CloudLabBox
Try the free demo

CCNP ENARSI lab 10 of 35

Route filtering with prefix lists, route maps, distribute lists and tags

Clean up what a partner injects into your EIGRP domain: accept only the prefixes the contract allows, tag them, keep them away from the branch, and stop a test subnet reaching the data centre, using prefix lists, route maps, an ACL and route tags.

Run this lab

It needs Lite: its 4 nodes are set to 4 vCPU and 2,048 MB in total. That fits the free demo too.

In your workspace: Shared, then CCNP ENARSI 300-410 guided labs, then 10 - Route filtering with prefix lists route maps distribute lists and tags

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 70 minutes
Nodes need
4 vCPU, 2,048 MB
Smallest plan
Lite

The scenario

Mosswood Bank exchanges routes with a payments partner through a gateway router (R2) that the bank manages but the partner controls the prefixes of. Last week the partner sent a default route, and half of the bank's Internet traffic followed it. The security team has now written a routing policy for the core router R1:

  1. From the partner, accept only 172.20.0.0/16 and any of its subnets up to /24, and the shared-services network 192.168.200.0/24. Never accept a default route, any 10.0.0.0/8 prefix from the partner (it overlaps the bank's own space), or anything longer than /24. The gateway's own loopback must still be reachable.
  2. Tag accepted partner routes 100 and shared services 200, so other routers can recognise them.
  3. The branch (R4) must never learn partner or shared-services routes.
  4. The data centre (R3) must never learn the branch test lab 10.4.99.0/24.
DeviceInterfaceAddressRole
R1Gi0/0 / Gi0/1 / Gi0/210.0.12.1 / 10.0.13.1 / 10.0.14.1 /24core: to R2 / R3 / R4
R2Gi0/010.0.12.2/24partner gateway, redistributes static routes
R3Lo110.3.3.1/24data centre
R4Lo1 / Lo2 / Lo9910.4.1.1 / 10.4.2.1 / 10.4.99.1 /24branch users / printers / test lab
R*n*Lo010.255.0.n/32management

R2 injects these prefixes (static routes to Null0, redistributed): 0.0.0.0/0, 10.99.0.0/16, 172.20.0.0/16, 172.20.1.0/24, 172.20.2.0/25, 172.20.3.0/26, 172.20.4.0/27 and 192.168.200.0/24.

What you’ll practise

  • Write prefix lists with ge and le and predict exactly what they match
  • Build route maps with several sequences, match and set clauses, and an implicit deny
  • Apply route maps and ACLs as EIGRP distribute lists inbound and outbound
  • Set route tags at one router and filter on them at another
  • Explain split horizon and route poisoning as built-in loop prevention

The tasks

  1. See what the partner sends
  2. Write the prefix lists
  3. Filter and tag inbound from the partner
  4. Keep partner routes away from the branch with tags
  5. Block the test lab from the data centre with an ACL
  6. Loop prevention you get for free

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Route filtering with prefix lists route maps distribute lists and tags4 nodes, 3 links. Every link is listed as text below the diagram.R1R2R3R4Gi0/0Gi0/0Gi0/1Gi0/0Gi0/2Gi0/0
4 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • R1 Gi0/0 to R2 Gi0/0
  • R1 Gi0/1 to R3 Gi0/0
  • R1 Gi0/2 to R4 Gi0/0
Nodes in Route filtering with prefix lists, route maps, distribute lists and tags, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
R1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
R2Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
R3Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
R4Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder CCNP ENARSI 300-410 guided labs.

  3. Open 10 - Route filtering with prefix lists route maps distribute lists and tags and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More CCNP ENARSI labs

All CCNP ENARSI labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.