Create Filters for the Advanced Routing Engine

Create an access list to permit or deny IPv4 or IPv6 addresses where this filter is applied.
Select
Network
Routing
Filters
.
Add
a
Filters Access List
by
Name
(maximum of 63 characters). The name must start with an alphanumeric character, underscore (_), or hyphen (-), and can contain a combination of alphanumeric characters, underscore, or hyphen. No dot (.) or space is allowed.
Enter a helpful
Description
.
Select the
Type
of access list:
IPv4
or
IPv6
.
For IPv4,
Add
an
IPv4 Entry
and enter the
Seq
number for the rule (range is 1 to 65,535).
Select the
Action
:
Deny
(the default) or
Permit
.
For
Source Address
, there are three options: select
Address
and in the subsequent
Address
field, enter an IPv4 address. Enter a
Wildcard
mask to indicate a range. A zero (0) in the mask indicates that bit must match the corresponding bit in the address; a one (1) in the mask indicates a “don’t care” bit. The other options are
Any
or
None
.
For
Destination Address
, select
Address
and in the subsequent
Address
field, enter an IPv4 address. Enter a
Wildcard
. A zero (0) in the mask indicates a bit that must match; a one (1) in the mask indicates a “don’t care’ bit. The other options are
Any
or
None
.
Click
OK
to save the entry.

Alternatively, select the
Type
to be
IPv6
.
For IPv6,
Add
an
IPv6 Entry
and enter the
Seq
number (range is 1 to 65,535).
Select the
Action
:
Deny
(the default) or
Permit
.
For
Source Address
, there are three options: select
Address
and in the subsequent
Address
field, enter an IPv6
Address
. Optionally select
Exact Match of this address
to have the firewall perform a comparison of both the prefix and prefix length and they must match exactly; otherwise, the firewall determines the match comparison based on whether the route is in the same subnet as the configured prefix. (If the Source Address is
Any
or
None
, you cannot select
Exact Match of this address
.) The other options are
Any
or
None
.
Click
OK
to save the entry. Optionally add more entries.

Click
OK
to save the access list.
Create a prefix list.
Select
Network
Routing
Filters
.
Add
a
Filters Prefix List
by
Name
(maximum of 63 characters). The name must start with an alphanumeric character, underscore (_), or hyphen (-), and can contain a combination of alphanumeric characters, underscore, or hyphen. No dot (.) or space is allowed.
Enter a helpful
Description
.
Select the
Type
of prefix for this rule to filter:
IPv4
or
IPv6
.

For IPv4,
Add
an
IPv4 Entry
, and enter the
Seq
number for the rule; range is 1 to 65,535.
Select the
Action
:
Deny
(the default) or
Permit
.
For
Prefix
, there are three options; default is
None
. Another option is to select
Network any
. The third option is to select
Entry
and enter an IPv4
Network
prefix with slash and a base prefix length that together specify a network, for example, 192.168.2.0/24. Optionally specify that the prefix length be
Greater Than Or Equal
to a number (that is at least as large as the base length you specified; range is 0 to 32). Optionally specify a top limit to the range by specifying
Less Than Or Equal
to a number (that is at least as high as the base length and at least as high as the
Greater Than Or Equal
length if configured; range is 0 to 32).

Comparing a route to the prefix rule (IPv4 or IPv6) is a two-step process: 1) Match the prefix with the network first. 2) Match the prefix length to the mask range (Greater Than or Equal to Less Than Or Equal). For example, consider the preflix list rule with Network 192.168.3.0/24, and a prefix length Greater Than or Equal to 26 and Less Than or Equal to 30. The following table shows routes that are tested and whether they pass or fail the rule. Routes that pass the rule are subject to the configured action (Deny or Permit).
Sample Route	Result
192.168.3.0/28	Pass: the network and prefix length match the rule.
192.168.2.0/30	Fail: network does not match the rule.
192.168.3.0/32	Fail: prefix length does not match the rule.
In the output summary of the rule, LOU is Logical Operator Unit (equal, greater or equal, less or equal). >= indicates a prefix length greater than or equal to the value; it is the lowest value of a range of the prefix length. <= indicates a prefix length less than or equal to the value; it is the highest value of a range of the prefix length.
Alternatively,
Add
an
IPv6 Entry
and follow the steps similar to those for an IPv4 prefix rule. The range of the IPv6 prefix length is
Greater Than or Equal
to 0 to 128 and
Less Than Or Equal
to 0 to 128.
For example, consider the prefix list rule with Network 2001:db8:1/48, and a prefix length Greater Than or Equal to 56 and Less Than or Equal to 64. The following table shows routes that are tested and whether they pass or fail the rule. Routes that pass the rule are subject to the configured action (Deny or Permit).
Sample Route	Result
2001:db8:1/64	Pass: the network and prefix length match the rule.
2001:db8:2/48	Fail: network does not match the rule.
2001:db8:1/65	Fail: prefix length does not match the rule.
Click
OK
to save the prefix entry. Optionally add more entries.
Click
OK
to save the Prefix List.
Create an AS Path Access List for BGP.
Select
Network
Routing
Filters
.
Add
an
AS Path Acess List
by
Name
(maximum of 63 characters). The name must start with an alphanumeric character, underscore (_), or hyphen (-), and can contain a combination of alphanumeric characters, underscore, or hyphen. No dot (.) or space is allowed.
Enter a helpful
Description
.
Add
an
Entry
and enter a
Seq
number; range is 1 to 65,535.
Select the
Action
:
Deny
(the default) or
Permit
.
Each AS Path access list ends with an implicit
Permit Any
rule. Use an AS Path access list to deny autonomous systems.
Enter the
Aspath Regex
(regular expression) in the format
regex1:regex2:regex3
, where a colon (:) separates three AS values. Characters allowed are 1234567890_^|[,{}()]$*+.?-\. For example, .*65000 in a Deny statement excludes prefixes originating from AS 65000.

