Specifying the source (export

The export_list specifies export based on the origin of a route, and the syntax varies depending on the source.

All the formats below with the variable route_filter allow route filters. See ``gated route filtering'' for a detailed explanation of how they work. When no route filtering is specified (when restrict is specified on the first line of a statement), all routes from the specified source will match that statement. If any filters are specified, only routes that match the specified filters will be exported. Put differently, if any filters are specified, an ``all restrict ;'' is assumed at the end of the list.

Exporting BGP and EGP routes

   proto bgp | egp autonomoussystem autonomous_system
       restrict ;
   proto bgp | egp autonomoussystem autonomous_system
       [ metric metric ] {
       route_filter [ restrict | ( metric metric ) ] ;
   } ;

BGP and EGP routes may be specified by source autonomous_system. All routes may be exported by AS path; see below for more information.

Exporting RIP routes

proto rip
    [ ( interface interface_list ) | (gateway gateway_list ) ]
    restrict ;
proto rip
    [ ( interface interface_list ) | (gateway gateway_list ) ]
    [ metric metric ] {
    route_filter [ restrict | ( metric metric ) ] ;
} ;

RIP routes may be exported by protocol, source interface, and/or source gateway.

Exporting OSPF routes

proto ospf | ospfase restrict ;
proto ospf | ospfase [ metric metric ] {
    route_filter [ restrict | ( metric metric ) ] ;
} ;

Both OSPF and OSPF ASE routes may be exported into other protocols. See below for information on exporting by tag.

Exporting routes from nonrouting protocols with interface

proto direct | static
    [ (interface interface_list ) ]
    restrict ;
proto direct | static
    [ (interface interface_list ) ]
    [ metric metric ] {
    route_filter [ restrict | ( metric metric ) ] ;
} ;

These protocols may be exported by protocol or by the interface of the next hop. These protocols are:

direct: routes to directly attached interfaces
static: static routes specified in a static clause

Exporting routes from nonrouting by protocol

proto default
    restrict ;
proto default
    [ metric metric ] {
    route_filter [ restrict | ( metric metric ) ] ;
} ;

These protocols may only be referenced by protocol. The keyword default refers to routes created by the gendefault option.

Exporting by AS path

proto proto aspath aspath_regexp
    origin [ any | igp | egp | incomplete ]
    restrict ;
proto proto aspath aspath_regexp
    origin [ any | igp | egp | incomplete ]
    [ metric metric ] {
    route_filter [ restrict | ( metric metric ) ] ;
} ;

When BGP is configured, all routes are assigned an AS path when they are added to the routing table. For all interior routes, this AS path specifies igp as the origin and no ASEs in the AS path (the current AS is added when the route is exported). For EGP routes, this AS path specifies EGP as the origin and the source AS as the AS path. For BGP routes, the AS path is stored as learned from BGP.

Exporting by route tag

proto proto tag tag restrict ;
proto proto tag tag
    [ metric metric ] {
    route_filter [ restrict | ( metric metric ) ] ;
} ;

Both OSPF and RIP Version 2 currently support tags; all other protocols always have a tag of zero. The source of exported routes may be selected based on this tag. This is useful when routes are classified by tag when they are exported into a given routing protocol.

Network Access Protection Design Guide

Updated: October 6, 2008

Applies To: Windows 7, Windows Server 2008, Windows Server 2008 R2, Windows Vista

Network Access Protection (NAP) is one of the most anticipated features of the Windows Server� 2008 operating system. NAP is a new platform that allows network administrators to define specific levels of network access based on a client�s identity, the groups to which the client belongs, and the degree to which the client complies with corporate governance policy. If a client is not compliant, NAP provides a mechanism for automatically bringing the client into compliance (a process known as remediation) and then dynamically increasing its level of network access. NAP is supported by Windows Server 2008 R2, Windows Server 2008, Windows 7, Windows Vista�, and Windows� XP with Service Pack 3 (SP3). NAP includes an application programming interface that developers and vendors can use to integrate their products and leverage this health state validation, access enforcement, and ongoing compliance evaluation. For more information about the NAP API, see Network Access Protection (http://go.microsoft.com/fwlink/?LinkId=128423).

The following are key NAP concepts:

NAP Agent. A service included with Windows Server 2008, Windows Vista, and Windows XP with SP3 that collects and manages health information for NAP client computers.
NAP client computer. A computer that has the NAP Agent service installed and running, and is providing its health status to NAP server computers.
NAP-capable computer. A computer that has the NAP Agent service installed and running and is capable of providing its health status to NAP server computers. NAP-capable computers include computers running Windows Server 2008, Windows Vista, and Windows XP with SP3.
Non-NAP-capable computer. A computer that cannot provide its health status to NAP server components. A computer that has NAP agent installed but not running is also considered non-NAP-capable.
Compliant computer. A computer that meets the NAP health requirements that you have defined for your network. Only NAP client computers can be compliant.
Noncompliant computer. A computer that does not meet the NAP health requirements that you have defined for your network. Only NAP client computers can be noncompliant.
Health status. Information about a NAP client computer that NAP uses to allow or restrict access to a network. Health is defined by a client computer's configuration state. Some common measurements of health include the operational status of Windows Firewall, the update status of antivirus signatures, and the installation status of security updates. A NAP client computer provides health status by sending a message called a statement of health (SoH).
NAP health policy server. A NAP health policy server is a computer running Windows Server 2008 with the Network Policy Server (NPS) role service installed and configured for NAP. The NAP health policy server uses NPS policies and settings to evaluate the health of NAP client computers when they request access to the network, or when their health state changes. Based on the results of this evaluation, the NAP health policy server instructs whether NAP client computers will be granted full or restricted access to the network.

Specifying the source (export_list)