Attach a routing policy

Association with protocol context

Policies become effective only after they are attached to a routing protocol entity, such as a neighbor, address family, or redistribution point. The attach point defines the association between the protocol context and the named policy, enabling the protocol to apply the policy to relevant routes, for example during route import or export processing.

Protocol attributes and attachment validation

Each routing protocol defines a specific set of route attributes that can be matched or modified by policy. During attachment, the system verifies that the policy operates only on attributes that are valid for the selected protocol context. The protocol configuration rejects attempts to attach policies that perform unsupported operations.

For example, a policy that matches BGP community attributes cannot be attached to OSPF, and a policy that sets IS-IS–specific attributes cannot be applied to BGP routes. Similarly, when a policy that is already in use is modified, the system verifies that the changes remain compatible with all existing attachment points.

Attach points operating on RIB routes

Some attach points operate on routes in the Routing Information Base (RIB) rather than native protocol routes. In these cases, the policy may match attributes from the RIB representation and set attributes relevant to the target protocol, depending on the direction of processing.

Redistribution and mixed attribute operations

Some policy attach points are used during route redistribution, where routes move between protocols through the common RIB representation. These scenarios can involve matching attributes from the source representation and setting attributes for the destination protocol. As a result, policies applied at redistribution points may combine operations across attribute domains, depending on the processing stage and protocol context.

BGP policy attach points by function

Use these BGP policy attach points to control how BGP selects, advertises, imports, and manages routes:

• Path selection and advertisement

  • additional-path

  • default originate

  • neighbor export

  • neighbor import

• Route injection

  • network

  • redistribute

• Display, accounting, and operations

  • show bgp

  • table policy

  • clear-policy

  • debug

• VPN route movement and retention

  • import

  • export

  • retain route-target

• Label and ORF controls

  • allocate-label

  • label-mode

  • neighbor-orf

• Next-hop event control: next-hop

• Stability control: dampening

additional-path

The additional-path attach point controls whether BGP selects additional paths so a BGP speaker can send multiple paths for the same prefix.

Example:

router bgp 100
  address-family ipv4 unicast
    additional-paths selection route-policy add-path-policy

This table summarizes the BGP attributes and operators available for the additional-path attach point.

dampening

The dampening attach point controls BGP route-dampening behavior by using a policy to set dampening attributes for routes.

Policy behavior:

• The last set dampening statement encountered takes effect.

• If the policy executes drop , the route does not contribute to dampening.

• If the policy executes pass or done without set dampening , the default dampening parameters apply.

• If an applied policy executes pass , execution returns to the calling policy.

• If an applied policy executes done , policy execution stops and accepts the route.

Example:

route-policy sample_damp
  if destination in (0.0.0.0/0 ge 25) then
    set dampening halflife 30 others default
  else
    set dampening halflife 20 others default
  endif
end-policy
router bgp 2
  address-family ipv4 unicast
    bgp dampening route-policy sample_damp
...

This table summarizes the BGP attributes and operators available for the dampening attach point.

default originate

The default originate attach point conditionally generates and advertises the default route 0.0.0.0/0 to a peer based on whether routes in the RIB pass the attached policy.

Example:

route-policy sample-originate
  if rib-has-route in (10.0.0.0/8 ge 8 le 32) then
    pass
  endif
end-policy

router bgp 2
  neighbor 10.0.0.1
    remote-as 3
    address-family ipv4 unicast
      default-originate policy sample-originate
...

This table summarizes the BGP attributes and operators available for the default originate attach point.

neighbor export

The neighbor export attach point selects which BGP routes BGP sends to a peer or peer group by running candidate routes through the attached policy. Routes that pass are sent, and the policy can modify route attributes before BGP sends the update.

Example:

route-policy sample-export
  if community matches-any (2:[100-200]) then
    set med 100
    set community (2:666)
  else
    set med 200
    set community (2:200)
  endif
end-policy

router bgp 2
  neighbor 10.0.0.5
    remote-as 3
  address-family ipv4 unicast
    route-policy sample-export out
...

