Routing policy: accept, prefer, announce
Routing policy on an edge router answers three questions: what do I accept, which path do I prefer, and what do I announce?
What to accept
FROM-UPSTREAM is the import filter, applied to both ISPs. Prefix lists are checked top to bottom, and the first match decides:
- The office's own prefix, or any part of it, is refused. Accepting it would let a mistake (or an attack) somewhere else pull your own traffic away from you.
- Private and shared address space (10/8, 172.16/12, 192.168/16, 100.64/10) never belongs on the internet.
- Anything longer than a /24 is refused: the internet doesn't carry them, so they're mistakes.
- Everything else, up to /24, is allowed, including the default route (a /0).
soft-reconfiguration inbound keeps a copy of what each neighbour sent before the filter. Comparing received-routes with routes shows the filter at work: ISP 1 sent five routes, and three were filtered. Two are the ones it was set up to leak; the third is the office's own /24, which came back from ISP 1 by way of ISP 2. Plain BGP would have dropped that one anyway, because AS 64500 is in its path, but the filter doesn't rely on it.
Which path to prefer
Both ISPs send a default route. ISP1-IN sets local preference 200 on everything from ISP 1; ISP 2's routes keep the default of 100. Local preference is the first thing BGP compares between paths, so show bgp ipv4 marks ISP 1's paths best (>), and ISP 2's are kept as the backup.
What to announce, and how
The outbound route maps allow only OUR-PREFIX, so the router can never pass ISP 1's routes on to ISP 2 and become a free transit path between them, a classic and expensive mistake. Towards ISP 2, the route map also prepends the office's AS twice. Local preference only affects your outgoing traffic; prepending is how you influence the incoming. In ISP 2's table, the office prefix now has two paths: through ISP 1 (64501 64500, two ASes) and directly (64500 64500 64500, three). It picks the shorter, so even traffic from ISP 2's customers arrives through ISP 1 while it's up.
root@edge:~# vtysh -c "show bgp ipv4 neighbors 192.0.2.0 received-routes"
BGP table version is 3, local router ID is 10.255.0.1, vrf id 0
Default local pref 100, local AS 64500
Status codes: s suppressed, d damped, h history, u unsorted, * valid, > best, = multipath,
i internal, r RIB-failure, S Stale, R Removed
Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found
Network Next Hop Metric LocPrf Weight Path
*> 0.0.0.0/0 192.0.2.0 0 0 64501 i
*> 100.64.0.0/10 192.0.2.0 0 0 64501 i
*> 198.51.100.0/24 192.0.2.0 0 0 64501 i
*> 203.0.113.0/24 192.0.2.0 0 64501 64500 i
*> 203.0.113.128/25 192.0.2.0 0 0 64501 i
Total number of prefixes 5 (3 filtered)
root@edge:~# vtysh -c "show bgp ipv4 neighbors 192.0.2.0 routes"
BGP table version is 3, local router ID is 10.255.0.1, vrf id 0
Default local pref 100, local AS 64500
Status codes: s suppressed, d damped, h history, u unsorted, * valid, > best, = multipath,
i internal, r RIB-failure, S Stale, R Removed
Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found
Network Next Hop Metric LocPrf Weight Path
*> 0.0.0.0/0 192.0.2.0 0 200 0 64501 i
*> 198.51.100.0/24 192.0.2.0 0 200 0 64501 i
Displayed 2 routes and 5 total paths- Lines 11–15: Everything ISP 1 sent, before filtering.
- Line 12: Shared address space: refused by the prefix list.
- Line 14: The office's own prefix, coming back through ISP 2 (AS 64500 is in the path): refused.
- Line 15: A piece of the office's prefix: refused.
- Line 17: Five received, three filtered.
- Lines 29–30: What's left: the default route and the web server's network, with local preference 200.
root@edge:~# vtysh -c "show bgp ipv4"
BGP table version is 3, local router ID is 10.255.0.1, vrf id 0
Default local pref 100, local AS 64500
Status codes: s suppressed, d damped, h history, u unsorted, * valid, > best, = multipath,
i internal, r RIB-failure, S Stale, R Removed
Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found
Network Next Hop Metric LocPrf Weight Path
*> 0.0.0.0/0 192.0.2.0 0 200 0 64501 i
* 192.0.2.2 0 0 64502 i
*> 198.51.100.0/24 192.0.2.0 0 200 0 64501 i
* 192.0.2.2 0 0 64502 i
*> 203.0.113.0/24 0.0.0.0 0 32768 i
Displayed 3 routes and 5 total paths- Lines 11–12: Two default routes. ISP 1's is best (
>) because of its local preference. - Line 15: The office prefix, from the blackhole route (
0.0.0.0as next hop: this router).
root@isp1:~# vtysh -c "show bgp ipv4 203.0.113.0/24"
BGP routing table entry for 203.0.113.0/24, version 4
Paths: (1 available, best #1, table default)
Advertised to non peer-group peers:
192.0.2.1 198.51.100.2
64500
192.0.2.1 from 192.0.2.1 (10.255.0.1)
Origin IGP, metric 0, valid, external, best (First path received)
Last update: Wed Nov 4 22:02:27 2026
root@isp2:~# vtysh -c "show bgp ipv4 203.0.113.0/24"
BGP routing table entry for 203.0.113.0/24, version 5
Paths: (2 available, best #1, table default)
Advertised to non peer-group peers:
192.0.2.3 198.51.100.1
64501 64500
198.51.100.1 from 198.51.100.1 (198.51.100.1)
Origin IGP, valid, external, best (AS Path)
Last update: Wed Nov 4 22:02:27 2026
64500 64500 64500
192.0.2.3 from 192.0.2.3 (10.255.0.1)
Origin IGP, metric 0, valid, external
Last update: Wed Nov 4 22:02:27 2026- Lines 6–8: ISP 1: one AS in the path, learned directly.
- Lines 16–18: ISP 2 prefers the path through ISP 1 (two ASes)…
- Lines 20–22: …over the direct one, made three ASes long by the prepend.
Check your understanding
Local preference 200 on ISP 1's routes changes which path…
- …the office's outgoing traffic takes. For incoming traffic you need something the ISPs see, like prepending.
- …both incoming and outgoing traffic takes.
- …the ISPs use to reach each other.
- …OSPF uses inside the office.
Check your understanding
Why do the outbound route maps match only OUR-PREFIX?
- So the office never re-announces one ISP's routes to the other and becomes a transit path between them.
- Because BGP can only announce one prefix per session.
- To hide the office's internal /26.
- Because the ISPs require route maps.