BGP Replace Peer Autonomous System
This chapter describes BGP replace peer AS.
Topics in this chapter include:
Applicability
The CLI in the latest update of this chapter corresponds to SR Linux Release 26.3.1.
Overview
In some network designs, the same Autonomous System Number (ASN) is reused at different sites or regions that are interconnected by a common service or backbone. This can occur when an enterprise buys an IP-VRF service to connect various sites that, in the past, were operated as a single ASN. This can also occur when a service provider builds a common backbone to interconnect regional networks that, for simplicity, reuse the same ASN.
This type of interconnectivity creates a problem because a BGP route originated by one of the sites and propagated through the backbone appears as an AS path loop when advertised into another site. Routes with an AS loop are invalid; PE-2 detects AS path loop and advertises invalid route to PE-3 shows an example. PE-2 in AS 64501 receives a BGP route from PE-1 in AS 64496. PE-2 detects that the ASN 64496 in the BGP AS path attribute equals the ASN of its peer PE-3, so it detects an AS loop and advertises this route to PE-3 as an invalid route.
There are different solutions to this problem:
-
Use different ASNs per site or region. From an operational point of view, this is a major change in an existing network.
-
Disable AS path loop detection within each region. This is not encouraged in case you have external peering to the outside world. Any loops formed between these paths would be undetected.
-
Configure the default network instance or the IP-VRF instance with BGP AS path option replace-peer-as.
Most operators prefer to use BGP AS path option replace-peer-as. A router configured to use replace-peer-as on a BGP session monitors outbound routes toward that peer. Whenever a route has the ASN of the peer in its AS path, all occurrences of this ASN are replaced by the local ASN of the router. PE-2 replaces peer ASN in the AS path with the local ASN shows that PE-2 has replaced ASN 64496 in the AS path attribute of the BGP route toward PE-3 with its own ASN 64501.
The BGP AS path option replace-peer-as applies to all supported address families.
The replace-peer-as command is configurable in the BGP group or neighbor context, both for the default network instance and the IP-VRFs.
In SRL, AS path loop detection is enabled by default. Several actions can be configured when detecting an AS path loop, but those actions are out of the scope of this chapter.
Configuration
Example topology shows the example topology with five routers: PE-1, PE-3, and PE-5 in AS 64496, PE-2 in AS 64501, and PE-4 in AS 64502.
The initial configuration includes:
-
Cards, MDAs, ports
-
Router interfaces
-
EBGP sessions between the nodes
The initial BGP configuration on PE-2 is as follows.
# on PE-2:
routing-policy {
community-set scs-1:1 {
member [
1:1
]
}
policy rp-1:1 {
default-action {
policy-result reject
}
statement stmt-10 {
match {
bgp {
community-set scs-1:1
}
}
action {
policy-result accept
}
}
}
}
network-instance default {
admin-state enable
router-id 192.0.2.2
interface int-PE-2-PE-1 {
interface-ref {
interface ethernet-1/1
subinterface 1
}
}
interface int-PE-2-PE-3 {
interface-ref {
interface ethernet-1/3
subinterface 1
}
}
interface system0.0 {
}
protocols {
bgp {
admin-state enable
autonomous-system 64501
router-id 192.0.2.2
afi-safi ipv4-unicast {
admin-state enable
}
route-advertisement {
rapid-withdrawal true
}
group EBGP {
admin-state enable
export-policy [
rp-1:1
]
import-policy [
rp-1:1
]
}
neighbor 192.168.12.1 {
admin-state enable
peer-as 64496
peer-group EBGP
}
neighbor 192.168.23.2 {
admin-state enable
peer-as 64496
peer-group EBGP
}
}
}The BGP configuration on the other nodes is similar.
