28.06.2014 Views

Discussion

Discussion

Discussion

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

the longer option to match all prefixes longer than 172.18.20.0/19—for example,<br />

172.18.20.0/24. A variation of this uses the orlonger keyword instead of the longer<br />

keyword to match the specified prefix and all longer prefixes:<br />

[edit policy-options policy-statement long-prefixes term 1]<br />

aviva@router1# set route-filter 172.18.20.0/19 orlonger<br />

The difference between this command and the one in the recipe is that this command<br />

will match 172.18.20.0/19, while the set from route-filter 172.18.20.0/19<br />

longer command will not.<br />

There are two other ways to specify address ranges. The upto keyword is, in some<br />

sense, the opposite of the longer and orlonger keywords, looking at the high-order<br />

bits of the IP address instead of the low-order bits:<br />

[edit policy-options policy-statement prefixes-to-exclude term 1]<br />

aviva@router1# set route-filter 0.0.0.0/0 upto /7<br />

The following command matches prefixes 0.0.0.0/0, 0.0.0.0/1, and so on, up to<br />

0.0.0.0/7. The final keyword is prefix-length-range:<br />

[edit policy-options policy-statement prefixes-to-exclude term 1]<br />

aviva@router1# set route-filter 0.0.0.0/0 prefix-length-range /25-/30<br />

The following command matches IP prefixes in the range 0.0.0.0/25, 0.0.0.0/26,<br />

0.0.0.0/27, 0.0.0.0/28, 0.0.0.0/29, and 0.0.0.0/30 only.<br />

Route lists can also match exactly one prefix, just as prefix lists can:<br />

[edit policy-options policy-statement long-prefixes term 1]<br />

aviva@router1# set route-filter 172.18.20.0/24 exact<br />

A second advantage of route lists over prefix lists is that each prefix can include an<br />

action. When a match occurs, the action is taken immediately instead of waiting to<br />

reach the then clause. (The action can be any of those listed in Table 9-3.) When the<br />

list of prefixes is long, this speeds up the processing of routing traffic. The following<br />

simple policy illustrates how this works:<br />

[edit policy-options policy-statement prefix-policy term 1]<br />

aviva@router1# set from route-filter 0.0.0.0/0 upto /7 accept<br />

aviva@router1# set from route-filter 0.0.0.0/0 or longer<br />

aviva@router1# set then reject<br />

This policy accepts prefixes up to /7 and rejects everything longer.<br />

You can also use route lists as another way to manipulate the routing information in<br />

a route. Instead of screening routes by protocol or by other routing information they<br />

contain, you filter by destination prefix:<br />

[edit policy-statement set-metric-igp]<br />

aviva@router1# set term 1 from route-filter 10.12.0.0/16 exact<br />

aviva@router1# set term 1 from route-filter 172.64.0.0/16 exact<br />

aviva@router1# set term 1 from route-filter 192.168.0.0/24 exact<br />

aviva@router1# set term 1 then local-preference 300<br />

aviva@router1# set term 1 then accept<br />

294 | Chapter 9: Routing Policy and Firewall Filters<br />

This is the Title of the Book, eMatter Edition<br />

Copyright © 2008 O’Reilly & Associates, Inc. All rights reserved.

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!