Click
OK
to save the entry. Optionally add more entries; a maximum of 64 entries are allowed in an AS Path access list.
Click
OK
to save the AS Path access list.
Create a Community List.
Select
Network
Routing
Filters
.
Add
a
Filters Community List
by
Name
(maximum of 63 characters). The name must start with an alphanumeric character, underscore (_), or hyphen (-), and can contain a combination of alphanumeric characters, underscore, or hyphen. No dot (.) or space is allowed.
Enter a helpful
Description
.

Select the
Type
:
Regular

—

Add

a

Seq

number (range is 1 to 65,535), select the

Action

:

Deny

(the default) or

Permit

, and

Add

one or more community values, select one or more well-known communities, or enter a combination of community values and well-known communities. Separate multiple communities with a vertical bar (|), for example,

6409:10|6520:13|internet

. Enter a maximum of 16 communities in a

Regular

entry (rule).

A regular community value in the format AA:NN where AA is an AS number and NN is a network number (each with a range of 0 to 65,535).
accept-own
—Represents well-known community value ACCEPT-OWN (0xFFFF0001)
blackhole
—Represents well-known community value BLACKHOLE (0xFFFF029A). The neighboring network should discard traffic destined for the prefix.
graceful-shutdown
—Represents well-known community value GRACEFUL_SHUTDOWN (0xFFFF0000)
internet
—Represents well-known community value 0 (0x00). Advertise a prefix to all BGP neighbors.
local-as
—Represents well-known community value NO_EXPORT_SUBCONFED (0xFFFFFF03). The effect is to not advertise the prefix outside of the sub-AS in a confederation.
no-advertise
—Represents well-known community value NO_ADVERTISE (0xFFFFFF02). Adding this community to a prefix means the receiving BGP peer will place the prefix in its BGP route table, but won’t advertise the prefix to other neighbors.
no-export
—Represents well-known community value NO_EXPORT (0xFFFFFF01).Adding this community to a prefix means the receiving BGP peer will advertise the prefix only to iBGP neighbors, not neighbors outside the AS.
no-peer
—Represents well-known community value NOPEER (0xFFFFFF04).
route-filter-v4
—Represents well-known community value ROUTE_FILTER_v4 (0xFFFF0003).
route-filter-v6
—Represents well-known community value ROUTE_FILTER_v6 (0xFFFF0005).



Large

—

Add

a

Seq

number (range is 1 to 65,535), select the

Action

:

Deny

(the default) or

Permit

, and

Add

a large community regular expression (LC REGEX) entry. Characters allowed in an entry are 1234567890_^|[,{}()]$*+.?-\. Each community must be in the format

regex1:regex2:regex3

; for example,

203[1-2]:205[2-5]:206[5-6]

. Enter a maximum of eight communities in a

Large

entry (rule).



Extended

—

Add

a

Seq

number (range is 1 to 65,535), select the

Action

:

Deny

(the default) or

Permit

, and

Add

the BGP extended community regular expression (EC REGEX). Characters allowed are 1234567890_^|[,{}()]$*+.?-\. Each extended community must be in the format

regex1:regex2

; for example,

204*[3-8]:205*[4-8]

. Enter a maximum of eight communities in an

Extended

entry (rule).


Click
OK
to save the entry in the Community List. Optionally add more entries of the same type (Regular, Large, or Extended).
Click
OK
to save the Community List.
Create a BGP route map.
Select
Network
Routing
Filters
.
Add
a
Filters Route Maps BGP
by
Name
(maximum of 63 characters). The name must start with an alphanumeric character, underscore (_), or hyphen (-), and can contain a combination of alphanumeric characters, underscore, or hyphen. No dot (.) or space is allowed.
Enter a helpful
Description
of the route map.