In this chapter, two examples are shown:
-
BGP replace-peer-as in the default network instance
-
BGP replace-peer-as in an IP-VRF
Default: peer AS is not replaced in the default network instance
The default BGP AS path options are the following:
--{ + running }--[ ]--
A:admin@PE-2# info from state network-instance default protocols bgp group EBGP as-path-options
allow-own-as 0
replace-peer-as false
remove-private-as {
mode disabled
leading-only false
ignore-peer-as false
}
PE-1 exports BGP route 10.1.0.0/16, defined as a loopback interface in the default routing instance. The configuration is as follows:
# on PE-1:
routing-policy {
community-set scs-1:1 {
member [
1:1
]
}
prefix-set ps-10.1.0.0 {
prefix 10.1.0.0/16 mask-length-range 16..32 {
}
}
policy rp-export-10.1.0.0 {
default-action {
policy-result reject
}
statement stmt-10 {
match {
prefix {
prefix-set ps-10.1.0.0
}
}
action {
policy-result accept
bgp {
communities {
add scs-1:1
}
}
}
}
}
policy rp-1:1 {
default-action {
policy-result reject
}
statement stmt-10 {
match {
bgp {
community-set scs-1:1
}
}
action {
policy-result accept
}
}
}
}
network-instance default {
admin-state enable
router-id 192.0.2.1
interface int-PE-1-PE-2 {
interface-ref {
interface ethernet-1/2
subinterface 1
}
}
interface loop0 {
interface-ref {
interface lo0
subinterface 0
}
}
interface system0.0 {
}
protocols {
bgp {
admin-state enable
autonomous-system 64496
router-id 192.0.2.1
afi-safi ipv4-unicast {
admin-state enable
}
route-advertisement {
rapid-withdrawal true
}
group EBGP {
admin-state enable
export-policy [
rp-export-10.1.0.0
]
import-policy [
rp-1:1
]
}
neighbor 192.168.12.2 {
admin-state enable
peer-as 64501
peer-group EBGP
}
}
}
PE-2 receives the following BGP routes from PE-1 with AS path 64496, as follows:
--{ + running }--[ ]--
A:admin@PE-2# show network-instance default protocols bgp neighbor 192.168.12.1 received-routes ipv4
----------------------------------------------------------------------------------------------------------------------------------
Peer : 192.168.12.1, remote AS: 64496, local AS: 64501
Type : static
Description : None
Group : EBGP
----------------------------------------------------------------------------------------------------------------------------------
Status codes: u=used, *=valid, >=best, x=stale, b=backup, w=unused-weight-only
Origin codes: i=IGP, e=EGP, ?=incomplete
+-------------------------------------------------------------------------------------------------------------------------------+
| Status Network Path-id Next Hop MED LocPref AsPath Origin |
+===============================================================================================================================+
| u*> 10.1.0.0/16 0 192.168.12.1 - [64496] i |
| u*> 10.1.0.1/32 0 192.168.12.1 - [64496] i |
+-------------------------------------------------------------------------------------------------------------------------------+
----------------------------------------------------------------------------------------------------------------------------------
2 received BGP routes : 2 used 2 valid
----------------------------------------------------------------------------------------------------------------------------------
PE-2 detects that the ASN 64496 in the AS path equals the ASN of the peer AS of PE-3, so an AS loop is detected and PE-2 advertises these routes to PE-3 as an invalid route with AS path <64501 64496>, as follows:
--{ + running }--[ ]--
A:admin@PE-2# show network-instance default protocols bgp neighbor 192.168.23.2 advertised-routes ipv4
----------------------------------------------------------------------------------------------------------------------------------
Peer : 192.168.23.2, remote AS: 64496, local AS: 64501
Type : static
Description : None
Group : EBGP
----------------------------------------------------------------------------------------------------------------------------------
Origin codes: i=IGP, e=EGP, ?=incomplete
+-----------------------------------------------------------------------------------------------------------------------------+
| Network Path-id Next Hop MED LocPref AsPath Origin |
+=============================================================================================================================+
| 10.1.0.0/16 0 192.168.23.1 - [64501, 64496] i |
| 10.1.0.1/32 0 192.168.23.1 - [64501, 64496] i |
+-----------------------------------------------------------------------------------------------------------------------------+
----------------------------------------------------------------------------------------------------------------------------------
2 advertised BGP routes
----------------------------------------------------------------------------------------------------------------------------------
The following command on PE-3 shows that path 1 is not best, valid, and used as on PE-2.
