![This image has an empty alt attribute; its file name is image-39.png](https://vmme.org/wp-content/uploads/2024/11/nsx-t-filter-route-re-destribution-of-transit-subnets-to-upstream-router.png)
One of the customer requirements I have been asked to do a couple of days ago is to filter the transit subnets from being re-distributed from the NSX-T domain to the upstream physical router.
When you attach a tier-1 logical router to a tier-0 logical router, a router-link switch between the two routers is created. This switch is labeled as system-generated in the topology. The default address space assigned for these tier-0-to-tier-1 connections is 100.64.0.0/16. Each tier-0-to-tier-1 peer connection is provided a /31 subnet within the 100.64.0.0/16 address space.
In addition, when you have active-active Tier-0 SR with Inter-SR Routing enabled on the BGP Process of the T0 Gateway, both the SR Components establish an internal SR link between each other over an NSX managed subnet 169.254.0.128/25.
Such subnets are directly connected to the Tier-0 gateway and would be redistributed to the physical upstream router if you enable route redistribution for connected subnets.
Filtering such subnets would be beneficial especially when you have multi-tenancy with multiple Tier-1 gateways connected to Tier-0 gateway.
![](https://vmme.org/wp-content/uploads/2024/11/nsx-t-filter-route-re-destribution-of-transit-subnets-to-upstream-router-1.png)
To filter such subnets, you can use IP Prefix lists which can be referenced in the Out/in filters in the BGP neighborship configuration.
Let’s create an IP Prefix list to deny these subnets and permit all others. Edit the created Tier-0 gateway and expand Routing section.
![](https://vmme.org/wp-content/uploads/2024/11/nsx-t-filter-route-re-destribution-of-transit-subnets-to-upstream-router-2.png)
Click on the number beside IP Prefix Lists. Click on Add IP Prefix List to add a new list.
![](https://vmme.org/wp-content/uploads/2024/11/nsx-t-filter-route-re-destribution-of-transit-subnets-to-upstream-router-3.png)
Choose a name for the prefix list and click on Set to add the subnets/action combinations.
![](https://vmme.org/wp-content/uploads/2024/11/nsx-t-filter-route-re-destribution-of-transit-subnets-to-upstream-router-4.png)
Add the subnets to deny but don’t forget to add a permit any at the end to allow other subnets as the default action is deny.
![](https://vmme.org/wp-content/uploads/2024/11/nsx-t-filter-route-re-destribution-of-transit-subnets-to-upstream-router-5.png)
Click Apply and save your configuration.
![](https://vmme.org/wp-content/uploads/2024/11/nsx-t-filter-route-re-destribution-of-transit-subnets-to-upstream-router-6.png)
Expand BGP section and click the number beside BGP neighbors.
![](https://vmme.org/wp-content/uploads/2024/11/nsx-t-filter-route-re-destribution-of-transit-subnets-to-upstream-router-7.png)
Edit the neighbor configuration and click on Configure Out Filter.
![](https://vmme.org/wp-content/uploads/2024/11/nsx-t-filter-route-re-destribution-of-transit-subnets-to-upstream-router-8.png)
Select the prefix list previously created and save your work.
![](https://vmme.org/wp-content/uploads/2024/11/nsx-t-filter-route-re-destribution-of-transit-subnets-to-upstream-router-9.png)
If you check the routing table on the upstream router now, you should not see the filtered transit subnets.
Hope this post is informative,
Thanks for reading,
Mohamad Alhussein
![](https://vmme.org/wp-content/uploads/2024/11/nsx-t-filter-route-re-destribution-of-transit-subnets-to-upstream-router-10.png)