How would you assign BGP AS numbers in an eBGP spine-leaf fabric, and why?
Show the answer
Say this first
All spines share one ASN, for example 65100. Each leaf, or each MLAG or vPC leaf pair, gets its own ASN: 65001, 65002 and so on. Shared spine ASN means a route can never pass through two spines, which stops valley paths and path hunting. Unique leaf ASNs mean a leaf accepts routes from other leaves without allowas-in, and every spine delivers the same AS path, so ECMP works without multipath-relax.
Go deeper
Why the spines share an ASN
When LEAF2's loopback is withdrawn, a spine with its own ASN could pick a backup path through another leaf and another spine, then withdraw that too. That is path hunting and it slows convergence. When all spines are 65100, any path that would cross a second spine contains 65100 twice and is rejected on arrival.
Why each leaf gets its own ASN
- If all leaves were 65001, LEAF1 would drop routes from LEAF2 because 65001 is already in the path.
You would need
allowas-inon leaves, which weakens loop protection. - LEAF1 receives LEAF2's prefix from SPINE1 and SPINE2 with the same path
65100 65002, so plainmaximum-pathsinstalls both.
Leaf pairs
MLAG or vPC peers commonly share one ASN and run an iBGP session across the peer link, so either peer can still reach the fabric if it loses all its uplinks.
ASN ranges
2-byte private ASNs are 64512 to 65534 (1,023 numbers). Large fabrics use 4-byte private ASNs, 4200000000 to 4294967294 (RFC 6996).
When you do need multipath-relax
When the same prefix arrives with different AS paths of equal length, for example an anycast service
advertised from leaves in 65001 and 65002 (65100 65001 and 65100 65002). IOS and NX-OS only use both
paths with bestpath as-path multipath-relax (IOS spells it bgp bestpath as-path multipath-relax).
They will ask next
What is BGP unnumbered?
Peering over IPv6 link-local addresses learned from router advertisements, and carrying IPv4 prefixes with an IPv6 next hop (RFC 5549, updated by RFC 8950). No /31 addressing plan is needed for fabric links. FRR-based systems such as SONiC made it popular.
Would you ever give each spine its own ASN?
Rarely. It reintroduces path hunting. Some designs give each spine plane its own ASN in a five-stage Clos, with careful policy. In a simple two-stage fabric, one spine ASN is the norm.
Traps
- Fixing a shared leaf ASN with
allowas-ineverywhere instead of fixing the ASN plan. - Saying multipath-relax is always required. It is only needed when equal-length AS paths differ.