{{ summary.heading }} {{ summary.primary }} {{ summary.line }}

Prefixes {{ policyRailAction }} {{ policyRailTarget }} Config
Use one IPv4 or IPv6 CIDR policy row per line.
{{ sourceLineCount }} rows
{{ sourceStatus }}
{{ fileError }}
Choose the command family used by the target routing policy.
Use the exact deployment identifier you want reviewers to recognize.
An action written in a source row overrides this default.
Leave this neutral unless the change plan requires an explicit catch-all outcome.
A start of 10 leaves room for reviewed insertions.
A step of 10 is the neutral sample default.
Recheck shadowing whenever you select a sorted output order.
{{ result.configText }}
SeqActionPrefixLength rangeMatchStatementStatusCopy
{{ row.sequence }}{{ row.action }}{{ row.prefix }}{{ row.lengthRange }}{{ row.matchType }}{{ row.statement }}{{ row.status }}{{ row.statusDetail }}
CheckStateEvidenceOperator actionCopy
{{ row.check }}{{ row.state }}{{ row.evidence }}{{ row.action }}
Actions by address family {{ row.family }} Permit Deny
IP Overlap Checker Check IPv4 CIDRs and ranges for exact duplicates, containment, partial overlap, host-bit corrections, and duplicate address coverage.
Route Table Longest Match Checker Find the IPv4 or IPv6 route that wins for a destination using longest-prefix lookup, selectable tie-break rules, and CIDR cleanup warnings.
Static Route Commands Generator Generate reviewed static-route commands across host and network CLIs with CIDR normalization plus priority checks and rollback-ready delete output.
EDNS Client Subnet (ECS) Tester Compare DNS answers with and without an EDNS Client Subnet hint, then inspect answer steering, echoed scope, TTL drift, and privacy clues.

A routing policy can be syntactically valid and still admit the wrong routes. Border Gateway Protocol (BGP) prefix lists express which network blocks and prefix lengths may match, but their meaning depends on address containment, length bounds, rule order, and the policy that consumes the list.

Classless Inter-Domain Routing (CIDR) writes a network as an address followed by a prefix length. In 198.51.100.0/23, the first 23 bits identify the network. A larger length is more specific: a covered /24 names half of that /23, while an IPv4 /32 or IPv6 /128 identifies one address.

Base prefix
The network within which a candidate route must fall.
Exact
The candidate must have the same network and prefix length as the rule.
Length range
The candidate must sit inside the base and have a length between the lower and upper bounds, inclusive.

This distinction is central to route hygiene. An operator may permit a customer's aggregate but reject unexpected deaggregation, accept selected more-specific routes during a migration, or prevent private and documentation ranges from escaping. The address block and length test must describe the intended set together.

Order adds another constraint. On platforms that evaluate prefix-list entries sequentially, an earlier broad match can make a later exception unreachable. Sorting a list for readability can therefore change policy behavior. Explicit terminal rules also deserve review because an appended permit-all or deny-all may not match the surrounding route-policy default.

Vendor syntax differs even when the policy set is the same. Cisco-style platforms use sequence numbers with ge and le; Junos route-filter-list entries use match types such as exact, longer, orlonger, upto, and prefix-length-range. Generated text is a change candidate, not a substitute for checking the target software release, address-family attachment, and complete policy chain.

How to Use This Tool:

Define the route set before choosing presentation order or terminal behavior.

  1. Enter one rule per line in Prefix rows. Use a CIDR alone for an exact match, add ge/le or a named match form, or provide comma-separated minimum length, maximum length, action, and note.
  2. Choose Platform syntax and enter the List name expected by the target configuration. The platform choice changes both commands and match wording.
  3. Set the Default row action for lines that do not name permit or deny. Explicit row actions still take precedence.
  4. Keep Output order at input order when sequence is already part of the reviewed policy. Use another order only when you intend to reevaluate overlaps and exceptions.
  5. Set Start sequence, Sequence step, and any Terminal rule. Terminal rows are appended separately for each address family found in the source.
  6. Resolve every warning in Policy review, then compare Prefix ledger with the change request before copying the configuration.

Interpreting Results:

Read the normalized prefix, length range, action, and statement as one policy row. A ready label only means the row passed the local syntax and ordering checks. It does not confirm that the list is attached to the intended neighbor, route map, policy term, or address family.

  • Normalized means host bits were cleared to the network base. Compare the changed prefix with the intended allocation.
  • Duplicate means the same family, normalized prefix, length range, and action already appeared.
  • Shadowed means an earlier Cisco-style rule covers the later row's complete match range. Move the exception earlier or narrow the broader rule.
  • A mixed IPv4 and IPv6 warning asks for an operational decision; some teams keep separate policy objects even when the generated syntax supports both.

Technical Details:

Prefix matching has two tests. The candidate network must be contained by the rule's base prefix, and the candidate prefix length must fall within the rule's inclusive minimum and maximum. An exact row sets both bounds to the base length.

Rule Core:

Requested match Length bounds Cisco-style form Junos form
Exact base base to base No ge or le exact
Base and all more-specifics base to 32 or 128 le family maximum orlonger
More-specifics only base + 1 to family maximum ge base + 1 longer
Bounded range chosen minimum to maximum ge minimum and le maximum prefix-length-range, or upto when the minimum equals the base

Bounds cannot be shorter than the base, the maximum cannot be below the minimum, and neither bound may exceed 32 for IPv4 or 128 for IPv6. CIDR input with host bits is masked to its network base. For example, 198.51.100.7/24 normalizes to 198.51.100.0/24.

Transformation Core:

  1. Ignore blank lines and comment lines, then parse IPv4 or IPv6 CIDR and any action or length tokens.
  2. Normalize the address, fill missing bounds, and reject invalid family limits.
  3. Apply the selected order and append one catch-all per detected family when requested.
  4. Assign sequence numbers for Cisco-style output or ordered entries for Junos.
  5. Mark duplicate rows and, for non-Junos profiles, rows completely covered by an earlier rule.

The list name is made configuration-safe by replacing unsupported characters and collapsing repeated underscores. Sequence starts range from 1 to 4,294,967,294; steps range from 1 to 1,000,000. Source text is limited to 512 KiB.

Operational Limits:

No live router parses or installs the generated configuration. Shadow checks model ordered coverage for Cisco-style profiles and do not attempt to evaluate a complete route map, Junos policy statement, platform defaults, or interactions with neighboring policy objects. Validate in the target platform's configuration checker and use a rollback plan.

Worked Examples:

Aggregate plus covered routes

The row 198.51.100.0/23,23,24,permit accepts the aggregate and its two covered /24 routes. For Cisco IOS with list name PEER-IN at sequence 10, it becomes ip prefix-list PEER-IN seq 10 permit 198.51.100.0/23 le 24. A later deny for one of those /24 routes will be flagged as shadowed unless it is placed first.

References: