Filtering Subnets of a Summary using BGP Suppress Maps

aggregate address sub command of BGP can be used for manual sumarization of BGP routes and when it is used with summary only keyword, it can filter all component subnets of the summary or when the summary only keyword is not used, it can advertise all the component subnets along with the summary address. Refer this post for more research on aggregate address command.

Anyhow this means you can either advertise all the component subnets of the summary or you can stop advertising all the component subnets of the summary. But what if you want to filter some component subnets of the summary? Here is the application of Suppress Map comes in..

What to remember is;

The prefixes which are permitted by the route-map are suppressed which means the prefixes which are denied route-map are advertised..

I am getting the same example scenario used in the Route Summarization using Aggregate Address Command in BGP post.

The BGP configuration is like the following in R1;

Routes advertised by R1 are like the following..









Routes learned by R3 from R1 are like the following..

The tricky part is that in suppress maps, the selecting logic is bit different. The subnets not to be advertised (suppressed) will be matched with a permit statement in both ACL and in route-map.

Note that the extended ACL is used here using both source and destination portions to match the network id and the subnet mask. This is a bit rare configuration method. Ofcourse you can use a standard ACL too.

R1(config)#ip access-list extended SP-MAP-ACL
R1(config-ext-nacl)#permit ip host 11.20.1.0 host 255.255.255.0

R1(config)#route-map SP-MAP permit 10
R1(config-route-map)#match ip address SP-MAP-ACL

The aggregate address is 11.0.0.0/8 in this scenario. So the suppress map is bound to the following command.

R1(config)#router bgp 65001
R1(config-router)#aggregate-address 11.0.0.0 255.0.0.0 suppress-map SP-MAP

Now you can see the suppressed subnet is shown in 's'

As you can see, the suppressed subnet is not advertised to the neighbors..