BGP Prefix Filter Builder

BGP Prefix Filtering Fundamentals

BGP prefix filtering is one of the most critical security and traffic engineering controls in production networks. Without proper prefix filtering, an autonomous system can inadvertently advertise invalid routes to its peers or accept routes that should never be propagated. This can lead to route leaks, blackholing, or even large-scale internet disruptions. Network operators use prefix filters to enforce strict inbound and outbound route policies at BGP peering boundaries, ensuring that only authorized prefixes are advertised or accepted.

A prefix-list operates by evaluating each route against a sequential list of entries, where each entry specifies a prefix (in CIDR notation), an action (permit or deny), and optional ge (greater-than-or-equal-to) and le (less-than-or-equal-to) prefix-length modifiers. When ge and le are used, the prefix-list matches any prefix that falls within the specified prefix range. For example, an entry of permit 10.0.0.0/8 ge 16 le 24 permits any prefix within the 10.0.0.0/8 block that has a subnet length between /16 and /24. This provides fine-grained control over route advertisement granularity without requiring individual entries for every possible subnet.

Cisco IOS implements prefix filtering through ip prefix-list commands combined with route-maps that reference them via match ip address prefix-list. Each entry in a Cisco prefix-list is assigned a sequence number for ordered evaluation, and the list has an implicit deny at the end. Juniper JunOS uses a different approach with hierarchicalpolicy-options containing prefix-list and policy-statement blocks, where route filters are evaluated using route-filter statements that supportexact, orlonger, upto, and prefix-length-range match criteria. Understanding these platform-specific syntax differences is essential for multi-vendor network environments.

Our BGP Prefix Filter Builder abstracts away these syntax differences. Define your filter entries once using the unified entry form, and the tool generates the corresponding configuration for each target platform. This saves time and eliminates syntax errors that commonly occur when writing prefix filters manually across multiple vendor platforms. The builder also provides a summary view showing the total number of entries, unique prefixes, and the minimum and maximum prefix lengths across all entries, giving you immediate insight into your filter composition before deploying it to production.