--{ + running }--[ ]--
A:admin@PE-3# show / network-instance default protocols bgp routes ipv4 prefix 10.1.0.0/16
-------------------------------------------------------------------------------------------
Show report for the BGP routes to network "10.1.0.0/16" network-instance "default"
-------------------------------------------------------------------------------------------
Network: 10.1.0.0/16
Received Paths: 1
Path 1: <>
Route source : neighbor 192.168.23.1
Route Preference: MED is -, No LocalPref
BGP next-hop : 192.168.23.1
Path : i [64501, 64496]
Communities : 1:1
Path 0 was advertised to:
[ ]
-------------------------------------------------------------------------------------------
The reason why this route is invalid, is an AS loop, as follows:
--{ + running }--[ ]--
A:admin@PE-3# show / network-instance default protocols bgp routes ipv4 prefix 10.1.0.0/16 detail | grep Invalid
Invalid Reason : As_Loop
PE-3 does not advertise any routes to PE-4:
--{ + running }--[ ]--
A:admin@PE-3# show network-instance default protocols bgp neighbor 192.168.34.2 advertised-routes ipv4
-----------------------------------------------------------------------------------------------------------------------------------------------------
Peer : 192.168.34.2, remote AS: 64502, local AS: 64496
Type : static
Description : None
Group : EBGP
-----------------------------------------------------------------------------------------------------------------------------------------------------
Origin codes: i=IGP, e=EGP, ?=incomplete
+--------------------------------------------------------------------------------------------------------------------------------------------------+
| Network Path-id Next Hop MED LocPref AsPath Origin |
+==================================================================================================================================================+
+--------------------------------------------------------------------------------------------------------------------------------------------------+
-----------------------------------------------------------------------------------------------------------------------------------------------------
0 advertised BGP routes
-----------------------------------------------------------------------------------------------------------------------------------------------------
PE-2 detects AS path loop and advertises invalid route to PE-3 shows the BGP routes advertised by PE-1 and PE-2 with the corresponding AS path.
Replace BGP peer AS in default network instance on PE-2 and PE-4
On PE-2 and PE-4, the following command configures BGP AS path option replace-peer-as true in the group "EBGP":
# on PE-2, PE-4:
network-instance default {
protocols {
bgp {
group "EBGP" {
as-path-options {
replace-peer-as true
}
With this configuration, BGP AS path options are as follows:
--{ + running }--[ ]--
A:admin@PE-2# info from state network-instance default protocols bgp group EBGP as-path-options
allow-own-as 0
replace-peer-as true
remove-private-as {
mode disabled
leading-only false
ignore-peer-as false
}PE-2 receives the route from PE-1 with ASN 64496, as follows:
--{ + running }--[ ]--
A:admin@PE-2# show / network-instance default protocols bgp routes ipv4 prefix 10.1.0.0/16
--------------------------------------------------------------------------------------------
Show report for the BGP routes to network "10.1.0.0/16" network-instance "default"
--------------------------------------------------------------------------------------------
Network: 10.1.0.0/16
Received Paths: 1
Path 1: <Best,Valid,Used,>
Route source : neighbor 192.168.12.1
Route Preference: MED is -, No LocalPref
BGP next-hop : 192.168.12.1
Path : i [64496]
Communities : 1:1
Path 1 was advertised to:
[ 192.168.23.2 ]
--------------------------------------------------------------------------------------------
