When we advertise a BGP route to an eBGP neighbor, it is common to remove any private AS numbers that are in the AS path.
One reason to do this is to hide any complexity within our network so our eBGP peers only see our public AS number in the path.
On Junos, this can be done by setting the ‘remove-private’ statement at either the BGP group or neighbor level.
The private AS number ranges are:
- 2-byte AS Numbers: 64512 to 65535
- 4-byte AS Numbers: 4200000000–4294967294
Lab Environment
The lab is set up as per the below diagram.
WARNING: To show how the remove private statement works, I need to use some public AS numbers. In this case AS 40, 41, and 42. I am not associated with any of these networks. In real networks, only use your own AS number(s). Re-using someone else’s AS numbers can have bad consequences for both your own and other networks.
- vMX-2 belongs to AS 41.
- vMX-3 belongs to AS 42.
- vMX-2 is advertising the following routes.
- 172.30.101.0/24 with AS path: 41 65100 65200.
- 172.30.102.0/24 with AS path: 41 65100 65200 40 65300 65400.
- 172.30.103.0/24 with AS path: 41 4200000001 4200000002.
- 172.30.104.0/24 with AS path: 41 4200000001 4200000002 40 4200000003 4200000004.
Note the first two routes use 2-byte ASNs. The last two routes use 4-byte ASNs. The second and fourth routes also have a public 2-byte ASN in the middle of the path.
Example 1 – Baseline
Before we start, we’ll look at vMX-3 first to see what the AS paths look like before we make any changes.
lab@vMX-3-B> show route protocol bgp
inet.0: 12 destinations, 12 routes (12 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
172.30.101.0/24 *[BGP/170] 00:10:37, localpref 100
AS path: 41 65100 65200 I, validation-state: unverified
> to 192.168.2.2 via ge-0/0/1.0
172.30.102.0/24 *[BGP/170] 00:10:37, localpref 100
AS path: 41 65100 65200 40 65300 65400 I, validation-state: unverified
> to 192.168.2.2 via ge-0/0/1.0
172.30.103.0/24 *[BGP/170] 00:10:37, localpref 100
AS path: 41 4200000001 4200000002 I, validation-state: unverified
> to 192.168.2.2 via ge-0/0/1.0
172.30.104.0/24 *[BGP/170] 00:10:37, localpref 100
AS path: 41 4200000001 4200000002 40 4200000003 4200000004 I, validation-state: unverified
> to 192.168.2.2 via ge-0/0/1.0
inet6.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)
lab@vMX-3-B>Example 1 – Configuring Remove Private
In this step, we will configure vMX-2 with the remove private statement. This can be set at the group or neighbor level.
lab@vMX-2> configure
Entering configuration mode
[edit]
lab@vMX-2# show protocols bgp group my-external-group
type external;
authentication-key "$9$7mdw2ZUH5Qn4aQn/CB17-V"; ## SECRET-DATA
peer-as 42;
neighbor 192.168.2.1;
[edit]
lab@vMX-2# set protocols bgp group my-external-group neighbor 192.168.2.1 remove-private
[edit]
lab@vMX-2# show protocols bgp group my-external-group
type external;
authentication-key "$9$7mdw2ZUH5Qn4aQn/CB17-V"; ## SECRET-DATA
peer-as 42;
neighbor 192.168.2.1 {
remove-private;
}
[edit]
lab@vMX-2# commit
commit complete
[edit]
lab@vMX-2#Example 1 – Validation
If look at the routes on vMX-3 now, we should see a difference.
lab@vMX-3-B> show route protocol bgp
inet.0: 12 destinations, 12 routes (12 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
172.30.101.0/24 *[BGP/170] 00:01:30, localpref 100
AS path: 41 I, validation-state: unverified
> to 192.168.2.2 via ge-0/0/1.0
172.30.102.0/24 *[BGP/170] 00:01:30, localpref 100
AS path: 41 40 65300 65400 I, validation-state: unverified
> to 192.168.2.2 via ge-0/0/1.0
172.30.103.0/24 *[BGP/170] 00:01:30, localpref 100
AS path: 41 I, validation-state: unverified
> to 192.168.2.2 via ge-0/0/1.0
172.30.104.0/24 *[BGP/170] 00:01:30, localpref 100
AS path: 41 40 4200000003 4200000004 I, validation-state: unverified
> to 192.168.2.2 via ge-0/0/1.0
inet6.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)
lab@vMX-3-B>The stripping of the private AS numbers works on both 2-byte and 4-byte ASNs.
