cisco-nxos.config

! This configuration uses vlan-maps to block the BGP traffic for the IXPs
! Assumption: IX peering vlan 10
!

! ACL IPV4: Basic ACL to match BGP, note it _must_ be a permit based.
ip access-list ACL-BLOCK-BGP
  10 permit tcp A.B.C.0/YY eq bgp A.B.C.0/YY
  20 permit tcp A.B.C.0/YY A.B.C.0/YY eq bgp
!
ip access-list ACL-PERMIT-ALL
  10 permit ip any any
!
 
 
! ACL IPV6: Basic ACL to match BGP, note it _must_ be a permit based.
ipv6 access-list ACL-BLOCK-BGP6
  10 permit tcp XX::XX/YY eq bgp XX:XX/YY
  20 permit tcp XX:XX/YY XX:XX/YY eq bgp
!
ipv6 access-list ACL-PERMIT-ALL6
  10 permit ipv6 any any
!

! VLAN access-map is almost like a route-map for VLANs, matching on the ACL and drop.
vlan access-map VAM-BGP 10
  match ip address ACL-BLOCK-BGP
  match ipv6 address ACL-BLOCK-BGP6
  action drop
  statistics per-entry
! Forward everything else that does not match the ACL located in VAM seq 10.
vlan access-map VAM-BGP 20
  match ip address ACL-PERMIT-ALL
  match ipv6 address ACL-PERMIT-ALL6
  action forward
!
 
! Now trigger the filter.
vlan filter VAM-BGP vlan-list 10