Connect. Secure. Manage.
BGP Route Filtering
Review and implement Cisco BGP import and export filters to restrict accepted prefixes, prevent accidental advertisements and document routing intent.
Devices supported
across the UK
Client locations
supported
Traffic handled
at peak time
Average
response time
Average response is not a resolution time or a contractual guarantee. Support scope and response commitments are agreed for each engagement.
BGP route filtering controls what your network learns and what it tells its neighbours. It is one of the most important safeguards at an internet edge or private interconnect, because an incorrect route can affect customers, partners and upstream providers. MCI Network Services reviews and implements Cisco BGP filters with explicit prefix ownership, clear policy direction and tests for both permitted and rejected advertisements.
Cisco-focused engineering
Design around the platform, traffic and failure behaviour you actually operate.
Change with evidence
Use pre-checks, acceptance criteria and a documented route back.
Operational handover
Keep the configuration, diagrams and responsibilities understandable after delivery.
Build a route-authorisation record
We begin with the networks that should legitimately cross each boundary. For every peer, we record the expected prefixes, their owner, permitted lengths and the reason they are exchanged. A private counterparty may require only a small set of application networks; an internet provider may supply a default route or a much larger table. Those are different trust relationships.
The record should distinguish authorised advertisements from routes merely present on a router. A connected network, static route or learned prefix does not automatically belong in an export policy. We ask who can approve additions and how that approval is evidenced. This is especially valuable when an inherited configuration contains broad rules whose original purpose is no longer understood.
Standards & partnerships
Confidence in the team behind your network.
Cisco Partner
Cisco Meraki
Cyber Essentials
Cyber Essentials PlusMCI Network Services is operated by Proxar Ltd. Certifications apply to the certified legal entity and the scope of its certificates. View accreditation information
Review inbound and outbound policy separately
Inbound filters protect the customer’s route selection from unexpected information. Outbound filters prevent unauthorised announcements and accidental transit between peers. We examine both directions on every relevant address family. A careful IPv4 policy does not establish equivalent protection for an IPv6 session that was added later.
We also review policy ordering and implicit rejection behaviour. A prefix-list range can permit more subnets than its label suggests, and an earlier route-map entry may prevent a later safeguard from being reached. The assessment considers the complete policy chain rather than checking whether a reassuringly named filter exists in the configuration.
A useful starting point
Not sure where to start?
Bring the requirement. We will help you define the engineering work.
Control prefix lengths and defaults deliberately
Permitting an aggregate is not always the same as permitting every more-specific prefix beneath it. We define which lengths are appropriate for the service and verify how the selected Cisco syntax expresses them. Overly broad length ranges can admit advertisements that were never intended, while an exact-match rule may reject a legitimate migration prefix.
Default routes receive their own decision. Some connections should provide one; others should never influence general outbound traffic. We identify the conditions under which a default is accepted or originated and how it disappears when the represented service fails. A default route that remains present through an upstream outage can be more disruptive than a visibly failed session.
Different environments. The same care.
Built around the work
your network supports.
Finance, banking and the wider private sector. We start with the systems and people that depend on your connections.
Finance & banking
Market-data paths, routing and provider coordination on clients’ behalf.
Financial-market services ↗Offices & multi-site teams
Reliable access between people, workplaces and business applications.
Office network design ↗Data centres & cloud
Network boundaries, workload connections and operational ownership.
Data centre networks ↗Add complementary safeguards without confusing their roles
Maximum-prefix controls can help contain an unexpected increase in received routes, but they are not a replacement for a prefix policy. We establish a sensible expected range and the intended action when a threshold is crossed. A limit set too close to normal growth can create its own outage, so ownership of threshold review matters.
RPKI origin validation can contribute evidence for public internet routes. It does not prove that a peer should advertise every valid prefix to you, nor does it replace outbound authorisation. Similarly, an AS-path filter and a prefix filter answer different questions. We combine suitable controls without suggesting that any single feature solves every route-leak scenario.
Test negative cases as well as successful routes
A filter is not proven simply because expected traffic works. We test policy evaluation against permitted prefixes, disallowed prefixes, unexpected lengths and relevant defaults. Where live advertisements cannot be used safely, offline policy review or an isolated test environment can provide evidence without affecting another network.
During deployment, we compare the expected received and advertised sets with the operational result. Remote confirmation is useful when a provider applies additional filtering. The change plan includes the supported method for refreshing routes and a rollback path. We avoid disabling all policy to make a missing route appear, because that can turn a local fault into a wider incident.
Maintain filters as the estate changes
New offices, acquisitions, cloud subnets and provider changes can all make a once-correct policy incomplete. We recommend an approval process tied to the addressing register, with a named owner for each peer. Configuration comments and change records should explain the purpose of exceptions rather than only recording who entered them.
Periodic review also identifies stale advertisements and unused permissions. Removing them should be deliberate: an apparently quiet prefix may support a recovery environment or a service used only at particular times. We check the business dependency before recommending its withdrawal and retain evidence of the final decision.
Get a focused policy review
MCI can assess a specific interconnect or review the wider Cisco BGP edge. The output is a policy inventory, prioritised findings, proposed changes and acceptance tests. Implementation and ongoing monitoring can be included where required. BGP troubleshooting is available when a filtering problem is already affecting service; the investigation still begins with the intended route policy rather than a blanket relaxation of controls.
Talk to a specialist
What does your network need next?
Tell us what you are planning, changing or trying to improve. We will help define a practical next step and the engineering scope.
+44 203 196 6566Choose option 1
sales@proxar.co.ukUK-wide service.
Most of our engineers are based in Kent, with a focus on London, Sussex, Essex and Berkshire.
Existing customers should use their agreed support and escalation channels. This form is for service enquiries, not a monitored emergency ticket.
Tell us what you need.
A short outline is enough. Please do not include passwords or sensitive network details.
Thank you. Your enquiry has been submitted.
Please check your name, email and message, then try again.
Your form session expired. Please try again.
Please wait a minute before sending another enquiry.
We could not submit your enquiry. Please call or email us instead.