Hi Luisi, while I am not aware of the complete thread, I see that you are trying to match VRF route information, using prefix-list or access-list:
For question A: Basically the le parameter in the prefix list you show us, "ip prefix-list FTP_NET seq 1 permit 10.53.0.224/29 le 32" For me it means: to check the first 29 bits of the prefix 10.53.0.224 and make sure that they match, Then it will check to make sure that the subnet mask is LESS THAN or EQUAL to 32, the subnet mask can't be any lower than the bits we are checking. So the valid range of subnet masks for this one would be 32 bits down to 29 bits (24,25,26,27-- and so on). Please check out this article https://cisco.hosted.jivesoftware.com/.../How%20do%20prefix%20list%20work.pd f And For question B: A normal access-list CANNOT check the subnet mask of a network. It can only check bits to make sure they match, nothing more. A prefix-list has an advantage over an access-list in that it CAN check BOTH bits and subnet mask - both would have to match for the network to be either permitted or denied. Off course you can use extended access-list to filter route, and make them behave just like a prefix-list, please take a look at the following link http://tcpmag.com/qanda/article.asp?EditorialsID=358 Thanks Victor Cappuccio.- [email protected] CCIE(R/S) #20657 STAC Support Engineer Cisco Small Business Support. -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of luismi Sent: lunes, 07 de septiembre de 2009 11:17 To: Tomas Caslavsky Cc: [email protected]; [email protected]; Daniska Tomas Subject: Re: [c-nsp] Leaking specific routes from a VRF Hi all, We are doing some tests here with the code provided by Tomas. We have several questions that we were not able to find a proper answer over internet that we would like to share with you to see if we can understand everything correctly: a) "ip prefix-list" has a parameter called "le" so we can create the rule like this: ip prefix-list FTP_NET seq 1 permit 10.53.0.224/29 le 32 Why is the reason to use "le" parameter? we saw it in several examples over internet but we don't understand it yet. What is the impact if we don't use it? b) Is there any difference if we use a normal ACL instead a prefix-list in the route-map? we also saw several configurations using ACLs and it seems to do the same. Regards and thanks in advance. _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