Instead of advertising a route with an AS loop, PE-2 replaces ASN 64496 in the AS path attribute with its own ASN 64501, so PE-3 receives the following valid route:
--{ + running }--[ ]--
A:admin@PE-3# show / network-instance default protocols bgp routes ipv4 prefix 10.1.0.0/16
--------------------------------------------------------------------------------------------
Show report for the BGP routes to network "10.1.0.0/16" network-instance "default"
--------------------------------------------------------------------------------------------
Network: 10.1.0.0/16
Received Paths: 1
Path 1: <Best,Valid,Used,>
Route source : neighbor 192.168.23.1
Route Preference: MED is -, No LocalPref
BGP next-hop : 192.168.23.1
Path : i [64501, 64501]
Communities : 1:1
Path 1 was advertised to:
[ 192.168.34.2 ]
--------------------------------------------------------------------------------------------
PE-4 receives the following BGP route from PE-3:
--{ + running }--[ ]--
A:admin@PE-4# show / network-instance default protocols bgp routes ipv4 prefix 10.1.0.0/16
-------------------------------------------------------------------------------------------------
Show report for the BGP routes to network "10.1.0.0/16" network-instance "default"
-------------------------------------------------------------------------------------------------
Network: 10.1.0.0/16
Received Paths: 1
Path 1: <Best,Valid,Used,>
Route source : neighbor 192.168.34.1
Route Preference: MED is -, No LocalPref
BGP next-hop : 192.168.34.1
Path : i [64496, 64501, 64501]
Communities : 1:1
Path 1 was advertised to:
[ 192.168.45.2 ]
-------------------------------------------------------------------------------------------------
PE-4 detects an AS loop when advertising this route to its peer PE-5 in AS 64496, so it replaces ASN 64496 in the AS path with its own ASN 64502. PE-5 receives the following valid route from PE-4:
--{ + running }--[ ]--
A:admin@PE-5# show / network-instance default protocols bgp routes ipv4 prefix 10.1.0.0/16
-------------------------------------------------------------------------------------------------
Show report for the BGP routes to network "10.1.0.0/16" network-instance "default"
-------------------------------------------------------------------------------------------------
Network: 10.1.0.0/16
Received Paths: 1
Path 1: <Best,Valid,Used,>
Route source : neighbor 192.168.45.1
Route Preference: MED is -, No LocalPref
BGP next-hop : 192.168.45.1
Path : i [64502, 64502, 64501, 64501]
Communities : 1:1
Path 1 was advertised to:
[ ]
-------------------------------------------------------------------------------------------------
No AS loop when peer AS is replaced for group "EBGP" on PE-2 and PE-4 shows the BGP routes advertised by the PEs with the corresponding AS path.
Default: no peer AS is replaced in IP-VRF
Example topology with IP-VRF-1 on all PEs shows the example topology with IP-VRF-1 configured on all PEs.
On PE-2, IP-VRF-1 is configured as follows. By default, replace-peer-as is not configured for any BGP group or BGP neighbor.
# on PE-2:
network-instance "IP-VRF-1" {
type ip-vrf
admin-state enable
interface int-VRF1onPE-2-VRF1onPE-1 {
interface-ref {
interface ethernet-1/1
subinterface 2
}
}
interface int-VRF1onPE-2-VRF1onPE-3 {
interface-ref {
interface ethernet-1/3
subinterface 2
}
}
protocols {
bgp {
admin-state enable
autonomous-system 64503
router-id 172.31.0.2
afi-safi ipv4-unicast {
admin-state enable
}
group grp-EBGP-1 {
export-policy [
rp-1:1
]
import-policy [
rp-1:1
]
}
neighbor 172.16.12.1 {
peer-as 64497
peer-group grp-EBGP-1
}
neighbor 172.16.23.2 {
peer-as 64497
peer-group grp-EBGP-1
}
}
The service configuration on the other nodes is similar. The IP addresses and ASNs are shown in Example topology with IP-VRF-1 on all PEs.
IP-VRF-1 on PE-1 exports BGP route 172.31.0.1/32, defined as a loopback interface within the IP-VRF-1 routing instance. The configuration is as follows:
# on PE-1:
routing-policy {
prefix-set ps-172.31.0.0 {
prefix 172.31.0.0/16 mask-length-range 16..32 {
}
}
community-set scs-1:1 {
member [
1:1
]
}
policy rp-export-172.31.0.0 {
default-action {
policy-result reject
}
statement stmt-10 {
match {
prefix {
prefix-set ps-172.31.0.0
}
}
action {
policy-result accept
bgp {
communities {
add scs-1:1
}
}
}
}
}
}
network-instance "IP-VRF-1" {
type ip-vrf
admin-state enable
interface int-VRF1onPE-1-VRF1onPE-2 {
interface-ref {
interface ethernet-1/2
subinterface 2
}
}
interface loop1-172.31.0.1 {
interface-ref {
interface lo0
subinterface 1
}
}
protocols {
bgp {
admin-state enable
autonomous-system 64497
router-id 172.31.0.1
afi-safi ipv4-unicast {
admin-state enable
}
group grp-EBGP-1 {
export-policy [
rp-export-172.31.0.0
]
import-policy [
rp-1:1
]
}
neighbor 172.16.12.2 {
peer-as 64503
peer-group grp-EBGP-1
}
}
IP-VRF-1 on PE-1 exports route 172.31.0.1/32 with ASN 64497 to IP-VRF-1 on PE-2. On PE-2, the following route is received in IP-VRF-1:
--{ + running }--[ ]--
A:admin@PE-2# show network-instance IP-VRF-1 protocols bgp neighbor 172.16.12.1 received-routes ipv4
-----------------------------------------------------------------------------------------------------------------------------------
Peer : 172.16.12.1, remote AS: 64497, local AS: 64503
Type : static
Description : None
Group : grp-EBGP-1
-----------------------------------------------------------------------------------------------------------------------------------
Status codes: u=used, *=valid, >=best, x=stale, b=backup, w=unused-weight-only
Origin codes: i=IGP, e=EGP, ?=incomplete
+-------------------------------------------------------------------------------------------------------------------------------+
| Status Network Path-id Next Hop MED LocPref AsPath Origin |
+===============================================================================================================================+
| u*> 172.31.0.1/32 0 172.16.12.1 - [64497] i |
+-------------------------------------------------------------------------------------------------------------------------------+
-----------------------------------------------------------------------------------------------------------------------------------
1 received BGP routes : 1 used 1 valid
-----------------------------------------------------------------------------------------------------------------------------------
ASN 64497 equals the peer AS of IP-VRF-1 on PE-3, so IP-VRF-1 on PE-2 detects an AS loop and advertises the following route to IP-VRF-1 on PE-3 as invalid:
--{ + running }--[ ]--
A:admin@PE-3# show network-instance IP-VRF-1 protocols bgp routes ipv4 prefix 172.31.0.1/32
-------------------------------------------------------------------------------------------------
Show report for the BGP routes to network "172.31.0.1/32" network-instance "IP-VRF-1"
-------------------------------------------------------------------------------------------------
Network: 172.31.0.1/32
Received Paths: 1
Path 1: <>
Route source : neighbor 172.16.23.1
Route Preference: MED is -, No LocalPref
BGP next-hop : 172.16.23.1
Path : i [64503, 64497]
Communities : 1:1
Path 0 was advertised to:
[ ]
-------------------------------------------------------------------------------------------------
The reason why this route is invalid on PE-3, is an AS loop:
--{ + running }--[ ]--
A:admin@PE-3#
show network-instance IP-VRF-1 protocols bgp routes ipv4 prefix 172.31.0.1/32 detail | grep Invalid
Invalid Reason : As_Loop
AS loop when BGP replace-peer-as is not configured in IP-VRF-1 on PE-2 shows the routes sent by IP-VRF-1 on PE-1 and PE-2. IP-VRF-1 on PE-3 receives an invalid route with an AS loop and it does not re-advertise this route to IP-VRF-1 on PE-4.
