How do prefix-lists work?

Prefix-lists are used to match on prefix and prefix-length pairs. Normal prefix-list syntax is as follows:

<pre>

ip prefix-list LIST permit w.x.y.z/len

</pre>

Where w.x.y.z is your exact prefix And where len is your exact prefix-length

"ip prefix-list LIST permit 1.2.3.0/24" would be an exact match for the prefix 1.2.3.0 with a subnet mask of 255.255.255.0. This does not match 1.2.0.0/24, nor does it match 1.2.3.4/32, nor anything in between.

When you add the keywords "GE" and "LE" to the prefix-list, the "len" value changes its meaning. When using GE and LE, the len value specifies how many bits of the prefix you are checking, starting with the most significant bit.

<pre>

ip prefix-list LIST permit 1.2.3.0/24 le 32

</pre>

This means: Check the first 24 bits of the prefix 1.2.3.0 The subnet mask must be less than or equal to 32

This equates to the access-list syntax:

<pre>access-list 1 permit 1.2.3.0 0.0.0.255</pre>

<pre>ip prefix-list LIST permit 0.0.0.0/0 le 32</pre>

This means: Check the first 0 bits of the prefix 0.0.0.0 The subnet mask must be less than or equal to 32 This equates to anything

<pre>ip prefix-list LIST permit 0.0.0.0/0</pre>

This means: The exact prefix 0.0.0.0, with the exact prefix-length 0. This is matching a default route.

<pre>ip prefix-list LIST permit 10.0.0.0/8 ge 21 le 29</pre>

This means: Check the first 8 bits of the prefix 10.0.0.0 The subnet mask must be greater than or equal to 21, and less than or equal to 29.

<pre>ip prefix-list CLASS_A permit 0.0.0.0/1 ge 8 le 8</pre>

This matches all class A addresses with classful masks. It means: Check the first bit of the prefix, it must be a 0. The subnet mask must be greater than or equal to 8, and less than or equal to 8. ( It is exactly 8 )

When using the GE and LE values, you must satisfy the condition:

Len < GE <= LE

Therefore "ip prefix-list LIST permit 1.2.3.0/24 ge 8" is not a valid list.

What you can not do with the prefix-list is match on arbitrary bits like you can in an access-list. Prefix-lists cannot be used to check if a number is even or odd, nor check if a number is divisible by 15, etc... Bit checking in a prefix-list is sequential, starting with the most significant (leftmost) bit.