difference between Access-list, Prefix-list,Distribute-list, Offset-list, Route-map

Basic Differences between access-list, prefix-list, distribute-list, offfset-list, route-map

Access-list is used to filter the traffic when applied on interface. It can also be used for route filtering but it can not be applied directly into any routing protocol. It is used to "match the routes" which are going to advertised or blocked and then that access-list has to be called into any distribute-list/route-map etc.(see detailed explanation below )

Prefix-list is mainly used to filter the Routes...Not user traffic. Hence used in routing protocols only.The main difference in access-list and prefix-list is that access-list only matches the bits specified by wildcard mask but prefix-list can also match sub-net mask and we can specify a range of subnet masks which need to be matched to be permitted or denied.

Distribute-list is mainly used for route filtering. Means to permit or block routes from being advertised but it does not care what is the metric being advertised with those routes.(So, if we want to modify the metric being advertised, then we can use Offset-list. )
Distribute-list is not a standalone list..means it itself doesn't block or permit any route but it will call a access-list or prefix-list and action will be taken based on whatever specified in that access-list or prefix-list.So a distribute-list is used to control incoming or outgoing traffic

Offset-list can modify the metric which is being advertised (incoming or outgoing), for all routes or selected routes. If you want to modify metric for specific routes, then select those routes throgh access-list and call that access-list into offset-list. Offset-list doesnt care if that route is being advertised or not, it is just to modify the metric (for selected routes or all routes.)
Offset-list command is used for distance vector routing protocols mainly, it doesnt work with ospf.

Detailed discussion with example:

(1)Access-list and Distribute-list
For example, if you want to block the traffic from PC1 to PC2, you can do it using Access-list only as it can be directly applied on interface.

PC1 IP: 10.1.1.1, PC2 IP 20.1.1.1. You want to block all traffic from pc1 to pc2.you can create 
access-list 10 deny 10.1.1.1 0.0.0.0
access-list 10 permit any

Now this access-list can be applied on incoming interface on R1 or outgoing interface on R4( or any of the outgoing interface in the path which is selected by routing, thats a different discussion, where should be applied)

interface Fastethernet 1/1
ip access-group 10 in

But what if you want to filter the routes from being exchanged between any 2 routers. Means, PC1 belong to 10.1.1.0/24 network. All routers are running EIGRP. You want 10.1.1.0/24 should not be advertised to R2 but it should be advertised to R3. So, now are you are not blocking the traffic from PC1 to PC2, you just want that traffic should go via R3, not R2 and for that you want PC1 subnet not to be advertised to R2. This is not directly possible with JUST Access-list. Means, you can not apply the same access-list to an interface becoz it will block the traffic not routes. So, it has to be applied in a routing protocol but there is no option to directly apply it. So, it has to be called in a Distribute-list or Route-map (Route-map is used mainly during BGP route filtering or while doing redistribution). For normal route filtering in EIGRP, distribute-list is used.

create similar access-list you created above:
access-list 10 deny 10.1.1.0 0.0.0.255
access-list 10 permit any

Now, call it in a distribute-list or route-map

router eigrp 1
network 10.1.1.0 0.0.0.255
network 10.1.2.0 0.0.0.255
network 10.1.3.0 0.0.0.255
distribute-list 10 out Serial 0/0


(10 is the number of access-list which it has to go through before sending routing update )
S0 now whenever EIGRP is announcing routing update, it will check against distribute-list which will point to a access-list to find what routes to be permitted or denied (just route, not traffic because not applied on interface)

(you can specify incoming/outgoing direction as well as interface. Don't specify interface if you want to block/permit route for all neighbors)

So, as we saw above, access-list can be used to filter traffic. It can also be used to filter routes but not directly, it has to be called into a distribute-list or Route-map).

Distribute can call a access-list or a prefix-list.
For example:
distribute-list prefix 10 out Serial 0/0
or
distribute-list prefix xyz out Serial 0/0

You need to use keyword prefix and then specify the number or name of the prefix-list.

2. Offset-list:

In the above example, as R1 is receiving routes both from R2 and R3 and you want one if the route to be preferred over another, so you can increase the metric on one of routes which are being advertised from R2 or R3.
Lets say you want to increase the metric on all the routes which are being received on S0/1 through R2.

