Routing Policies | Teleinf Edu

Introduction: routing policy goals and scope

Choosing the shortest path is not sufficient for routing between independently administered networks. An administrator may restrict particular links, select a preferred provider, prevent transit, or control which prefixes are advertised to a neighbor. The rules must account for technical properties as well as the administrative relationships between Autonomous Systems.

The Internet, a global network of independent networks known as , faces a similar challenge. Protocols such as OSPF calculate routes inside one Autonomous System from its topology and costs. The Internet connects networks operated by different companies, institutions, and organizations. A path selected only by cost might cross an undesired provider, violate a transit agreement, use a link without the required security, or incur a high charge.

Routing policies are administrator-defined rules that control how a router accepts, modifies, selects, and advertises routes. They can reject unwanted prefixes, change BGP attributes, and restrict which information is exported to specific neighbors. In BGP, policies connect technical decisions with security requirements, transit agreements, and link costs. BGP exchanges reachability between Autonomous Systems, but the protocol does not prescribe one import or export policy. Each operator defines its own rules.

Three elements of a routing policy

An administrator can implement a routing policy through three groups of actions: prefix filtering, attribute modification, and redistribution. Each group affects a different stage of routing-information processing. A filter can stop a route, a modification can change its preference, and redistribution can create an advertisement in another protocol.

Route filtering:
Filtering determines which routing advertisements are accepted from a neighbor and which prefixes are announced to it. Access lists, prefix lists, and AS_PATH filters limit the information that reaches the route-selection process. A rule can permit a prefix or reject it before further processing.
Attribute modification:
After a route is accepted, an administrator can change its BGP attributes. LOCAL_PREF affects selection inside the local AS, while MED and AS_PATH can influence a neighboring system. The result depends on the direction in which the policy is applied and on the remaining steps of the BGP decision process.
Redistribution:
Redistribution takes routes from one source, such as OSPF or a static routing table, and introduces them into another protocol, such as BGP. A redistribution policy should identify the exact prefixes that may leave the domain and may set their attributes before advertisement.

Route filtering

A router checks a route against a filter before accepting or advertising it. In BGP, a filter can operate in two directions. An inbound policy controls data stored in the local database, while an outbound policy controls the contents of updates sent to a particular neighbor:

Inbound filtering

This is applied to routing updates received from a neighbor. The administrator selects prefixes that may enter the local BGP database and can reject routes outside an agreed address range or security policy.

Outbound filtering

This is applied to routing updates sent to a neighbor. The administrator selects local prefixes and customer routes that may be advertised to that neighbor. The filter can also prevent unintended transit between other Autonomous Systems.

Why filtering matters

Security: Inbound filtering limits the risk of accepting a false prefix, redirecting traffic, or advertising private addresses outside the local domain. Operators also commonly filter unexpected prefix lengths and AS_PATH values.
Policy enforcement: An agreement may allow traffic only to an operator's own customers. Outbound filters reduce the risk of becoming an unintended transit path for another neighbor.
Stability: A filter can reject unstable or unnecessary prefixes so that frequent changes do not affect local decisions or overload BGP sessions.
Resource management: Limiting the number of stored routes reduces router memory and CPU requirements, especially when many prefixes are present.

BGP attribute modification

After a route passes through a filter, it enters the BGP decision process. An administrator can change its attributes to influence path selection by routers in the local AS or by neighboring systems. This is how traffic engineering is implemented in BGP. Attributes have different scopes and directions, so the same value need not produce the same result at two operators.

Controlling Outbound Traffic with LOCAL_PREF

An AS with multiple Internet connections needs a rule for selecting an exit for outbound traffic. The main attribute for this purpose is LOCAL_PREF (LOCAL_PREFERENCE).

During BGP selection, a route with a higher LOCAL_PREF is preferred over a comparable route. The attribute is carried to iBGP routers in the same AS and is not advertised to eBGP peers, so it controls internal exit selection.