If the AS path contains a public ASN, the private ASNs will only be removed up to that point. Any private ASNs after the first public ASN are left in place.
Example 2 – Remove All Private AS Numbers
To remove all the private AS numbers we need to add the ‘all’ keyword to the end of the remove-private statement.
[edit]
lab@vMX-2# show protocols bgp group my-external-group
type external;
authentication-key "$9$7mdw2ZUH5Qn4aQn/CB17-V"; ## SECRET-DATA
peer-as 42;
neighbor 192.168.2.1 {
remove-private;
}
[edit]
lab@vMX-2# set protocols bgp group my-external-group neighbor 192.168.2.1 remove-private all
[edit]
lab@vMX-2# show protocols bgp
group my-external-group {
type external;
authentication-key "$9$7mdw2ZUH5Qn4aQn/CB17-V"; ## SECRET-DATA
peer-as 42;
neighbor 192.168.2.1 {
remove-private {
all;
}
}
}
group my-internal-group {
type internal;
local-address 172.16.1.2;
authentication-key "$9$GSjkmz39O1hfT1hSr8LGDi"; ## SECRET-DATA
export fix-nhs;
neighbor 172.16.1.1;
}
[edit]
lab@vMX-2# commit
commit complete
[edit]
lab@vMX-2#Example 2 – Verification
If we check the routes on vMX-3, we can see that all the private AS numbers have been removed.
lab@vMX-3-B> show route protocol bgp
inet.0: 12 destinations, 12 routes (12 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
172.30.101.0/24 *[BGP/170] 00:09:39, localpref 100
AS path: 41 I, validation-state: unverified
> to 192.168.2.2 via ge-0/0/1.0
172.30.102.0/24 *[BGP/170] 00:01:08, localpref 100
AS path: 41 40 I, validation-state: unverified
> to 192.168.2.2 via ge-0/0/1.0
172.30.103.0/24 *[BGP/170] 00:09:39, localpref 100
AS path: 41 I, validation-state: unverified
> to 192.168.2.2 via ge-0/0/1.0
172.30.104.0/24 *[BGP/170] 00:01:08, localpref 100
AS path: 41 40 I, validation-state: unverified
> to 192.168.2.2 via ge-0/0/1.0
inet6.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)
lab@vMX-3-B>Something you might have noticed is that removing the private ASNs has shortened the AS path length as well. You might want to keep the AS path the same length, which we look at in the next examples.
Example 3 – Replacing Private AS Numbers With Our AS Number
Instead of removing the private ASNs, we can replace them with our own AS.
[edit]
lab@vMX-2# show protocols bgp group my-external-group
type external;
authentication-key "$9$7mdw2ZUH5Qn4aQn/CB17-V"; ## SECRET-DATA
peer-as 42;
neighbor 192.168.2.1 {
remove-private {
all;
}
}
[edit]
lab@vMX-2# set protocols bgp group my-external-group neighbor 192.168.2.1 remove-private all replace
[edit]
lab@vMX-2# show protocols bgp
group my-external-group {
type external;
authentication-key "$9$7mdw2ZUH5Qn4aQn/CB17-V"; ## SECRET-DATA
peer-as 42;
neighbor 192.168.2.1 {
remove-private {
all replace;
}
}
}
group my-internal-group {
type internal;
local-address 172.16.1.2;
authentication-key "$9$GSjkmz39O1hfT1hSr8LGDi"; ## SECRET-DATA
export fix-nhs;
neighbor 172.16.1.1;
}
[edit]
lab@vMX-2# commit
commit complete
[edit]
lab@vMX-2#Example 3 – Verification
Now, the routes on vMX-3 look like this.
