300-410 · Question #76
After some changes in the routing policy, it is noticed that the router in AS 45123 is being used as a transit AS router for several service provides. Which configuration ensures that the branch…
The correct answer is D. ip as-path access-list 1 permit ^$ neighbor bgp 45123 neighbor SP-Neighbors filter-list 1 out. To ensure the router advertises only its local networks and acts as a non-transit AS, an AS-path access-list matching an empty AS path (^$) must be applied outbound.
Question
Options
- Aip as-path access-list 1 permit ^45123 | neighbor bgp 45123 neighbor SP-Neighbors filter-list 1 out
- Bip as-path access-list 1 permit .* neighbor bgp 45123 neighbor SP-Neighbors filter-list 1 out
- Cip as-path access-list 1 permit ^45123$ neighbor bgp 45123 neighbor SP-Neighbors filter-list 1 out
- Dip as-path access-list 1 permit ^$ neighbor bgp 45123 neighbor SP-Neighbors filter-list 1 out
How the community answered
(33 responses)- A6% (2)
- B6% (2)
- C3% (1)
- D85% (28)
Why each option
To ensure the router advertises only its local networks and acts as a non-transit AS, an AS-path access-list matching an empty AS path (`^$`) must be applied outbound.
`^45123|` is an incomplete or malformed regex; if intended to match paths starting with 45123, it could permit routes that merely passed through AS 45123, not just locally originated ones.
`.*` matches any AS path, including those with multiple AS numbers, which would permit transit traffic and defeat the purpose of being a non-transit AS.
`^45123$` would match routes whose AS path consists solely of AS 45123, which is typically for routes received inbound from a peer after it prepends its AS, not for identifying locally originated routes for outbound filtering.
When a router advertises a locally originated network to an eBGP peer, the AS-path attribute, from the perspective of the `as-path access-list` evaluating outbound routes, is considered empty (`^$`) before the local AS is prepended. By permitting only an empty AS path, the router ensures that only routes originated within its own AS (45123) are advertised to SP neighbors, effectively preventing it from being a transit AS for routes learned from other ASes.
Concept tested: BGP AS-path filtering, non-transit AS
Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_bgp/configuration/xe-3s/asr1000/bgp-xe-3s-book/bgp-cfg-aspath-acl.html
Topics
Community Discussion
No community discussion yet for this question.