Junos Routing Policy Generator

Generate a deny-by-default Junos prefix list and routing policy for controlled import or export with explicit operational safeguards.

Config generator Juniper / Junos Runs in your browser

Result

Policy
EXPORT-CUSTOMER
Prefixes
2
Default action
reject
Junos set commands
set policy-options prefix-list CUSTOMER-PREFIXES 203.0.113.0/24
set policy-options prefix-list CUSTOMER-PREFIXES 198.51.100.0/24
set policy-options policy-statement EXPORT-CUSTOMER term approved from protocol static
set policy-options policy-statement EXPORT-CUSTOMER term approved from prefix-list-filter CUSTOMER-PREFIXES exact
set policy-options policy-statement EXPORT-CUSTOMER term approved then community add 64500:100
set policy-options policy-statement EXPORT-CUSTOMER term approved then accept
set policy-options policy-statement EXPORT-CUSTOMER term deny-rest then reject
Review commands
show configuration policy-options policy-statement EXPORT-CUSTOMER | display set
show route advertising-protocol bgp <neighbor> detail
The generated policy uses exact prefix matches and an explicit reject-rest term. Apply it to a protocol or BGP group only after reviewing direction and expected routes.

About Junos Routing Policy Generator

Create a reusable Junos prefix list and policy statement with an explicit final reject, suitable as a starting point for controlled route import or export. Prefixes are validated before commands are emitted for careful peer review.

Deny-by-default routing policy

The approved term matches an exact prefix list and selected source protocol. A final reject term prevents routes outside that intent from being accepted or advertised accidentally.

Policy review

Import and export directions have different risks: an import mistake can install unwanted routes, while an export mistake can leak internal or third-party prefixes. Confirm the protocol, match type and attachment point, then inspect advertised or received routes before and after commit. Exact matching is intentionally conservative. If more-specific routes should also match, design that behaviour explicitly rather than widening the generated policy without review.

Common use cases

  • Build a customer BGP export policy.
  • Filter redistributed static routes.
  • Prepare a prefix-list change for peer review.

Edge cases and gotchas

  • Routing-policy mistakes can leak, reject or reroute production prefixes. Use commit confirmed where appropriate, capture before-and-after route evidence, verify the exact import or export attachment point, and retain a tested rollback command during the maintenance window.

Frequently asked questions

Does the tool apply the policy to BGP?
No. Attachment direction and group or neighbor are topology-specific, so apply the generated policy only after review. Use show route advertising-protocol or receive-protocol commands and compare route counts before treating the change as complete.
Why use exact matches?
Exact matching prevents an approved aggregate from silently authorising every more-specific route. Broader matching should be an explicit reviewed design choice.