This table summarizes the BGP attributes and operators available for the neighbor export attach point.

neighbor import

The neighbor import attach point controls which routes BGP accepts from a peer by running received routes through the attached policy. Routes that pass become candidates in the BGP RIB.

When you change an import policy, BGP must re-evaluate routes from that peer against the new policy. The bgp auto-policy-soft-reset option can automate this when soft reconfiguration is enabled or route refresh is negotiated.

Example:

route-policy sample_import
  if community matches-any (3:100) then
    set local-preference 100
    set community (2:666)
  else
    set local-preference 200
    set community (2:200)
  endif
end-policy

router bgp 2
  neighbor 10.0.0.1
    remote-as 3
    address-family ipv4 unicast
      route-policy sample_import in

This table summarizes the BGP attributes and operators available for the neighbor import attach point.

network

The network attach point controls how BGP injects routes from the RIB into BGP. A policy at this attach point can set valid BGP attributes on injected routes.

Example:

route-policy NetworkControl
  if destination in (0.0.0.0/0 ge 25) then
    set community (no-export) additive
  endif
end-policy

router bgp 2
  address-family ipv4 unicast
    network 172.16.0.5/27 route-policy NetworkControl

This table summarizes the BGP attributes and operators available for the network attach point.

redistribute

The redistribute attach point injects routes from other routing protocols into OSPF by selecting routes and setting OSPF parameters such as cost and metric type.

Example:

route-policy OSPF-redist
  set metric-type type-2
  if tag eq 10 then
    set ospf cost 100
  elseif tag eq 20 then
    set ospf cost 200
  else
    drop
  endif
end-policy


router ospf 1
  redistribute isis instance_10 policy OSPF-redist

This table summarizes the BGP attributes and operators available for the redistribute attach point.

show bgp

The show bgp attach point displays BGP routes that are not dropped by the attached policy.

Example:

route-policy sample-display
  if med eq 5 then
    pass
  endif
end-policy

show bgp route-policy sample-display

This table summarizes the BGP attributes and operators available for the show bgp attach point.

table policy

The table policy attach point sets traffic-index values on routes as the system installs routes into the global routing table. This supports BGP policy accounting by classifying routes and tracking traffic counters per class.

Example:

route-policy sample-table
  if as-path originates-from '10.33' then
    set traffic-index 10
  elseif as-path originates-from '11.60' then
    set traffic-index 11
  endif
end-policy

router bgp 2
  address-family ipv4 unicast
    table-policy sample-table

import

The import attach point controls import of routes from the global VPN IPv4 table into a VRF.

Example:

route-policy bgpvrf_import
  if extcommunity rt matches-any (10:91) then
    set next-hop 172.16.0.1
  elseif extcommunity rt matches-every (11:92) then
    set next-hop 172.16.0.2
  elseif extcommunity soo matches-any (10:111111, 10:111222) then
    pass
  endif
end-policy

vrf vrf_import
  address-family ipv4 unicast
    import route-policy bgpvrf_import

export

The export attach point controls export of routes from a VRF to the global VPN IPv4 table, including conditional route-target handling.

Example:

route-policy bgpvrf_export
  if destination in (172.16.1.0/24) then
    set extcommunity rt (10:101)
    set weight 211
  elseif origin is egp then
    set local-preference 212
    set extcommunity rt (10:101)
  endif
  set extcommunity rt (10:111222) additive
end-policy

vrf vrf-export
  address-family ipv4 unicast
    export route-policy bgpvrf-export

retain route-target

The retain route-target attach point retains VPN routes based only on route target extended communities. This can reduce the route scale at a route reflector or support IPv4 VPN route retention at an autonomous system boundary router (ASBR).

Example:

extcommunity-set rt rtset1
  0:615,
  10:6150,
  192.0.2.15:15
end-set


route-policy retainer
  if extcommunity rt matches-any rtset1 then
    pass
  endif
end-policy


router bgp 2
  address-family vpnv4 unicast
    retain route-target route-policy retainer

This table summarizes the BGP attributes and operators available for the retain route-target attach point.

allocate-label

The allocate-label attach point decides whether BGP allocates a label when it sends updates for the IPv4 labeled-unicast address family. This attach point typically uses AS path match criteria and supports pass and drop.