Replace BGP peer AS in IP-VRF on PE-2 and PE-4
On PE-2 and PE-4, AS path option replace-peer-as true is configured in IP-VRF-1 for group "EBGP", as follows:
# on PE-2, PE-4:
network-instance IP-VRF-1 {
protocols {
bgp {
group grp-EBGP-1 {
as-path-options {
replace-peer-as true
}
Routes advertised when BGP replace-peer-as is enabled in IP-VRF-1 on the PEs shows the routes advertised in IP-VRF-1 on the PEs when BGP replace-peer-as is enabled on PE-2 and PE-4.
IP-VRF-1 on PE-2 receives the route with ASN 64497:
--{ + running }--[ ]--
A:admin@PE-2# show network-instance IP-VRF-1 protocols bgp routes ipv4 prefix 172.31.0.1/32
-------------------------------------------------------------------------------------------
Show report for the BGP routes to network "172.31.0.1/32" network-instance "IP-VRF-1"
-------------------------------------------------------------------------------------------
Network: 172.31.0.1/32
Received Paths: 1
Path 1: <Best,Valid,Used,>
Route source : neighbor 172.16.12.1
Route Preference: MED is -, No LocalPref
BGP next-hop : 172.16.12.1
Path : i [64497]
Communities : 1:1
Path 1 was advertised to:
[ 172.16.23.2 ]
-------------------------------------------------------------------------------------------
IP-VRF-1 on PE-2 replaces the peer AS 64497 with its own ASN 64503 and IP-VRF-1 on PE-3 receives the following valid route:
--{ + running }--[ ]--
A:admin@PE-3# show network-instance IP-VRF-1 protocols bgp routes ipv4 prefix 172.31.0.1/32
-------------------------------------------------------------------------------------------
Show report for the BGP routes to network "172.31.0.1/32" network-instance "IP-VRF-1"
-------------------------------------------------------------------------------------------
Network: 172.31.0.1/32
Received Paths: 1
Path 1: <Best,Valid,Used,>
Route source : neighbor 172.16.23.1
Route Preference: MED is -, No LocalPref
BGP next-hop : 172.16.23.1
Path : i [64503, 64503]
Communities : 1:1
Path 1 was advertised to:
[ 172.16.34.2 ]
-------------------------------------------------------------------------------------------
IP-VRF-1 on PE-4 receives the following route:
--{ + running }--[ ]--
A:admin@PE-4# show network-instance IP-VRF-1 protocols bgp routes ipv4 prefix 172.31.0.1/32
-------------------------------------------------------------------------------------------
Show report for the BGP routes to network "172.31.0.1/32" network-instance "IP-VRF-1"
-------------------------------------------------------------------------------------------
Network: 172.31.0.1/32
Received Paths: 1
Path 1: <Best,Valid,Used,>
Route source : neighbor 172.16.34.1
Route Preference: MED is -, No LocalPref
BGP next-hop : 172.16.34.1
Path : i [64497, 64503, 64503]
Communities : 1:1
Path 1 was advertised to:
[ 172.16.45.2 ]
-------------------------------------------------------------------------------------------
IP-VRF-1 on PE-4 replaces ASN 64497 with its own ASN 64504, so IP-VRF-1 on PE-5 receives the following valid route with AS path <64504 64504 64503 64503>:
--{ + running }--[ ]--
A:admin@PE-5# show network-instance IP-VRF-1 protocols bgp routes ipv4 prefix 172.31.0.1/32
-------------------------------------------------------------------------------------------
Show report for the BGP routes to network "172.31.0.1/32" network-instance "IP-VRF-1"
-------------------------------------------------------------------------------------------
Network: 172.31.0.1/32
Received Paths: 1
Path 1: <Best,Valid,Used,>
Route source : neighbor 172.16.45.1
Route Preference: MED is -, No LocalPref
BGP next-hop : 172.16.45.1
Path : i [64504, 64504, 64503, 64503]
Communities : 1:1
Path 1 was advertised to:
[ ]
-------------------------------------------------------------------------------------------
Conclusion
Replacing the peer AS can prevent AS loops in network designs where different sites or regions are interconnected by a common service or backbone. BGP replace peer AS can be enabled for BGP groups or BGP neighbors, both in the base router and in IP-VRFs.