Suppress routes using prefix lists

Sometimes you might not want to advertise certain networks out a particular interface, or you might want to filter updates as they come in. This is possible with distance-vector routing protocols, such as RIP or EIGRP. However, link-state protocols are less flexible, because every router in an area is required to have a synchronized database as a condition for full adjacency.

Distribute lists can be used with either access lists or prefix lists to filter routes by network address. With prefix lists, they can also be configured to filter routes by subnet masks.

To create a prefix list or add a prefix list entry, use the ip prefix-list command in global configuration mode.
ip prefix-list {list-name | list-number} {deny network/length | permit network/length} [ge ge-length] [le le-length]

The ge keyword represents the “greater than or equal to” operator. The le keyword represents the “less than or equal to” operator. If both the ge and le keywords are omitted, the prefix list is processed using an exact match.

R1(config)# ip prefix-list RIP-OUT permit
R1(config)# ip prefix-list RIP-OUT deny le 24
R1(config)# ip prefix-list RIP-OUT permit le 32
Line 1 of the prefix list permits the summary route and nothing else, because no other route can match that network address with a mask of exactly 22 bits.
Line 2 denies all prefixes with a network address in the block of addresses that have subnet masks from 22 bits to 24 bits. This removes exactly four network addresses matching the 22, 23, and 24 bits in length of the subnet mask. Line 2 would deny the summary route you created if Line 1 did not explicitly permit the summary route.
Line 3 allows all IPv4 prefixes that are not explicitly denied in previous statements of the prefix list.


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s