--- title: Stop the Propagation of Configuration Errors « BGP Labs description: A hands-on BGP lab exercise focused on configuring ISP-side input filters to block common customer configuration errors before they propagate to the wider... canonical: https://daily.dev/posts/stop-the-propagation-of-configuration-errors-bgp-labs-hs3fseguc twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Stop the Propagation of Configuration Errors « BGP Labs | daily.dev og:description: A hands-on BGP lab exercise focused on configuring ISP-side input filters to block common customer configuration errors before they propagate to the wider... og:url: https://daily.dev/posts/stop-the-propagation-of-configuration-errors-bgp-labs-hs3fseguc og:image: https://api.daily.dev/og/posts/Hs3fsEgUc.png og:image:alt: Stop the Propagation of Configuration Errors « BGP Labs og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Stop the Propagation of Configuration Errors « BGP Labs **[ipSpace.net Blog](https://daily.dev/sources/ipspace)** · 4 min read · 0 upvotes · 0 comments ## Summary A hands-on BGP lab exercise focused on configuring ISP-side input filters to block common customer configuration errors before they propagate to the wider Internet. The exercise covers filtering RFC 1918 prefixes, overly specific or broad prefixes (more specific than /24 or less specific than /16), transit routes with multiple ASes in the path, AS paths longer than five elements, and enforcing a maximum prefix limit of five per customer. Students use a policy template applied to all EBGP customer sessions, with FRRouting shown as the reference platform. The expected result reduces a noisy BGP table of 14 routes down to just 3 valid prefixes. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What BGP prefixes should an ISP filter from customer EBGP sessions to prevent fat-finger errors from propagating? ISPs should filter RFC 1918 private address space prefixes, prefixes more specific than /24 or less specific than /16 (including the default route), prefixes with more than one autonomous system in the AS path (transit routes), and prefixes with AS paths longer than five elements. A maximum prefix limit per customer (e.g., five prefixes) should also be enforced. _Network engineers hardening ISP BGP policies track lab exercises and real-world filtering patterns on daily.dev._ ### How do I use a BGP policy template to apply the same inbound filter to multiple EBGP customer sessions in FRRouting? Create a single routing policy (route-map or prefix-list set) that encodes all customer-facing rules, then apply it as a policy template to each EBGP neighbor session. This avoids duplicating filter logic per customer and ensures consistent enforcement. FRRouting supports BGP session and policy templates that can be inherited by multiple neighbor definitions. _Engineers managing multi-customer BGP configurations find peer discussions and lab walkthroughs on daily.dev._ ## Similar posts on daily.dev - [The Never-Ending IPv6 Loopback Prefix Saga « ipSpace.net blog](https://daily.dev/posts/the-never-ending-ipv6-loopback-prefix-saga-ipspace-net-blog-4nlhgh10l) · ipSpace.net Blog · 0 upvotes · 0 comments - [Enforcing the First AS in BGP AS\_PATHs](https://daily.dev/posts/enforcing-the-first-as-in-bgp-as-paths-yx1xiadkj) · Cloudflare · 0 upvotes · 0 comments - [Running Your Own AS: BGP on FreeBSD with FRR, GRE Tunnels, and Policy Routing](https://daily.dev/posts/running-your-own-as-bgp-on-freebsd-with-frr-gre-tunnels-and-policy-routing-2autkoulu) · Lobsters · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#bgp](https://daily.dev/tags/bgp) [View this post on daily.dev](https://daily.dev/posts/stop-the-propagation-of-configuration-errors-bgp-labs-hs3fseguc) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Stop the Propagation of Configuration Errors « BGP Labs","url":"https://daily.dev/posts/stop-the-propagation-of-configuration-errors-bgp-labs-hs3fseguc","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/stop-the-propagation-of-configuration-errors-bgp-labs-hs3fseguc"},"datePublished":"2026-08-11T08:55:16.393Z","dateModified":"2026-08-11T09:19:43.646Z","description":"A hands-on BGP lab exercise focused on configuring ISP-side input filters to block common customer configuration errors before they propagate to the wider...","image":"https://media.daily.dev/image/upload/s--CxzD6vbw--/f_auto/v1722860399/public/Placeholder%2005","thumbnailUrl":"https://media.daily.dev/image/upload/s--CxzD6vbw--/f_auto/v1722860399/public/Placeholder%2005","isAccessibleForFree":true,"articleSection":"ipSpace.net Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ipSpace.net Blog","logo":"https://media.daily.dev/image/upload/s--xS7E82MT--/f_auto,q_auto/v1786438303/logos/ipspace?_a=BAMAMicg0","url":"https://daily.dev/sources/ipspace"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/stop-the-propagation-of-configuration-errors-bgp-labs-hs3fseguc","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,bgp","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ipSpace.net Blog","item":"https://daily.dev/sources/ipspace"},{"@type":"ListItem","position":3,"name":"Stop the Propagation of Configuration Errors « BGP Labs"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/stop-the-propagation-of-configuration-errors-bgp-labs-hs3fseguc#faq","mainEntity":[{"@type":"Question","name":"What BGP prefixes should an ISP filter from customer EBGP sessions to prevent fat-finger errors from propagating?","acceptedAnswer":{"@type":"Answer","text":"ISPs should filter RFC 1918 private address space prefixes, prefixes more specific than /24 or less specific than /16 (including the default route), prefixes with more than one autonomous system in the AS path (transit routes), and prefixes with AS paths longer than five elements. A maximum prefix limit per customer (e.g., five prefixes) should also be enforced. Network engineers hardening ISP BGP policies track lab exercises and real-world filtering patterns on daily.dev."}},{"@type":"Question","name":"How do I use a BGP policy template to apply the same inbound filter to multiple EBGP customer sessions in FRRouting?","acceptedAnswer":{"@type":"Answer","text":"Create a single routing policy (route-map or prefix-list set) that encodes all customer-facing rules, then apply it as a policy template to each EBGP neighbor session. This avoids duplicating filter logic per customer and ensures consistent enforcement. FRRouting supports BGP session and policy templates that can be inherited by multiple neighbor definitions. Engineers managing multi-customer BGP configurations find peer discussions and lab walkthroughs on daily.dev."}}]} ```