address - A **route-map** contains numbered sequences (10, 20, ...) with a **permit** or **deny** action. - The **match ip address ACL_NAME** clause uses the access list to determine if the sequence matches a route. - If the route-map sequence does not match (or all sequences are processed without permitting), the route-map's **implicit deny** is applied. > Definition: *Route-map implicit deny* means that if no `permit` sequence matches, the route will be rejected by default. ## Practical Application: Step-by-Step Examples ### Example 1 — ACL with a Single Permit Entry 1. Create a standard ACL that permits 192.168.0.0/24: ip access-list standard R1_L0_PERMIT permit 192.168.0.0 0.0.0.255 2. Create a route-map that matches this ACL: route-map TEST_1 permit 10 match ip address R1_L0_PERMIT 3. Apply as a distribute-list in EIGRP (inbound): router eigrp 1 distribute-list route-map TEST_1 in Observed Result: In router R2's routing table, only the 192.168.0.0/24 network from R1 appears. Explanation: - The ACL explicitly permits 192.168.0.0/24 and denies everything else due to the implicit deny. - The route-map has a single `permit` sequence that only matches the permitted network; for any other route, the ACL will not match, and the route-map will not have any further permitting sequences, so the route-map's implicit deny will block those routes. ### Example 2 — ACL with a Single Deny Entry 1. Create an ACL that denies 192.168.0.0/24: ip access-list standard R1_L0_DENY deny 192.168.0.0 0.0.0.255 2. Create a route-map that matches this ACL: route-map TEST_2 permit 10 match ip address R1_L0_DENY 3. Apply as a distribute-list in EIGRP: router eigrp 1 distribute-list route-map TEST_2 in Observed Result: No /24 routes appear in the table (everything is filtered). Explanation: - The ACL contains only a `deny` line for the /24 and, by default, denies everything else (implicit deny). Therefore, there is no `permit` match in the ACL. - The route-map only has the `permit 10` sequence, but the `match` condition **does not** match any route (the ACL doesn't offer a `permit`), so the route-map effectively rejects all routes due to the implicit deny. Practical Tip: If the intention is to deny only one network and permit the rest, include a `permit any` entry in the ACL after the `deny`: ip access-list standard R1_L0_CUSTOM deny 192.168.0.0 0.0.0.255 permit any ### Example 3 — Route-map with a DENY Action The logic is reversed: the route-map uses `deny` in its sequence and matches the ACL that permits 192.168.0.0/24. route-map TEST_3 deny 10 match ip address R1_L0_PERMIT If applied as a distribute-list, routes that match the ACL (192.168.0.0/24) will be ex