ip ip-prefix
Function
The ip ip-prefix command creates an IPv4 prefix list or an entry in an IPv4 prefix list.
The undo ip ip-prefix command deletes an IPv4 prefix list or an entry from an IPv4 prefix list.
By default, no IPv4 prefix list is created.
Format
ip ip-prefix ip-prefix-name [ index index-number ] { permit | deny } ipv4-address mask-length [ match-network ] [ greater-equal greater-equal-value ] [ less-equal less-equal-value ]
undo ip ip-prefix ip-prefix-name [ index index-number ]
ip ip-prefix ip-prefix-name description text
undo ip ip-prefix ip-prefix-name description [ text ]
Parameters
| Parameter | Description | Value |
|---|---|---|
| ip-prefix-name | Specifies the name of an IPv4 prefix list. | The name is a string of 1 to 169 case-sensitive characters, with spaces not supported. When double quotation marks are used around the string, spaces are allowed in the string. |
| index index-number | Specifies the sequence number of an entry in the IPv4 prefix list. | The value is an integer that ranges from 1 to 4294967295. By default, the sequence number increases by 10 according to the configuration order, and the first sequence number is
10. NOTE:
A maximum of 65535 entries can be configured in an IP prefix list. |
| permit | Specifies the matching mode of the IP prefix list as permit. In permit mode, if the IP address to be filtered is within the defined prefix range, the IP address matches the routing policy and does not continue to match the next entry. Otherwise, the IP address continues to match the next entry. | - |
| deny | Specifies the matching mode of the IP prefix list as deny. In deny mode, if the IP address to be filtered is within the defined prefix range, the IP address fails to match the routing policy and cannot match the next entry. Otherwise, the IP address continues to match the next entry. | - |
| ipv4-address | Specifies an IP address. | The value is in dotted decimal notation. |
| mask-length | Specifies the mask length. | The value is an integer that ranges from 0 to 32. |
| match-network | Matches the network address. The match-network parameter can be configured only when the IP address generated after ipv4-address is ANDed with mask-length is 0.0.0.0. This parameter is mainly used to match routes with a specified network address. For example, the ip ip-prefix prefix1 permit 0.0.0.0 8 command filters all routes with mask length 8, while the ip ip-prefix prefix1 permit 0.0.0.0 8 match-network command filters all routes to the IP address range from 0.0.0.1 to 0.255.255.255. | - |
| greater-equal greater-equal-value | Specifies the lower threshold of the mask length. If greater-equal greater-equal-value and less-equal less-equal-value are not specified, the value of mask-length is the mask length. | greater-equal-value must meet the following requirement: mask-length ≤ greater-equal-value ≤ less-equal-value ≤ 32. If greater-equal is configured, the mask ranges from greater-equal-value to 32. |
| less-equal less-equal-value | Specifies the upper threshold of the mask length. If greater-equal greater-equal-value and less-equal less-equal-value are not specified, the value of mask-length is the mask length. | less-equal-value must meet the following requirement: mask-length ≤ greater-equal-value ≤ less-equal-value ≤ 32. If less-equal is configured, the mask ranges from mask-length to less-equal-value. |
| description text | Specifies the description of the IP prefix list. | The value is a string of 1 to 80 case-sensitive characters without spaces. If the string is enclosed within double quotation marks ("), the string can contain spaces. |
Usage Guidelines
Usage Scenario
An IP prefix list can be used as a filter or as matching conditions of a routing policy when it is used together with the if-match command.
Each entry in an IP prefix list can be used as a filtering rule. When a route to be filtered matches an entry, whether the route matches the IP prefix list is determined by the matching mode. A route to be filtered matches an entry or entries based on the following rules:
Sequential matching: The route has to match the entries in the IP prefix list in ascending order of their index-number values. Therefore, specifying index-number in a required sequence is recommended.
One-time matching: If a route matches one entry, the route matches the IP prefix list and will not be matched against the next entry.
Matching failure by default: If a route fails to match any of the entries, it fails to match the IP prefix list.