Example: Choosing the Primary ISP

Your company (AS 65001) has a fast, expensive fiber connection to ISP-A (AS 65002) and a slower, cheaper backup connection to ISP-B (AS 65003). You want all outbound traffic to default to ISP-A.

On your border router connected to ISP-A, you apply an inbound policy that sets the LOCAL_PREF for all routes learned from them to 200.
For this example, routes learned from ISP-B are configured with a LOCAL_PREF of 100.
When the routes are advertised via iBGP to other routers in the AS, they see that paths through ISP-A have a higher preference $(200 > 100)$ and select them when the remaining decision-process conditions are satisfied.
If the connection to ISP-A fails, its routes disappear, and the routers automatically fall back to using the routes via ISP-B.

Influencing Inbound Traffic with MED and AS_PATH Prepending

Influencing inbound traffic is harder because the other AS makes the final decision. You can still communicate a preference through selected attributes.

Multi-Exit Discriminator (MED): MED communicates a preferred entry point to a neighboring AS. In the standard decision process, a lower MED value is preferred when comparing routes from the same neighboring AS, but a device may apply local rules and the neighbor may ignore the attribute. In the example, you could send MED 100 to ISP-A over the primary link and MED 200 over the backup link. If ISP-A honors MED, it may select the primary link.
AS_PATH prepending:An administrator can add its own ASN to AS_PATH repeatedly so that the path appears longer. BGP often prefers a shorter path, but the neighbor's local policy can change the result. To reduce use of the backup link, you could advertise routes to ISP-B with (65001, 65001, 65001), increasing its apparent length compared with the advertisement through ISP-A.

Route redistribution

moves routes between protocol domains. A BGP router can advertise networks learned through an IGP such as OSPF, or through static routes, to external BGP peers. Each such operation should have an explicit prefix filter. The operator should also define attributes, metrics, and route tags so that information does not return to the source protocol and create a loop.

Controlling the redistributed set

A company's web server can become reachable from the Internet when its prefix is learned through internal OSPF and a redistribution policy permits BGP to advertise it. The presence of a route in OSPF should not by itself export that route beyond the AS.

Without filtering, a router could advertise a private addressing plan or routes intended only for the internal network. This can expose information and create incorrect paths. A secure policy should reject prefixes by default and permit only those that are meant to be public.

Route maps

On many routing platforms, including Cisco IOS, a route map combines match criteria with actions applied to a route. It supports ordered, conditional policies for filtering, redistribution, and BGP attribute changes. The same map can be attached in an inbound or outbound direction, with different effects on the route.

A route map acts as a conditional statement for routes and consists of sequenced entries. The router checks entries in order and applies the actions in the first applicable entry. Sequence order matters because an earlier entry can end processing for a route:

Match clause (the "If"): The router checks whether the route meets defined criteria. This is often done with an to identify specific networks.
Set clause (the "Then"): After a match, the router applies actions such as setting LOCAL_PREF, setting MED, or prepending AS_PATH.
Permit/deny:An entry ends with permit or deny. After a match, processing normally stops; when there is no match, the router evaluates the next entry. If no entry permits the route, the route map's implicit deny rejects it.

Pseudo-code of a Route Map Policy

ROUTE-MAP "ISP-A-INBOUND-POLICY" permit 10
  MATCH ip address prefix-list "CUSTOMER-ROUTES"
  SET local-preference 150

ROUTE-MAP "ISP-A-INBOUND-POLICY" permit 20
  MATCH ip address prefix-list "PEER-ROUTES"
  SET local-preference 100

ROUTE-MAP "ISP-A-INBOUND-POLICY" deny 30
  MATCH ip address prefix-list "BOGON-NETWORKS"

This example policy sets a high preference for routes learned from trusted customers, a normal preference for routes from peers, and explicitly denies known bogus networks. Route maps are applied to BGP neighbors in either the inbound or outbound direction to enforce these policies.