BGP Route Filtering for Loop Prevention in AS64514

300-420 By islever Editorial Last updated

Create stable, secure, and scalable routing designs for BGP

Short answer

A An as-path access-list matching the originating AS number attached to a deny route-map statement, with route-map applied to each neighbor inbound

Question

Exhibit: BGP Route Filtering for Loop Prevention in AS64514
Refer to the exhibit. Which route filtering technique is required within AS64514 to ensure that BGP prefixes originating locally are not accepted from AS64512 or AS64513?
  1. an as-path access-list matching the originating AS number attached to a deny route-map statement, with route-map applied to each neighbor inbound Correct Answer
  2. no prefix-list or as-path access-list filtering technique is to be applied to each neighbor, either inbound or outbound
  3. a prefix-list matching the locally originated prefixes attached to a deny route-map statement, with the route-map applied to each neighbor inbound
  4. an as-path access-list matching the originating AS number attached to a deny route-map statement, with route-map applied to each neighbor outbound

Key Takeaways

The main trap is confusing inbound vs. outbound application; filtering must be inbound to prevent acceptance of routes, and AS-path filtering is preferred over prefix-lists for AS-specific loop prevention.

Learn how to configure BGP route filtering to prevent accepting locally originated prefixes from external peers using AS-path access-lists and route-maps.

Common mistake: Choosing Option D (outbound filtering) is common, but this only controls what you send, not what you accept. Choosing Option B ignores the need for explicit configuration best practices.

Expert Analysis

The scenario involves BGP routing within AS64514, which receives updates from neighbors in AS64512 and AS64513. The goal is to prevent AS64514 from accepting prefixes that it originates itself (originating in AS64514) if those prefixes are somehow advertised back into the network by external peers.

BGP has a built-in loop prevention mechanism: a router will reject any update containing its own AS number in the AS_PATH attribute. However, relying solely on this implicit behavior is not considered a robust security or stability practice for production designs, especially when dealing with potential misconfigurations or route leaks. Furthermore, the question asks for a specific "route filtering technique," implying an explicit configuration rather than just default behavior.

Let's analyze the options:

  • Option A proposes using an AS-path access-list matching the originating AS number (AS64514), attached to a deny statement in a route-map, applied inbound. This explicitly filters out any prefix whose AS_PATH contains AS64514. Since prefixes originating locally would have AS64514 as the first AS in the path (or only AS if no other ASes are traversed), this effectively blocks them from being accepted via inbound updates from external peers. This is the standard best practice for preventing accidental acceptance of one's own routes.
  • Option B suggests no filtering, which relies entirely on the implicit loop detection. While functionally similar in many cases, it lacks the explicit control required by the question's context of "required technique" for ensuring stability.
  • Option C uses a prefix-list matching locally originated prefixes. This is less reliable because prefix overlap can occur, and it doesn't leverage the unique AS_PATH signature. Also, applying a deny for local prefixes inbound might block legitimate re-advertisements if they were supposed to be propagated differently, but more importantly, AS-path filtering is the canonical method for AS-based loop prevention.
  • Option D applies the filter outbound. Filtering outbound prevents sending bad routes, but does not prevent accepting them. The question specifically asks about ensuring prefixes are not accepted.

Therefore, Option A is the correct technical approach to explicitly filter incoming updates that contain the local AS number, providing a defense-in-depth layer against loops.

Exam Strategy

When asked about preventing acceptance of routes, always look for 'inbound' application of filters. For loop prevention involving your own AS, prioritize AS-path filtering over prefix-lists unless specific prefix ranges are the sole concern. Remember that BGP's implicit loop detection exists, but explicit filtering is often the tested 'best practice' solution.

Frequently Asked Questions

Why not rely on BGP's built-in loop prevention?

While BGP drops updates with its own AS in the path, explicit filtering provides better visibility, logging, and control. It also handles edge cases where AS_PATH manipulation might obscure the loop.

What is the difference between AS-path and prefix-list filtering here?

AS-path filtering targets the origin AS directly, which is unique to your network. Prefix-lists match IP addresses, which could potentially overlap with other networks, making AS-path more precise for this specific goal.

More 300-420 FAQ →

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 2 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 2

  1. G_Singh12 👍 1 Answered B
    • f the router detects its own Autonomous System number (AS64514) anywhere inside that AS_PATH list, it means the route originally started inside its own network, looped through neighboring ASes (like AS64512 or AS64513), and is now trying to re-enter. The router will automatically drop and reject the update.
  2. bp3t3r_ 👍 1 Answered B
    Routers in AS64514 will automatically drop prefixes which includes the AS Path 64514. Built in loop prevention.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

POV Report Builds the Customer Platform During Discovery

S-grade

VPLS design for sites sharing one IP subnet

S-grade

Inter-VN Communication in Cisco SD-WAN Architecture

S-grade

Advertising a Default Route from Core to Aggregation to Hide Instability

S-grade

Practice All 300-420 Questions

Access 150 questions with complete answers and detailed explanations.

View Full 300-420 Practice Test →

← Back to 300-420 Study Guide