Add
a route map and on the
Entry
tab, assign a
Seq
number; range is 1 to 65,535.
Assign sequence numbers that are five or more numbers apart so you have unused numbers for which to insert additional entries in the future.
Enter a helpful
Description
of the entry (rule).
For
Action
, select
Deny
or
Permit
.
On the
Match
tab, specify the criteria that determine which routes are subject to the function that uses this route map. Multiple attributes are logically ANDed, meaning all criteria must be met.

AS Path Access List
—Select an AS path list. Default is
None
.
Regular Community
—Select a Community list. Default is
None
.
Large Community
—Select a Large Community list. Default is
None
.
Extended Community
—Select an Extended Community list. Default is
None
.
Metric
—Enter a value in the range 0 to 4,294,967,295.
Interface
—Select a local interface from the list of all interfaces for all logical routers. Make sure to choose an interface that belongs to the logical router you are configuring. Default is
None
. At commit, the firewall checks that the interface you chose belongs to the logical router you are configuring.
Origin
—Select the origin of the route:
ebgp
,
ibgp
, or
incomplete
. Default is
none
.
Tag
—Enter a tag value that has meaning in your networks, in the range 0 to 4,294,967,295.
Local Preference
—Enter a value in the range 0 to 4,294,967,295.
Peer
—Select a peer name or
local (Static or Redistributed routes)
. Default is
none
.
Select
IPv4
or
IPv6
to match on various types of addresses. If you select
IPv4
:
On the
Address
tab, select an
Access List
to specify addresses to match.
Select a
Prefix List
to specify addresses to match. It matches the prefix received from a peer or a prefix redistributed to protocol from another protocol.
If both an access list and prefix list are specified, both requirements must be met (logical AND).
On the
Next Hop
tab, select an
Access List
to specify next hop addresses to match.
Select a
Prefix List
to specify next hop addresses to match.
On the
Route Source
tab, select an
Access List
to specify a source IP address of a route to match. For example, the access list could permit a distant peer with the address 192.168.2.2 who is advertising a route to a certain prefix. You can make this BGP route map match on the route’s source address 192.168.2.2 and then perhaps filter the route based on matching the peer address 192.168.2.2 as the source of the route, or set a next hop for routes matching that route source.
Specify a
Prefix List
to specify one or more source network prefixes to match.
If you select
IPv6
:
On the
Address
tab, select an
Access List
to specify addresses to match.
Select a
Prefix List
to specify addresses to match.
On the
Next Hop
tab, select an
Access List
to specify next hop addresses to match.
Set
any of the following attributes for routes that meet the match criteria:

