Rate and give feedback:  Feedback Received. Thank You!

Rate and give feedback: 

X

This document helped resolve my issue

Yes No

Additional Comments

800 characters remaining

May we contact you if necessary?

Name:  

E-mail: 

Enter a valid Email ID

Need product assistance? Contact Juniper Support

Submit

This site is protected by hCaptcha and its Privacy Policy and Terms of Service apply.

English  

English

Example: Configuring AS Override

Understanding AS Override

The AS override feature allows a provider edge (PE) router to change the private autonomous system (AS) number used by a customer edge (CE) device on an external BGP (EBGP) session running on a VPN routing and forwarding (VRF) access link. The private AS number is changed to the PE AS number. Another CE device connected to another PE device sees the EBGP route coming from the first site with an AS path of provider-ASN provider-ASN, instead of provider-ASN site1-ASN. This allows enterprise networks to use the same private ASN on all sites.

The AS override feature offers a clear management advantage to the service provider because BGP by default does not accept BGP routes with an AS path attribute that contains the local AS number.

In an enterprise network with multiple sites, you might wish to use a single AS number across sites. Suppose, for example that two CE devices are in AS 64512 and that the provider network is in AS 65534.

When the service provider configures a Layer 3 VPN with this setup, even if the MPLS network has routes towards Device CE1 and Device CE2, Device CE1 and Device CE2 do not have routes to each other because the AS path attribute would appear as 64512 65534 64512. BGP uses the AS path attribute as its loop avoidance mechanism. If a site sees its own AS number more than once in the AS path, the route is considered invalid.

One way to overcome this difficulty is with the as-override statement, which is applied to the PE devices. The as-override statement replaces the CE device's AS number with that of the PE device, thus preventing the customer AS number from appearing more than once in the AS path attribute.

If a customer uses AS path prepending to make certain paths less desirable and the service provider uses AS override, each CE AS number occurrence in the AS-path is changed to the service provider AS number. For example, suppose that all customer sites use the same AS number, say 64512. If the ISP uses AS number 65534, one customer site sees the path to another site as 65534 65534. If the customer prepends 64512 on a particular path to make it less desirable, another customer site sees that path as 65534 65534 65534.

Example: Configuring a Layer 3 VPN with Route Reflection and AS Override

Suppose that you are a service provider providing a managed MPLS-based Layer 3 VPN service. Your customer has several sites and requires BGP routing to customer edge (CE) devices at each site.

• Requirements
• Overview
• Configuration
• Verification

Requirements

No special configuration beyond device initialization is required before configuring this example.

Overview

This example has two CE devices, two provider edge (PE) devices, and several provider core devices. The provider network is also using IS-IS to support LDP and BGP loopback reachability Device P2 is acting as a route reflector (RR). Both CE devices are in autonomous system (AS) 64512. The provider network is in AS 65534.

The as-override statement is applied to the PE devices, thus replacing the CE device's AS number with that of the PE device. This prevents the customer AS number from appearing more than once in the AS path attribute.

Figure 1 shows the topology used in this example.

Figure 1: AS Override Topology

CLI Quick Configuration shows the configuration for all of the devices in Figure 1. The section Step-by-Step Procedure describes the steps on Device PE1.

Configuration

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level.

Step-by-Step Procedure

1. Configure the interfaces.

   To enable MPLS, include the protocol family on the interface so that the interface does not discard incoming MPLS traffic.

   [edit interfaces]user@PE1# set ge-1/2/0 unit 0 family inet address 10.0.0.2/30user@PE1# set ge-1/2/0 unit 0 family isouser@PE1# set ge-1/2/0 unit 0 family mplsuser@PE1# set ge-1/2/1 unit 0 family inet address 10.0.0.5/30user@PE1# set ge-1/2/1 unit 0 family isouser@PE1# set ge-1/2/1 unit 0 family mplsuser@PE1# set ge-1/2/2 unit 0 family inet address 10.0.0.21/30user@PE1# set ge-1/2/2 unit 0 family isouser@PE1# set ge-1/2/2 unit 0 family mplsuser@PE1# set lo0 unit 0 family inet address 10.255.2.2/32user@PE1# set lo0 unit 0 family iso address 49.0001.0010.0000.0202.00
2. Add the interface to the MPLS protocol to establish the control plane level connectivity.

   Set up the IGP so that the provider devices can communicate with each other.

   To establish a mechanism to distribute MPLS labels, enable LDP. Optionally, for LDP, enable forwarding equivalence class (FEC) deaggregation, which results in faster global convergence.

