Summary of Understanding Cisco Route-Maps
Understanding Cisco Route-Maps: Configuration & Examples
Introduction
Access lists (access-lists) are fundamental networking tools for filtering traffic and controlling which routes are accepted or advertised when used with routing protocols or filtering functions. In this material, we will explore how standard access lists function when combined with distribute-list filters in EIGRP and how they interact with route-maps when used for matching. Although examples use EIGRP, the conceptual approach is applicable to other protocols that allow for route distribution or filtering.
Definition: A standard access list is a sequence of statements that permit or deny networks based solely on the source IP address of routes or packets; it has an explicit "deny/permit" per line and a final implicit deny that denies everything not explicitly mentioned.
Basic Concepts
Standard Access List Structure
- Each entry can be permit or deny followed by a network and its wildcard mask.
- If no entry matches, the implicit deny any is applied at the end.
Definition: A wildcard mask (wildcard bits) indicates which bits to compare; for example, the wildcard 0.0.0.255 corresponds to a /24 network for comparisons.
Route-map and match ip address
- A route-map contains numbered sequences (10, 20, ...) with a permit or deny action.
- The match ip address ACL_NAME clause uses the access list to determine if the sequence matches a route.
- If the route-map sequence doesn't match (or all sequences are processed without permitting), the route-map's implicit deny is applied.
Definition: The route-map implicit deny means that if no
permitsequence matches, the route will be rejected by default.
Practical Examples: Step-by-Step
Example 1 — ACL with a Single Permit Entry
-
Create a standard access list that permits 192.168.0.0/24:
ip access-list standard R1_L0_PERMIT permit 192.168.0.0 0.0.0.255
-
Create a route-map that matches that ACL:
route-map TEST_1 permit 10 match ip address R1_L0_PERMIT
-
Apply as a distribute-list in EIGRP (inbound):
router eigrp 1 distribute-list route-map TEST_1 in
Observed Result: In router R2's routing table, only the 192.168.0.0/24 network originating from R1 appears.
Explanation:
- The ACL explicitly permits 192.168.0.0/24 and implicitly denies everything else due to the implicit deny.
- The route-map has a single
permitsequence that only matches the permitted network; for any other route, the ACL will not match, and the route-map will not have any further permitting sequences, therefore, the route-map's implicit deny will block those routes.
Example 2 — ACL with a Single Deny Entry
-
Create an ACL that denies 192.168.0.0/24:
ip access-list standard R1_L0_DENY deny 192.168.0.0 0.0.0.255
-
Create a route-map that matches that ACL:
route-map TEST_2 permit 10 match ip address R1_L0_DENY
-
Apply as a distribute-list in EIGRP:
router eigrp 1 distribute-list route-map TEST_2 in
Observed Result: No /24 routes appear in the table (all routes are filtered).
Explanation:
- The ACL contains only a
denyline for the /24 network and, by default, denies everything else (implicit deny). Therefore, there is nopermitmatch in the ACL. - The route-map only has the
permit 10sequence, but thematchcondition does not match any route (the ACL does not offer apermitmatch), therefore, the route-map effectively rejects all routes due to the implicit deny.
Practical Tip: If the intention is to deny only one network and permit the rest, include a permit any entry in the ACL after the deny:
ip access-list standard R1_L0_CUSTOM deny 192.168.0.0 0.0.0.255 permit any
Example 3 — Route-map with a DENY Action
The logic is reversed: the route-map uses deny in its sequence and matches the ACL that permits 192.168.0.0/24.
route-map TEST_3 deny 10 match ip address R1_L0_PERMIT
If applied as a distribute-list, routes that mat
Sign up for the full summaryAlready have an account? Sign in
Access Lists - EIGRP and Filters
Klíčové pojmy: Standard ACLs filter by source address and include an implicit deny any., An ACL needs permit entries for a route-map with a permit action to match., If an ACL only contains deny statements, no routes will be permitted without a permit any., Route-maps also have an implicit deny if there's no matching permit sequence., To deny a specific network and permit all others, use a deny statement followed by a permit any in the ACL., A route-map with a deny action blocks matching routes and allows non-matching routes to proceed to subsequent sequences., Applying a distribute-list in EIGRP can cause a neighbor resync and expedite testing., Verify the routing table after making changes to confirm the filtering effect., Use descriptive names for ACLs and route-maps to facilitate troubleshooting., Wildcard masks indicate which bits to compare; 0.0.0.255 is equivalent to a /24 for matching purposes.