According to CCIE R&S Official Cert Guide vol. 2, "if the ASN of the eBGP peer is in the current AS_PATH, the private ASNs will not be removed, either."

Can someone please explain what is the point of this restriction, since an eBGP peer will discard a prefix anyway if it sees its own AS number in the AS-PATH?

Many thanks, Cristian

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 11 '17 at 14:59

It is to prevent routing loops due to bad practice or configuration errors. Example: Jackweasel.COM is single-homed to some transit provider Victim.NET who has assigned them a private ASN, say 65000. Someone at Jackweasel.COM decides to initiate a peering session with Clueless.ORG who has a public ASN, and has agreed to peer with Jackweasel using the private ASN that Jackweasel has (it would surprise you how many people would not notice off that bat that they are setting up a peering session with someone who is using a private ASN and might also peer with someone else). Now Jackweasel announces routes learned from Clueles to Victim. Victim will now keep that full path in its route announcements to prevent a loop just like it does with regular BGP announcements using public ASNs. Basically it is a matter of "someone is multihomed with a private ASN so I now have to treat the path the same as I do with public ASNs to prevent routing loops in other networks". It also might break connectivity to the announced routes for everyone else on the planet using that same private ASN.

You might also be surprised at how many people accept routes with their own ASN because their network is not fully meshed. They have a colo in Virginia and one in California and they are each announcing a different /24 using the same ASN so they allow announcements carrying their own ASN to be installed so the two colos can talk to each other. But it also helps protect the Jackweasel who did this because they now see THEIR own private ASN in route announcements from Clueless (and who knows how many other peers they might have set up that way) that they sent to Victim.

| improve this answer | |

You can override the path loop protection (on Cisco this would be the neighbor ... allowas-in X command). X stands for the number of times your own AS is allowed in the path. So if you strip private AS from the path the eBGP neighbor may not see it's own AS (when it is a private AS) and there would be an unrestricted loop.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.