   [edit protocols]user@PE1# set mpls interface ge-1/2/2.0user@PE1# set mpls interface ge-1/2/1.0user@PE1# set mpls interface lo0.0user@PE1# set mpls interface fxp0.0 disableuser@PE1# set isis interface ge-1/2/1.0 level 2 metric 10user@PE1# set isis interface ge-1/2/1.0 level 1 disableuser@PE1# set isis interface ge-1/2/2.0 level 2 metric 10user@PE1# set isis interface ge-1/2/2.0 level 1 disableuser@PE1# set isis interface fxp0.0 disableuser@PE1# set isis interface lo0.0 level 2 metric 0user@PE1# set ldp deaggregateuser@PE1# set ldp interface ge-1/2/1.0user@PE1# set ldp interface ge-1/2/2.0user@PE1# set ldp interface fxp0.0 disableuser@PE1# set ldp interface lo0.0
3. Enable the internal BGP (IBGP) connection to peer with the RR only, using the IPv4 VPN unicast address family.
   [edit protocols bgp group l3vpn]user@PE1# set type internaluser@PE1# set local-address 10.255.2.2user@PE1# set family inet-vpn unicastuser@PE1# set peer-as 65534user@PE1# set local-as 65534user@PE1# set neighbor 10.255.4.4
4. Configure the routing instance, including the as-override statement.

   Create the routing-Instance (VRF) on the PE device, setting up the BGP configuration to peer with Device CE1.

   [edit routing-instances VPN-A]user@PE1# set instance-type vrfuser@PE1# set interface ge-1/2/0.0user@PE1# set route-distinguisher 65534:1234user@PE1# set vrf-target target:65534:1234user@PE1# set protocols bgp group CE type externaluser@PE1# set protocols bgp group CE family inet unicastuser@PE1# set protocols bgp group CE neighbor 10.0.0.1 peer-as 64512user@PE1# set protocols bgp group CE neighbor 10.0.0.1 as-override
5. Configure the router ID and the AS number.
   [edit routing-options]user@PE1# set router-id 10.255.2.2user@PE1# set autonomous-system 65534

Results

From configuration mode, confirm your configuration by entering the show interfaces, show protocols, show routing-instances, and show routing-options commands. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

If you are done configuring the device, enter commit from configuration mode.

Verification

Confirm that the configuration is working properly.

• Checking AS Path to the CE Devices
• Checking How the Route to Device CE2 Is Advertised
• Checking the Route on Device CE1

Checking AS Path to the CE Devices

Purpose

Display information on Device PE1 about the AS path attribute for the route to Device CE2’s loopback interface.

Action

On Device PE1, from operational mode, enter the show route table VPN-A.inet.0 10.255.6.6 command.

 

VPN-A.inet.0: 5 destinations, 6 routes (5 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

10.255.6.6/32      *[BGP/170] 02:19:35, localpref 100, from 10.255.4.4
                      AS path: 64512 I, validation-state: unverified
                    > to 10.0.0.22 via ge-1/2/2.0, Push 300032, Push 299776(top)

Meaning

The output shows that Device PE1 has an AS path for 10.255.6.6/32 as coming from AS 64512.

Checking How the Route to Device CE2 Is Advertised

Purpose

Make sure the route to Device CE2 is advertised to Device CE1 as if it is coming from the MPLS core.

Action

On Device PE1, from operational mode, enter the show route advertising-protocol bgp 10.0.0.1 command.

 
VPN-A.inet.0: 5 destinations, 6 routes (5 active, 0 holddown, 0 hidden)
  Prefix                  Nexthop              MED     Lclpref    AS path
* 10.0.0.16/30            Self                                    I
* 10.255.1.1/32           10.0.0.1                                65534 I
* 10.255.6.6/32           Self                                    65534 I

Meaning

The output indicates that Device PE1 is advertising only its own AS number in the AS path.

Checking the Route on Device CE1

Purpose

Make sure that Device CE1 contains only the provider AS number in the AS path for the route to Device CE2.

Action

From operational mode, enter the show route table inet.0 terse 10.255.6.6 command.

inet.0: 5 destinations, 6 routes (5 active, 0 holddown, 1 hidden)
+ = Active Route, - = Last Active, * = Both

A V Destination        P Prf   Metric 1   Metric 2  Next hop        AS path
* ? 10.255.6.6/32      B 170        100                             65534 65534 I
  unverified                                       >10.0.0.2

Meaning

The output indicates that Device CE1 has a route to Device CE2. The loop issue is resolved with the use of the as-override statement.

One route is hidden on the CE device. This is because Junos OS does not perform a BGP split horizon. Generally, split horizon in BGP is unnecessary, because any routes that might be received back by the originator are less preferred due to AS path length (for EBGP), AS path loop detection (IBGP), or other BGP metrics. Advertising routes back to the neighbor from which they were learned has a negligible effect on the router's performance, and is the correct thing to do.