This table summarizes the BGP attributes and operators available for the allocate-label attach point.

label-mode

The label-mode attach point selects a label mode based on match criteria such as prefix or community. This attach point is commonly used to choose per-CE, per-VRF, or per-prefix label modes and supports pass and drop.

neighbor-orf

The neighbor-orf attach point filters inbound BGP route updates by using prefix-based matching and sends the same prefix filters to upstream neighbors as outbound route filter (ORF) entries.

Example:

prefix-set orf-preset
  172.16.1.0/24,
  172.16.5.0/24,
  172.16.11.0/24
end-set

route-policy policy-orf
  if orf prefix in orf-preset then
    drop
  endif
  if orf prefix in (172.16.3.0/24, 172.16.7.0/24, 172.16.13.0/24) then
    pass
  endif

router bgp 2
  neighbor 1.1.1.1
    remote-as 3
    address-family ipv4 unicast
      orf route-policy policy-orf

This table summarizes the BGP attributes and operators available for the neighbor-orf attach point.

next-hop

The next-hop attach point controls which RIB next-hop up or down notifications BGP processes by matching prefixes and protocols. This attach point is commonly used with next-hop tracking to monitor non-BGP routes.

Example:

route-policy nxthp_policy_A
  if destination in (10.0.0.0/8) and protocol in (static, connected) then
    pass
  endif
end-policy


router bgp 2
  address-family ipv4 unicast
    nexthop route-policy nxthp_policy_A

This table summarizes the BGP attributes and operators available for the next-hop attach point.

clear-policy

The clear-policy attach point controls whether clear bgp operations clear flap statistics based on AS path match criteria.

Example:

as-path-set my-as-set
  ios-regex '_12$',
  ios-regex '_13$'
end-set

route-policy policy_a
  if as-path in my-as-set then
    pass
  else
    drop
  endif
end-policy

clear bgp ipv4 unicast flap-statistics route-policy policy_a

This table summarizes the BGP attributes and operators available for the clear-policy attach point.

debug

The debug attach point filters BGP debug output by matching route prefixes.

Example:

route-policy policy_b
  if destination in (10.0.0.0/8) then
    pass
  else
    drop
  endif
end-policy

debug bgp update policy_b

This table summarizes the BGP attributes and operators available for the debug attach point.

OSPF supports routing policy attachment at multiple points in the protocol workflow, where policies can influence route origination, redistribution, inter-area processing, and shortest path first (SPF) behavior:

• area-in

• area-out

• default-information originate

• distribute-list in

• redistribute

• spf-prefix-priority

area-in

The area-in attach point filters inbound OSPF type-3 summary LSAs by using prefix-based matching.

In this example, the policy drops summary LSAs that match specific 10.105.x.x/24 prefixes and passes summary LSAs that match specific 10.106.x.x/24 prefixes.

Example:

route-policy OSPF-area-in
  if destination in (10.105.3.0/24, 10.105.7.0/24, 10.105.13.0/24) then
    drop
  endif
  if destination in (10.106.3.0/24, 10.106.7.0/24, 10.106.13.0/24) then
    pass
  endif
end-policy


router ospf 1
  area 1
    route-policy OSPF-area-in in

area-out

The area-out attach point filters outbound OSPF type-3 summary LSAs by using prefix-based matching.

In this example, the policy drops summary LSAs that match specific prefixes and passes summary LSAs that match specific prefixes so OSPF can announce them.

Example:

route-policy OSPF-area-out
  if destination in (10.105.3.0/24, 10.105.7.0/24, 10.105.13.0/24) then
    drop
  endif
  if destination in (10.105.3.0/24, 10.105.7.0/24, 10.105.13.0/24) then
    pass
  endif
end-policy


router ospf 1
  area 1
    route-policy OSPF-area-out out

default-information originate

The default-information originate attach point conditionally injects the default route 0.0.0.0/0 into the OSPF link-state database by evaluating the attached policy against routes in the local RIB. If any routes pass the policy, the system inserts the default route into the link-state database.

