All You Need to Know About Prefix Lists..!

 The prefix list have been introduced speclfically for route / prefix filtering they allow to match a range of prefixes within an address block this is not easy to implement with an IP extended ACL and not all routing protocols support this use of IP extended ACL.

Example:

ip prefix-list EXAMPLE permit 10.100.0.0/16 ge 20 le 24

This means all prefixes within 10.100.0.0/16 with prefix length between 20 and 24 are accepted:

10.100.128.0/17 is not a match
10.100.20.0/24 is a match
10.100.21.128/25 is not a match
10.100.0.0/23 is a match

The most notable and important difference is that a prefix list allows you to filter networks based on their subnet mask. ACLs used in distribute list filter networks only by network addresses but they do not perform matching on subnet mask; in other words, for an ACL used in distribute list, the networks 192.168.10.0/24 and 192.168.10.0/28 are indistinguishable. Moreover, the prefix list also allows you to specify networks in a much more natural format than ACLs.

Example -1: How To Permit all the prefix.

ip prefix-list ALL-Networks permit 0.0.0.0/0 le 32

Example #2: How to block the prefix 11.0.0.0/24.

ip prefix-list DENY-11 deny 11.0.0.0/24

Due to the implicit deny of the prefix list, a second line is required to permit the other networks:

ip prefix-list DENY-11 permit 0.0.0.0/0 le 32

Note: the first line can be written like:

ip prefix-list DENY-11 deny 11.0.0.0/24 ge 24 le 24

Example #3: Permit only the default route

ip prefix-list DEFAULTE-ROUTE permit 0.0.0.0/0

Example #4: Permit all prefixes in the 11.0.0.0/16 with subnet mask less or equal /30

ip prefix-list TEST permit 11.0.0.0/16 le 30

this check the first 16 bits of the prefix 11.0.0.0, where the subnet mask must be less than or equal to 30.

So, if you have these networks:

11.0.0.0/24

11.11.11.0/24

11.0.11.128/30

11.0.0.10/32

Only the first and the third are valid. The second is not valid due to different prefix, while the fourth due to a greater subnet mask.

Example #5: Permits all prefixes in the 192.168.0.0/24 with subnet mask between 26 and 30 bits.

ip prefix-list TEST permit 192.168.0.0/24 ge 26 le 30

So, if you have these networks:

192.168.123.0/24
192.168.0.0/30
192.168.0.0/16
192.168.0.0/8

Only the second statement is valid; the third and fourth are not valid due to lesser subnet mask and the first one is not valid due the different network.

Example #6: Deny all the loopback network (/32)

ip prefix-list Test deny 0.0.0.0/0 ge 32 le 32

ip prefix-list Test permit 0.0.0.0/0 le 32

The first line block all the network with subnet mask /32, while the last line permit any.