Prefix-lists are a precise and scalable tool for filtering routes based on network prefix and prefix length – typically used in routing (especially BGP).

Facts (key topic)

• Matches: network address + prefix length, with ranges via ge / le
• Used for route filtering, not traffic filtering (that’s ACLs)
• Sequence numbers control order (lowest evaluated first)
• Implicit deny at the end if nothing matches
• Typical use: BGP, OSPF (via route-maps), EIGRP
• Very high scalability – better than ACLs

Which problem does it solve?

• ACLs are imprecise and hard to maintain for routing
• Risk of advertising overly broad prefixes or accepting unwanted routes (route leaks)

Prefix-lists match both network and mask length, are readable and deterministic – perfect for BGP policy control.

Configuration (IOS / IOS-XE)

ip prefix-list PL-LOCAL permit 10.0.0.0/8
ip prefix-list PL-LOCAL seq 10 permit 10.0.0.0/8
! prefix-length range (CCNP important!):
ip prefix-list PL-LOCAL seq 20 permit 10.0.0.0/8 ge 16 le 24
! matches 10.0.0.0/16, 10.1.0.0/17, 10.2.3.0/24 – but NOT /25 or /15
! IPv6:
ipv6 prefix-list PL-V6 seq 10 permit 2001:db8::/32 le 64

Prefix-list + BGP (exam classic)

router bgp 65001
 neighbor 192.0.2.1 prefix-list PL-LOCAL in
 neighbor 192.0.2.1 prefix-list PL-LOCAL out

In a route-map (redistribution, BGP attribute manipulation):

route-map RM-FILTER permit 10
 match ip address prefix-list PL-LOCAL

Special considerations

• Evaluated top-down → order is everything
• Use sequence numbers for easy editing
• Prefix-lists filter routes only, never packets
• In BGP think inbound vs outbound

ACL vs prefix-list

Feature	ACL	Prefix-list
Matches prefix length	❌	✅
Readable	❌	✅
Scalable	⚠️	✅
Routing-focused	⚠️	✅

CCNP exam tips 🔥

• Don’t confuse ge/le with wildcard masks
• No match = deny
• Prefix-list ≠ traffic filter
• Better than distribute-lists in modern designs