lab@vMX-3-B> show route protocol bgp
inet.0: 12 destinations, 12 routes (12 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
172.30.101.0/24 *[BGP/170] 00:00:06, localpref 100
AS path: 41 41 41 I, validation-state: unverified
> to 192.168.2.2 via ge-0/0/1.0
172.30.102.0/24 *[BGP/170] 00:00:06, localpref 100
AS path: 41 41 41 40 41 41 I, validation-state: unverified
> to 192.168.2.2 via ge-0/0/1.0
172.30.103.0/24 *[BGP/170] 00:00:06, localpref 100
AS path: 41 41 41 I, validation-state: unverified
> to 192.168.2.2 via ge-0/0/1.0
172.30.104.0/24 *[BGP/170] 00:00:06, localpref 100
AS path: 41 41 41 40 41 41 I, validation-state: unverified
> to 192.168.2.2 via ge-0/0/1.0
inet6.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)
lab@vMX-3-B>The private AS numbers have all been replaced with our public AS. The routes that already had another public AS in the path look a bit strange now though. The path appears to loop through our AS, AS 41.
There is one final tweak we can make.
Example 4 – Replacing Private AS Numbers With The Nearest ASN In The Path
Instead of replacing all the private ASNs with our AS number, we can instead tell Junos to use the nearest public ASN in the path.
[edit]
lab@vMX-2# show protocols bgp group my-external-group
type external;
authentication-key "$9$7mdw2ZUH5Qn4aQn/CB17-V"; ## SECRET-DATA
peer-as 42;
neighbor 192.168.2.1 {
remove-private {
all replace;
}
}
[edit]
lab@vMX-2# set protocols bgp group my-external-group neighbor 192.168.2.1 remove-private all replace nearest
[edit]
lab@vMX-2# show protocols bgp
group my-external-group {
type external;
authentication-key "$9$7mdw2ZUH5Qn4aQn/CB17-V"; ## SECRET-DATA
peer-as 42;
neighbor 192.168.2.1 {
remove-private {
all replace nearest;
}
}
}
group my-internal-group {
type internal;
local-address 172.16.1.2;
authentication-key "$9$GSjkmz39O1hfT1hSr8LGDi"; ## SECRET-DATA
export fix-nhs;
neighbor 172.16.1.1;
}
[edit]
lab@vMX-2# commit
commit complete
[edit]
lab@vMX-2# Example 4 – Verification
Time for a final check of the routes on vMX-3.
lab@vMX-3-B> show route protocol bgp
inet.0: 12 destinations, 12 routes (12 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
172.30.101.0/24 *[BGP/170] 00:05:43, localpref 100
AS path: 41 41 41 I, validation-state: unverified
> to 192.168.2.2 via ge-0/0/1.0
172.30.102.0/24 *[BGP/170] 00:01:11, localpref 100
AS path: 41 41 41 40 40 40 I, validation-state: unverified
> to 192.168.2.2 via ge-0/0/1.0
172.30.103.0/24 *[BGP/170] 00:05:43, localpref 100
AS path: 41 41 41 I, validation-state: unverified
> to 192.168.2.2 via ge-0/0/1.0
172.30.104.0/24 *[BGP/170] 00:01:11, localpref 100
AS path: 41 41 41 40 40 40 I, validation-state: unverified
> to 192.168.2.2 via ge-0/0/1.0
inet6.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)
lab@vMX-3-B>All the routes have had the private ASNs replaced with the closest public ASN in the path.
Summary
The remove-private statement on Junos will either remove or replace private AS numbers in the AS path. It works on both 2-byte and 4-byte private AS numbers.
We can configure it to:
- Remove private AS numbers up to the first public AS Number in the path.
- Remove all private AS numbers in the path.
- Replace all private AS numbers in the path with our own AS number.
- Replace all private AS numbers in the path with the closest public AS number.