R1(config)#router eigrp 1
R1(config-router)#offset-list 0 in 100000 serial 0/1

In the above configuration 0 is the number given to offset-list. If you specify number 0, that means it is going to modify the metric for all incoming routes.
As we did in above example of distribute-list, we can select specific routes and modify the metric for those electred route also. If you want to do the same for any selected route, then identify those route using a access-list and call that access-list in offset-list command with the access-list number. So, in the above example, after offset-list keyword, use the acutal access-list number or if there is no selection, then mention "0" for all routes.


access-list 10 deny 20.1.1.0 0.0.0.255
access-list 10 permit any

R1(config)#router eigrp 1
R1(config-router)#offset-list 10 in 100000 serial 0/1

So, offset-list 0 = all routes.
       offset-list (number or name) = means for specic route which are specified in the access-list number or named access-list.

Important to note that, Off-set list is not blocking or permitting the route, it is just modifiying the metric. Whatever metric we specify in offset-list command, it will get added to original metric.

Designing Active/backup Failover in EIGRP

In Real life Networking, you often come across a requirement that you have multiple links for same destination and you have to design Active/Backup or you can say Failover design. Below is the example how to achive the same if you are using EIGRP:

In EIGRP you have multiple ways to design the same, consider below example:

In the diagram above, if i do a "sh ip route" on R1, you can notice that there 2 equal cost path exists to destination 2.2.2.2 which is a loopback IP on R2
=================================================================
R1#sh ip route

Gateway of last resort is not set

     2.0.0.0/32 is subnetted, 1 subnets
D       2.2.2.2 [90/2297856] via 10.1.2.2, 00:03:54, Serial0/1              
                      [90/2297856] via 10.1.1.2, 00:03:54, Serial0/0

"at this point there are two path ,via S0/1 and S0/0, in routing table"
=================================================================
Now if you want one of them to be preferred over another and in case of primary link failure, the failover link should be used for traffic, then you may increase decrease the delay on less preferred route:

You can first check the value of delay
================================================
R1#sh int s0/1
Serial0/1 is up, line protocol is up
  Hardware is M4T
  Internet address is 10.1.2.1/30
  MTU 1500 bytes, BW 1544 Kbit, DLY 20000 usec
=================================================
Now increase the delay on S0/1 and you will notice it will disappear from routing table:
R1(config)#int s0/1
R1(config-if)#delay
R1(config-if)#delay 4000

Now, you can see only one path (s0/0)exists in routing table. The another path through interface  s0/1 has been disappeard

2) 2nd way of implementing this through modifying bandwidth. As eigrp prefers high BW links in its metric calculation, i will increase the BW on S0/1 interface. 

R1(config)#int s0/1

R1(config-if)#bandwidth 3000

but if you check the topology table, both the path exists there but now one of them is backup or fesible succesor and will be used in case of primary link is down.

If you have QOS applied in your network, then the preferred way is Delay instead of Bandwidth to avoid any issues with your QOS policies.


3) Another way is to increase the AD (Administrative Distance) for the routes from less preferred or backup link.

IMPORTANT: If it is designed incorrectly, it may create loop. It is less recommended but its just an option available
If you want the neighborship with 10.1.2.2 less preferred, then you can increae the AD value for all route received from that neighbor.  (default is 90, so set anything above it but less than if any other routing protocol is also in use).

R1(config)#router eigrp 1
R1(config-router)#distance 95 10.1.2.2 0.0.0.0  (specify AD that wish to set, then neighbor IP)

If you want to increase AD selectively for some routes, then you may identify routes using access list and call that access-list in Distance command after the neighbor IP:
create access-list 10 and identify routes
Router(config)# access-list 10 permit 50.1.1.0 0.0.0.255
Router(config)# access-list 10 permit 60.1.2.0 0.0.0.255
Router(config)# access-list 10 permit 192.168.1.0 0.0.0.255

go in router eigrp configuration mode and call the access list after neighbor IP in distance command:
Router(config)# router eigrp 1
Router(config-router)# distance 95 10.1.2.2 0.0.0.0 10   (specifity AD, then neighbor(with wild card mask) and then call the access-list number)

4) Another way to making one link preferable over other is to use offset-list.
Offset-list is basicaly used to increase the overall metric.

Below output shows that Metric is same for both the links in default case:

Now, we can use offset-list to modify the metric Incoming or Outing depending on your the scenario and choose the best place. In this example, I will modify the metric for incoming routes from S0/1 interface.
R1(config)#router eigrp 1
R1(config-router)#offset-list 0 in 100000 serial 0/1

In the above configuration 0 is the number given to offset-list. If you specify number 0, that means it is going to modify the metric for all incoming routes. If you want to do the same for any selected route, then identify those route using a access-list and call that access-list in offset-list command with the access-list number. So, in the above example, after offset-list keyword, use the acutal access-list number or if there is no selection, then mention "0" for all routes. Important to note that, Off-set list is not blocking or permitting the route, it is just modifiying the metric. Whatever metric we specify in offset-list command, it will get added to original metric.