Which AS numbers are private, and what does remove-private-as do?
Show the answer
Say this first
Private ASNs are 64512 to 65534 and 4200000000 to 4294967294 (RFC 6996). They must not leak into the global
table, so the provider strips them on its upstream sessions with neighbor x remove-private-as. On Cisco IOS
the plain command only strips them when the AS path contains nothing but private ASNs. remove-private-as all
removes them wherever they appear, and all replace-as swaps each one for the local AS so the path length is kept.
Go deeper
Ranges worth knowing
| Range | Use |
|---|---|
| 0, 65535, 4294967295 | Reserved |
| 23456 | AS_TRANS: stands in for a 4-byte ASN when talking to a 2-byte-only speaker |
| 64496 to 64511, 65536 to 65551 | Documentation (RFC 5398) |
| 64512 to 65534 | Private, 2-byte |
| 4200000000 to 4294967294 | Private, 4-byte |
Typical use
A customer connected only to ISP1 runs eBGP with private AS 65010. ISP1 (AS 64496) strips 65010 toward its upstream, so the internet sees the customer prefix as originated by 64496.
router bgp 64496
neighbor 192.0.2.10 remote-as 65010
neighbor 192.0.2.10 description CUSTOMER-A
neighbor 198.51.100.9 remote-as 64511
neighbor 198.51.100.9 description UPSTREAM
neighbor 198.51.100.9 remove-private-asThe upstream sees the path 64496 instead of 64496 65010.
Cisco IOS behaviour
remove-private-as: removes private ASNs only if the whole path is private. A mixed path such as65010 64499is left alone.remove-private-as all: removes every private ASN anywhere in the path.remove-private-as all replace-as: replaces each private ASN with the local AS, so prepends keep working.- It applies on eBGP sessions only.
They will ask next
Why does a customer multihomed to two different ISPs usually need a public ASN?
After both ISPs strip the private ASN, the prefix appears to be originated by two different ASes. That multiple-origin situation is confusing to troubleshoot, needs ROAs for both origins, and most providers simply require a public ASN for multi-provider multihoming.
What is asdot notation?
A way to write 4-byte ASNs as two 16-bit halves: 65536 is
1.0in asdot and65536in asplain. Cisco switches the display withbgp asnotation dot. Asplain is the usual default today.
Traps
- Expecting plain
remove-private-asto clean a path that also contains public ASNs. On IOS you need theallkeyword.