The article explains the route advertisement issues that can happen when prefix-list and prefix-list-filter is used in the same policy and possible workarounds.
When prefix-list and prefix-list-filter is used in the same policy route export may not happen as expected. Even though the route to be advertised matches less specific prefix configured, the route may not get advertised.
In the below example, the policy export has prefix-list and prefix-list-filter
show policy-options policy-statement export from { prefix-list prefix_list_1; prefix-list-filter prefix_list_filter_1 longer; } then accept;
Below are the prefixes configured in each of them.
show policy-options prefix-list prefix_list_1
100.3.0.0/16;
100.4.0.0/14;
100.8.0.0/13;
100.16.0.0/12;
100.16.0.0/13;
100.24.0.0/14;
100.28.0.0/14;
100.32.0.0/11;
100.32.0.0/12;
100.48.0.0/13;
100.56.0.0/14;
100.60.0.0/15;
100.62.0.0/15;
100.64.0.0/11;
100.96.0.0/12;
show policy-options prefix-list prefix_list_filter_1
If the route 100.60.0.0/24 needs to be exported based on the above policy, then we expect it to be forwarded because it matches the prefix_list_filter_1 entry 100.32.0.0/11 with action as longer. But still we do not see the route exported.
When multiple prefix-list are together under a 'from' it is complied into one singular route-filter tree including all the cases of exact match/longer. When more specific route in the prefix list does not match, the complete tree is not walked through due to optimization.
So in this case when 100.60.0.0/24 route is matched with this tree, more specific prefix in the tree "100.60.0.0/15 exact" is looked at. 100.60.0.0/24 do not match with the prefix as the action is exact. Now the route filter is not exported because there is a failure case and the tree is not traversed completely.
show policy export
Policy export: [CHANGED/RESOLVED/]
Term unnamed:
prefix-list prefix_list_1
prefix-list-filter prefix_list_filter_1
route filter:
100.3.0.0/16; exact
100.4.0.0/14; exact
100.8.0.0/13; exact
100.16.0.0/12 exact
100.16.0.0/13 exact
100.24.0.0/14 exact
100.28.0.0/14 exact
100.32.0.0/11 exact
100.32.0.0/12 exact
100.48.0.0/13 exact
100.56.0.0/14 exact
100.60.0.0/15 exact
100.62.0.0/15 exact
100.64.0.0/11 exact
100.96.0.0/12 exact
100.3.0.0/16;longer
100.4.0.0/14;longer
100.8.0.0/13;longer
100.16.0.0/12 longer
100.32.0.0/11 longer <<<<<<<<<<<<<<<<<< matching prefix
100.64.0.0/11 longer
100.96.0.0/12 longer
then accept
The workaround or better way to organize the filter in different terms as below.
set policy-options policy-statement export term 1 from prefix-list-filter prefix_list_filter_1 longer
set policy-options policy-statement export term 1 then accept
set policy-options policy-statement export term 2 from prefix-list prefix_list_1
set policy-options policy-statement export term 2 then accept
In the above configuration the prefix with longer matches is first run through and hence routes will be exported.