8.1 Controlling Routing Update Traffic  
  8.1.3 Filtering routing updates with distribute-list  
Configuring an interface as passive prevents it from sending updates entirely. However, sometimes there is a need to suppress only certain routes in the update from being sent or received. If RTA is configured with the network 10.0.0.0 command, all four directly connected subnets will be advertised in the updates from RTA, along with any dynamically learned routes. However, RTZ may need to be prevented from learning about network 10.1.1.0 from RTA.

This may be needed to enforce a routing policy that is based on some external factor such as link expense, administrative jurisdiction, or security concerns. In some cases, there is the desire to reduce needless overhead by preventing access routers from receiving the complete, and possibly immense, core routing table. Just assume that for one of these reasons, RTZ is not to learn the route to 10.1.1.0 from RTA.

Use the distribute-list command to pick and choose which routing updates a router will send or receive. By referencing an access list, the distribute-list creates a route filter. This is a set of rules that precisely controls what routes a router will send or receive in a routing update. This command is available for all IP routing protocols and can be applied to either inbound or outbound routing updates. When applied to inbound updates, the syntax for configuring a route filter is as follows:

Router(config-router)#distribute-list access-list-number in [interface-name]

When applied to outbound updates, the syntax can be more complicated as shown in the following:

Router(config-router)#distribute-list access-list-number out [interface-name | routing-process | as-number]

The routing-process and as-number options are invoked when exchanging routes between different routing protocols. This will be covered later in the module, in the section titled Route Redistribution.

In Figure , access list 24 will match the route to 10.1.1.0 and result in a deny. When referenced by the distribute-list command, this match results in the removal of the route to network 10.1.1.0 in the outbound update. However, there is a drawback. The distribute-list 24 out command will have a global effect on RIP updates out every interface, not just out the interface connected to RTZ. The intent was to suppress the 10.1.1.0 route from updates to RTZ only. This level of specificity can be accomplished by using an optional interface argument with the command, shown as follows:

RTA(config-router)#distribute-list 24 out interface s2

Conversely, RTZ could have been told to globally filter network 10.1.1.0 from any incoming updates.

Or, 10.1.1.0 could have been precisely filtered from the specific interface on RTZ, shown as follows:

RTZ(config-router)#distribute-list 16 out

The distribute-list command can filter any routes in either an outbound or an inbound update globally, or for a specific interface. The Cisco IOS permits one incoming and one outgoing global distribute-list for each routing process. It also permits one incoming and one outgoing distribute-list for each interface involved in a routing process. Keep track of which routing filters are applied globally and which are applied on specific interfaces with the show ip protocols command.

Configuring a Passive EIGRP Interface Using distribute-list Command
A passive interface cannot send EIGRP Hello packets, which prevents adjacency relationships with link partners. A "pseudo" or false passive EIGRP interface can be created by using a route filter that suppresses routes from the EIGRP routing update, shown as follows:

RTA(config)#router eigrp 364
RTA(config-router)#network 10.0.0.0
RTA(config-router)#distribute-list 5 out interface s0
RTA(config-router)#exit
RTA(config)#access-list 5 deny any

With this configuration, RTA can send EIGRP Hello packets and establish adjacencies, but no routes will appear in any updates sent out s0.

 

Lab Activity

e-Lab Activity: Filtering Routing Updates with Distribute-list

This lab is using distribute-list to configure two exchanged routes.