Example:

route-policy ospf-originate
  if rib-has-route in (10.0.0.0/8 ge 8 le 25) then
    pass
  endif
end-policy


router ospf 1
  default-information originate policy ospf-originate

distribute-list in

The distribute-list in attach point filters OSPF prefixes by using a route policy. You can configure distribute-list in route-policy at the OSPF instance, area, and interface levels.

Route policies at this attach point support:

• destination

• rib-metric

Route policies at this attach point do not support set commands.

Example 1:

route-policy DEST
  if destination in (10.10.10.10/32) then
    drop
  else
    pass
  endif
end-policy

Example 2:

route-policy METRIC
  if rib-metric ge 10 and rib-metric le 19 then
    drop
  else
    pass
  endif
end-policy

Example 3:

prefix-set R-PFX
  10.10.10.30
end-set
route-policy R-SET
  if destination in R-PFX and rib-metric le 20 then
    pass
  else
    drop
  endif
end-policy

redistribute

The redistribute attach point injects routes from other routing protocols into the OSPF link-state database. The policy selects which routes to inject and sets OSPF attributes such as metric type and cost by using set metric-type and set ospf cost .

In this example, the policy sets metric type type-2 for all redistributed routes, sets the OSPF cost based on the IS-IS route tag, and drops routes that do not match tag 10 or 20.

Example:

route-policy OSPF-redist
  set metric-type type-2
  if tag eq 10 then
    set ospf cost 100
  elseif tag eq 20 then
    set ospf cost 200
  else
    drop
  endif
end-policy


router ospf 1
  redistribute isis instance_10 policy OSPF-redist

OSPF supports routing policy attachment at multiple points in the protocol workflow, where policies can influence route origination and redistribution.

• default-information originate

• redistribute

default-information originate

The default-information originate attach point conditionally injects the default route 0.0.0.0/0 into the OSPFv3 link-state database by evaluating the attached policy against routes in the local RIB. If any routes pass the policy, the system inserts the default route into the link-state database.

redistribute

The redistribute attach point injects routes from other routing protocols into the OSPFv3 link-state database. The attached policy selects which routes to inject and sets OSPFv3 attributes such as metric type and cost by using set metric-type and set ospf cost statements.

In this example, the policy sets metric type type-2 for all redistributed routes, sets the cost based on the route tag, and drops routes with tags other than 10 or 20.

Example:

route-policy OSPFv3-redist
  set metric-type type-2
  if tag eq 10 then
    set extcommunity cost 100
  elseif tag eq 20 then
    set extcommunity cost 200
  else
    drop
  endif
end-policy


router ospfv3 1
  redistribute bgp 15 policy OSPFv3-redist

IS-IS supports routing policy attachment at specific points that control route origination and the propagation of routes between levels:

• default-information originate

• inter-area-propagate

default-information originate

The default-information originate attach point conditionally injects the default route 0.0.0.0/0 into the IS-IS route database.

In this example, the policy injects an IPv4 unicast default route when the local RIB contains any route that matches 10.0.0.0/8 ge 8 le 25 . The policy sets the default route metric to 100 and the level to level-1-2 .

Example:

route-policy isis-originate
  if rib-has-route in (10.0.0.0/8 ge 8 le 25) then
    set metric 100
    set level level-1-2
  endif
end-policy


router isis instance_10
  address-family ipv4 unicast
    default-information originate policy isis-originate

inter-area-propagate

The inter-area-propagate attach point conditionally propagates prefixes between IS-IS levels within the same IS-IS instance.

In this example, the policy allows prefixes to propagate from level 1 to level 2 when the destination matches 10.0.0.0/8 ge 8 le 25 .

Example:

route-policy isis-propagate
  if destination in (10.0.0.0/8 ge 8 le 25) then
    pass
  endif
end-policy


router isis instance_10
  address-family ipv4 unicast
    propagate level 1 into level 2 policy isis-propagate