Enable BGP atomic aggregate
—Mark the route as a less specific route because it has been aggregated. ATOMIC_AGGREGATE is a well-known discretionary attribute that alerts BGP speakers along a path that information has been lost due to route aggregation, and therefore the aggregate path might not be the best path to the destination. When some router are aggregated by an aggregator, the aggregator attaches its Router-ID to the aggregated route into the AGGREGATOR-ID attribute and it sets the ATOMIC_AGGREGATE attribute or not, based on whether the AS_PATH information from the aggregated routers was preserved.
Aggregator AS
—Enter the Aggregator AS. The Aggregator attribute includes the AS number and the IP address of the router that originated the aggregated route.The IP address is the Router ID of the router that performs the route aggregation.
Router ID
—Enter the aggregator’s Router ID (usually a loopback address).
Local Preference
—Enter the local preference to which matching routes are set; range is 0 to 4,294,967,295. IBGP Update packets carry local preference, which is advertised to IBGP peers only. When there are multiple routes to another AS, the firewall prefers the highest local preference.
Tag
—Set a tag; range is 1 to 4,294,967,295.
Metric Action
—Select an action:
set
,
add
, or
subtract
. You can set the specified Metric Value, or add the specified Metric Value to the matching route’s original metric value, or subtract the specified Metric Value from the matching route’s original metric value; default is set. Select the add or subtract action to adjust a metric and thus prioritize or deprioritize the matching route.
Metric Value
—Enter the metric value to set matching routes to, or add to, or subtract from the original metric value; range is 0 to 4,294,967,295.
Weight
—Set a weight (applied locally; not propagated); range is 0 to 4,294,967,295.
Origin
—Set the origin of the matching routes:
ebgp
,
ibgp
, or
incomplete
(unclear how the route came to be added to the RIB).
Originator ID
—Set the IP address of the originator of the matching routes.
Delete Regular Community
—Select a regular community to delete. Default is
None
.
Delete Large Community
—Select a large community to delete. Default is
None
.
Select
IPv4
or
IPv6
as the AFI.
On the
IPv4
tab, select a
Source Address
to set from the list of all source addresses from all logical routers or select
None
. At commit, the firewall checks that the source address you chose belongs to the logical router you are configuring.
Select an
IPv4 Next-Hop
to set:
none
,
peer-address (Use Peer Address)
, or
unchanged
.
On the
IPv6
tab, select
IPv6 Nexthop Prefer Global Address
to prefer the global unicast address over the other IPv6 address types (link-local address, anycast address, or multicast address) for next hop. (By default, connected peers prefer a link-local next hop address over a global next hop address.)
On the
IPv6
tab, select a
Source Address
to set from the list of all source addresses from all logical routers or select
None
. At commit, the firewall checks that the source address you chose belongs to the logical router you are configuring.
Select an
IPv6 Next-Hop
to set:
none
or
peer-address (Use Peer Address)
.
In the AS Path window,
Add
up to four AS paths to
Exclude
from the AS path of matching routes, perhaps to remove an AS from a confederation.
Add
up to four AS Paths to
Prepend
to the AS Path of matching route(s) (to make the route in an advertisement less desirable).
In the Regular Community window, select
Overwrite Regular Community
to overwrite the regular community.
Add
a
Regular Community
to add one or more regular communities.
In the Large Community window, select
Overwrite Large Community
to overwrite the large community.
Add
a
Large Community
to add one or more large communities.
In the Regular Community window, select
Overwrite Regular Community
to overwrite the regular community.
Add
a
Regular Community
to add one or more regular communities.
In the Large Community window, select
Overwrite Large Community
to overwrite the large community.
Add
a
Large Community
to add one or more large communities.
Click
OK
to save the route map entry. Optionally add more entries.
Click
OK
to save the BGP route map.
Create a Redistribution Route Map.
Select
Network
Routing
Filters
.
Add
a
Filters Route Maps Redistribution
by
Name
(maximum of 63 characters). The name must start with an alphanumeric character, underscore (_), or hyphen (-), and can contain a combination of alphanumeric characters, underscore, or hyphen. No dot (.) or space is allowed.
Enter a helpful
Description
.
To redistribute from a
Source Protocol
, select
BGP
,
OSPF
,
OSPFv3
,
RIP
, or
Connected Static
. The source protocol is where the Match selections apply.
To redistribute the routes to a
Destination Protocol
or local RIB, select
BGP
,
OSPF
,
OSPFv3
,
RIP
, or
Rib
. The destination protocol is where the Set selections apply. The Destination Protocols available in the dropdown depend on the Source Protocol selected. (This step shows an example of BGP redistributed to OSPF.)

Add
an
Entry
and enter the
Seq
number (range is 1 to 65,535).
Enter a helpful
Description
.
Select the
Action
:
Deny
or
Permit
.
Select the
Match
tab to configure criteria for the source protocol; this example specifies BGP attributes to match.

Select an
AS Path Access List
; default is
None
.
Select a
Regular Community
; default is
None
.
Select a
Large Community
; default is
None
.
Select an
Extended Community
; default is
None
.
Enter a
Metric
; range is 0 to 4,294,967,295.
Select an
Interface
; default is
None
.
Select the
Origin
of the route:
ebgp
,
ibgp
, or
incomplete
; default is
none
.
Enter a
Tag
; range is 1 to 4,294,967,295.
Enter a
Local Preference
; range is 0 to 4,294,967,295.
Select a
Peer
name or
local (Static or Redistributed routes)
; default is
none
.
The
Address
tab refers to the Destination address in a route. Select an
Access List
to specify routes with a destination address that must match in order to be redistributed. Default is
None
.
Select a
Prefix List
to specify routes with a destination address that must match in order to be redistributed. Default is
None
.
Select the
Set
tab to configure actions to perform on routes matching this rule, which will be redistributed to the destination protocol. (In this example, the destination protocol is OSPF.)

Select the
Metric Action
for the redistribution rule: you can
set
the Metric value,
add
the specified
Metric Value
to the matching route’s original Metric value, or
subtract
the specified
Metric Value
from the matching route’s original Metric value; default is
None
. Select the
add
or
subtract
action to adjust a metric and thus prioritize or deprioritize the matching route.
For example, you can put the metric of an IGP into BGP by using redistribution. The metric is dynamic, and you can simply add to its value rather than set it to an absolute number.
Enter a
Metric Value
to set, add to, or subtract from the metric; range is 0 to 4,294,967,295.
Select the
Metric Type
:
Type 1
or
Type 2
(because this example uses OSPF as the destination protocol).
Specify a
Tag
; range is 1 to 4,294,967,295.
Click
OK
to save the rule. Optionally add more rules.
Click
OK
to save the Redistribution route map.