Customer prefix-list typo rejects the customer's /24¶
Case 15 of the Network Change Verdict Corpus. Category: policy-bug. Expected verdict: unsafe (an experienced operator would reject it).
Why it is expected unsafe¶
le 23 instead of le 24 drops the customer's only prefix, so the customer becomes unreachable from the internet.
The config change¶
Against the FRR configs of the base lab:
--- a/pe1.conf
+++ b/pe1.conf
@@ -20,7 +20,7 @@
ip route 192.0.2.0/24 blackhole
!
ip prefix-list OWN seq 10 permit 192.0.2.0/24
-ip prefix-list CUSTOMER-IN seq 10 permit 10.100.0.0/22 le 24
+ip prefix-list CUSTOMER-IN seq 10 permit 10.100.0.0/22 le 23
!
bgp community-list standard CUSTOMER permit 65000:100
!
What each strategy said¶
The expected verdict was committed to git before any run. All three strategies tested the same running lab (method).
| Strategy | Verdict | Result | Checks that failed |
|---|---|---|---|
| Ping only | unsafe | ✅ | customer reaches upstream, customer reaches peer |
| All BGP sessions up | safe | ❌ approved a bad change | none |
| Netdryrun intent checks | unsafe | ✅ | I2 upstream has customer route, I2 peer has customer route, I3 customer reaches upstream, I3 customer reaches peer, I5 upstream receives exactly our 2 prefixes, I5 peer receives exactly our 2 prefixes |
What Netdryrun flagged¶
These checks from the intent spec failed:
- I2 upstream has customer route: 10.100.0.0/24 must be in up1's routing table as a bgp route
- I2 peer has customer route: 10.100.0.0/24 must be in peer1's routing table as a bgp route
- I3 customer reaches upstream: ce1 can ping 203.0.113.1 from 10.100.0.1
- I3 customer reaches peer: ce1 can ping 198.51.100.1 from 10.100.0.1
- I5 upstream receives exactly our 2 prefixes: up1 receives exactly 2 prefixes from 10.0.2.1
- I5 peer receives exactly our 2 prefixes: peer1 receives exactly 2 prefixes from 10.0.4.1
Reproduce it¶
On Linux or WSL2 with Docker and containerlab, from a checkout of the repository:
Case file: corpus/cases/15-customer-filter-too-strict.yml. Published result: netdryrun 0.2.0, containerlab 0.81.1, FRR quay.io/frrouting/frr:10.4.1, commit ec23379, run on 2026-10-26.