Case |
Commands |
Matching result |
Note |
|---|---|---|---|
1 |
ip ip-prefix aa index 10 permit 1.1.1.1 24 |
Only the route 1.1.1.1/24 is permitted, and the other routes are denied. |
This is a single-node accurate matching case, which indicates that only the route whose destination IP address and mask are the same as those specified by the entry meets the matching conditions. In addition, permit is configured as the matching mode. Therefore, the route 1.1.1.1/24 is permitted, and other routes are denied because they fail to meet the matching conditions. |
2 |
ip ip-prefix aa index 10 deny 1.1.1.1 24 |
All routes are denied. |
This is also a single-node accurate matching case. deny is configured as the matching mode. Therefore, the route 1.1.1.1/24 is denied, and the other routes are denied based on the rule of matching failure by default because they fail to meet the matching conditions. |
3 |
ip ip-prefix aa index 10 permit 1.1.1.1 24 less-equal 32 |
The routes 1.1.1.1/24, 1.1.1.1/32, and 1.1.1.1/26 are permitted, and the other routes are denied. |
This is also a single-node accurate matching case. permit is configured as the matching mode, and less-equal is set to 32. Therefore, the routes with 1.1.1.0 as the prefix and the mask ranging from 24 to 32 can be permitted, and the other routes are denied based on the rule of matching failure by default because they fail to meet the matching conditions. |
4 |
ip ip-prefix aa index 10 permit 1.1.1.0 24 greater-equal 24 less-equal 32 |
The routes 1.1.1.1/24, 1.1.1.1/32, and 1.1.1.1/26 are permitted, and the other routes are denied. |
This is also a single-node accurate matching case. permit is configured as the matching mode, greater-equal is set to 24, and less-equal is set to 32. Therefore, the routes with 1.1.1.0 as the prefix and the mask ranging from 24 to 32 can be permitted, and the other routes are denied based on the rule of matching failure by default because they fail to meet the matching conditions. This case is similar to case 3 in terms of the matching result. |
5 |
ip ip-prefix aa index 10 permit 1.1.1.1 24 greater-equal 26 |
The routes 1.1.1.1/32 and 1.1.1.1/26 are permitted, and the other routes are denied. |
This is also a single-node accurate matching case. permit is configured as the matching mode, and greater-equal is set to 26. Therefore, the routes with 1.1.1.0 as the prefix and the mask ranging from 26 to 32 can be permitted, and the other routes are denied based on the rule of matching failure by default because they fail to meet the matching conditions. |
6 |
ip ip-prefix aa index 10 permit 1.1.1.1 24 greater-equal 26 less-equal 32 |
The routes 1.1.1.1/32 and 1.1.1.1/26 are permitted, and the other routes are denied. |
This is also a single-node accurate matching case. permit is configured as the matching mode, greater-equal is set to 26, and less-equal is set to 32. Therefore, the routes with 1.1.1.0 as the prefix and the mask ranging from 26 to 32 can be permitted, and the other routes are denied based on the rule of matching failure by default because they fail to meet the matching conditions. This case is similar to case 5 in terms of the matching result. |
7 |
ip ip-prefix aa index 10 deny 1.1.1.1 24 ip ip-prefix aa index 20 permit 1.1.1.1 32 |
The route 1.1.1.1/32 is permitted, and the other routes are denied. |
This is a multi-node accurate matching case. deny is configured as the matching mode of the matching entry indexed 10, and therefore the route 1.1.1.1/24 is denied by the matching entry indexed 10 based on the rule of one-time matching. The route 1.1.1.1/32 fails to match the matching conditions, and it is then matched against the entry indexed 20 for which permit is configured as the matching mode. Consequently, the route 1.1.1.1/32 matches the matching conditions of the entry indexed 20. The other routes are denied based on the rule of matching failure by default because they fail to meet the matching conditions. |
8 |
ip ip-prefix aa index 10 permit 0.0.0.0 8 less-equal 32 |
The routes 1.1.1.1/24, 1.1.1.1/32, 1.1.1.1/26, 2.2.2.2/24, and 1.1.1.2/16 are all permitted. |
If the IP prefix is 0.0.0.0 and you specify a mask and a mask length range after this IP prefix, all routes with the mask length within the specified mask length range are denied or permitted, regardless of the mask. The mask length range is from 8 to 32, 0.0.0.0 is specified as the IP address, and permit is configured as the matching mode. Therefore, all routes with the mask length within the range are permitted. |
9 |
ip ip-prefix aa index 10 deny 0.0.0.0 24 less-equal 32 ip ip-prefix aa index 20 permit 0.0.0.0 0 less-equal 32 |
The route 1.1.1.2/16 is permitted, and the other routes are denied. |
Note: For the entry indexed 10, the mask length range is from 24 to 32, 0.0.0.0 is specified as the IP address, and deny is configured as the matching mode. Therefore, all routes with the mask length within the range are denied, and the route 1.1.1.2/16 that fails to match its matching conditions is then matched against the entry indexed 20. For the entry indexed 20, the mask length range is from 0 to 32, 0.0.0.0 is specified as the IP address, and permit is configured as the matching mode. Therefore, the route 1.1.1.2/16 is permitted by the entry indexed 20. |
9 |
ip ip-prefix aa index 10 deny 2.2.2.2 24 ip ip-prefix aa index 20 permit 0.0.0.0 0 less-equal 32 |
All routes except the route 2.2.2.2/24 are permitted. |
For the entry indexed 10, deny is configured as the matching mode. Therefore, the route 2.2.2.2/24 that matches its matching conditions is denied, and the other routes that fail to match the matching conditions are then matched against the entry indexed 20. For the entry indexed 20, the mask length range is from 0 to 32, 0.0.0.0 is specified as the IP address, and permit is configured as the matching mode. Therefore, all routes except the route 2.2.2.2/24 are permitted by the entry indexed 20. |
Configuration Impact
If you create an entry whose index-number has existed in the same IP prefix list but has different filtering rules, the new entry overwrites the existing one.
Precautions
Because of the matching failure by default, if one or more than one entry with deny as the matching mode is created, create an entry using the ip ip-prefix ip-prefix-name [ index index-number ] permit 0.0.0.0 0 less-equal 32 command so that all IPv4 routes may match the IP prefix list.
If ipv4-address mask-length is specified as 0.0.0.0 0, only default routes are matched.
If ipv4-address mask-length is set to 0.0.0.0 0 less-equal 32, all routes are matched.
Before you run the undo ip ip-prefix command to delete an IP prefix list that is referenced by another command, delete the reference configuration.
After a configuration is delivered, the device checks the validity of the parameters in the configuration and processes these parameters. After the processing, the generated configuration is the result of the AND calculation between the specified ipv4-address and mask-length. For example, if the specified ipv4-address and mask-length are 1.1.1.1 and 24, respectively, the generated configuration is 1.1.1.0 24.
If the ipv4-address in the generated configuration is 0.0.0.0, the configuration matches all IPv4 addresses. In this case, routes are filtered based on the following rules.
If the specified ipv4-address is not 0.0.0.0, the mask-length must not be 0.
Table 2 Route filtering rules Whether greater-equal and less-equal Exist in the Post-Processing Configuration
Condition
Matching Result
Example
Neither greater-equal nor less-equal exists.
The post-processing ipv4-address and mask-length are 0.0.0.0 and X (non-0 value), respectively. Matches all routes with the mask length of X.
Pre-processing:
ip ip-prefix aa index 10 permit 0.0.1.1 16
Post-processing:
ip ip-prefix aa index 10 permit 0.0.0.0 16
Matching result: The routes with the mask length of 16 are permitted.
greater-equal exists, but less-equal does not.
The post-processing ipv4-address and mask-length are 0.0.0.0 and X (non-0 value), respectively. Matches all the routes whose mask length is within the range from greater-equal to 32.
Pre-processing:
ip ip-prefix aa index 10 permit 0.0.1.1 16 greater-equal 20
Post-processing:
ip ip-prefix aa index 10 permit 0.0.0.0 16 greater-equal 20 less-equal 32
Matching result: The routes whose mask length is within the range from 20 to 32 are permitted.
greater-equal does not exist, but less-equal does.
The post-processing ipv4-address and mask-length are 0.0.0.0 and X (non-0 value), respectively. Matches all the routes whose mask length is within the range from X to less-equal.
Pre-processing:
ip ip-prefix aa index 10 permit 0.0.1.1 16 less-equal 30
Post-processing:
ip ip-prefix aa index 10 permit 0.0.0.0 16 greater-equal 16 less-equal 30
Matching result: The routes whose mask length is within the range from 16 to 30 are permitted.
Both greater-equal and less-equal exist.
The post-processing ipv4-address and mask-length are 0.0.0.0 and X (non-0 value), respectively. Matches all the routes whose mask length is within the range from greater-equal to less-equal.
Pre-processing:
ip ip-prefix aa index 10 permit 0.0.1.1 16 greater-equal 20 less-equal 30
Post-processing:
ip ip-prefix aa index 10 permit 0.0.0.0 16 greater-equal 20 less-equal 30
Matching result: The routes whose mask length is within the range from 20 to 30 are permitted.
Follow-up Procedure
In a scenario in which a routing policy is being modified, after an IP prefix is configured, the RM module notifies protocols of applying the changed routing policy immediately by default. However, in some cases, multiple commands need to be run to modify a routing policy. If other commands need to be run after an IP prefix is configured, protocols may apply the routing policy whose modification is not complete yet. To solve this problem, run the route-policy-change notify-delay command to configure a delay for protocols to apply the changed routing policy.
Example
# Configure the IP prefix list named p1 to permit only the routes with the mask length ranging from 17 to 18 on the network segment 10.0.0.0/8.
<HUAWEI> system-view
[HUAWEI] ip ip-prefix p1 permit 10.0.0.0 8 greater-equal 17 less-equal 18
<HUAWEI> system-view
[HUAWEI] ip ip-prefix p3 index 10 deny 0.0.0.0 8 match-network
[HUAWEI] ip ip-prefix p3 index 20 permit 0.0.0.0 0 less-equal 32