Course contents

Module 2: Scaling iBGPLesson 2.2 (2 of 3 in this module)5 of 11 in the Advanced BGP course

BGP confederations

Splitting one AS into sub-ASes to avoid a full mesh.

Advanced · 20 min read

You'll learn to explain how a confederation presents one AS to the outside, configure sub-ASes, and read the confederation segment in an AS path.

Smaller meshes inside one AS

A confederation divides a large AS into member sub-ASes. Inside each sub-AS the routers run ordinary iBGP and need a full mesh among themselves. Between sub-ASes they run a special form of eBGP. To the rest of the internet the whole thing is one AS, announced by the confederation identifier.

Full mesh against confederation
Full mesh against confederationA full iBGP mesh grows with the square of the routers. A confederation divides the AS into sub-ASes, each with a small mesh.Full meshEvery router peers withevery other routerLarge AS: too many sessionsConfederationSeveral small meshesSub-ASes peer with each otherOutside sees one ASvs

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Between sub-ASes the routers behave much like eBGP, but inside the confederation attributes are kept.
One AS presented as several sub-ASes
One AS presented as several sub-ASesConfederation AS 64500 contains member sub-ASes 65001 and 65002. Routers inside a sub-AS use full-mesh iBGP, and sub-ASes connect with confederation eBGP. The outside world sees only AS 64500.AS 64500 (as seen from outside)Sub-AS 65001Sub-AS 65002A1A2B1B2confed eBGPiBGP inside each sub-AS · confederation eBGP between sub-ASes

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Sub-AS numbers are private and hidden from the outside. AS_PATH carries them in a special confederation segment that does not count toward path length.

Configure a member sub-AS

router bgp 65001 bgp confederation identifier 64500 bgp confederation peers 65002 neighbor 10.255.0.2 remote-as 65001 neighbor 10.255.0.2 update-source Loopback0 neighbor 10.255.1.1 remote-as 65002 neighbor 10.255.1.1 update-source Loopback0 neighbor 10.255.1.1 ebgp-multihop 2

A1, a router in sub-AS 65001. The router bgp number is the sub-AS. The identifier is the AS the outside sees. bgp confederation peers lists the other sub-ASes. The loopback eBGP session between sub-ASes needs ebgp-multihop.

Neighbours inside the same sub-AS use their sub-AS number as remote-as. Neighbours in another sub-AS use that sub-AS number and are listed under confederation peers. Neighbours outside the confederation use their real AS number.

Reading a confederation path

Illustrative Cisco IOS XE output written for this lesson, not a router capture
B1#show ip bgp 203.0.113.0
BGP routing table entry for 203.0.113.0/24, version 5
Paths: (1 available, best #1, table default)
  (65001) 64501
    10.255.0.1 from 10.255.1.1 (10.255.1.1)
      Origin IGP, metric 0, localpref 100, valid, confed-external, best
The number in parentheses is the confederation segment: the route passed through sub-AS 65001 inside the confederation. The word confed-external tells you the session crosses a sub-AS boundary. The segment is removed before the route is sent outside.

Technical reference: RFC 5065, Autonomous System Confederations for BGP. Output above is illustrative.

What the outside sees
What the outside seesInside, the path lists sub-ASes. At the edge they are removed.Insidepath (65001 65002)sub-AS segmentsEdge routerremoves thesub-AS numbersOutsidesees AS 64500only

On small screens, swipe sideways or focus the diagram and use the arrow keys.

The confederation identifier is the only AS number outside peers see.

Following a route across sub-ASes

The path changes at every sub-AS boundary in a way that does not show on the internet. Follow one route from AS 64501 through three sub-ASes to AS 64502.

The AS path across a confederation
The AS path across a confederationA route from AS 64501 enters sub-AS 65001 of confederation AS 64500, crosses sub-AS 65002 and 65003, and leaves towards AS 64502. Inside, the path shows the sub-ASes in parentheses: (65001) 64501, then (65002 65001) 64501, then (65003 65002 65001) 64501. When the route leaves, the sub-AS numbers are removed and the confederation identifier is added, so AS 64502 sees 64500 64501.Confederation identifier AS 64500AS 64501AS 64502Sub-AS65001Sub-AS65002Sub-AS6500364501(65001) 64501(65002 65001) 6450164500 64501Each box shows the AS path as a router at that point sees it.

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Sub-AS numbers prevent loops inside the confederation but do not count towards the AS path length. Outside peers see one AS, 64500.

Inside the confederation, each sub-AS prepends its own number to a special segment of the path, written in parentheses. A router that finds its own sub-AS number in that segment rejects the route, so loops between sub-ASes are prevented the way AS_PATH prevents them between real ASes. When the route is sent to a true eBGP neighbour, the segment is dropped and the confederation identifier is added.

What is kept across a sub-AS boundary

The session between sub-ASes is a form of eBGP, but the confederation is still one AS in policy terms, so several attributes behave like iBGP instead of like normal eBGP.

Behaviour at a confederation boundary
Behaviour at a confederation boundaryAttributes kept and attributes changed.LOCAL_PREFKept, so the whole confederationagrees on the exitNEXT_HOPKept, so every sub-AS needs aroute to the original next hopMEDKept across the boundaryAS_PATHSub-AS number added in theconfederation segment

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Treating the whole confederation as one AS is the point: policy set at the edge applies throughout.

Migrating an AS to a confederation

A safe order for a migration
A safe order for a migrationFour stages.PlanPick sub-ASnumbers and layoutEdge peersOutside peers keepthe real AS numberSub-AS by sub-ASRe-number onegroup at a timeVerifyPaths show theconfed segment

On small screens, swipe sideways or focus the diagram and use the arrow keys.

On IOS XE the BGP process number cannot be changed in place, so each router BGP configuration is rebuilt under the sub-AS number. Plan a maintenance window for each sub-AS.

Confederations and route reflectors

Both reduce the iBGP mesh. A reflector keeps one AS and relays routes by rule. A confederation splits the AS and adds a layer of sub-AS numbers, which is more disruptive to introduce but gives policy boundaries.

Choosing between the two
Choosing between the twoReflectors are simpler to deploy. Confederations suit large networks that want policy boundaries or are merging.Route reflectorsKeep a single ASEasy to add to a networkConfederationsSplit into sub-ASesPolicy boundariesor

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Many networks combine them: reflectors inside each sub-AS.

Check your understanding

Predict · scenario 1

What does an outside network see in the AS path of a route from a confederation?

Predict · scenario 2

Which command identifies the AS the outside world sees?

Predict · scenario 3

Why does a confederation reduce sessions?

FAQ

Why use a confederation instead of route reflectors?
Both reduce the mesh. Confederations also let different parts of a large network run separate policy, and they are common after company mergers. Route reflectors are simpler to deploy and are the usual first choice.
What do outside networks see?
Only the confederation identifier, AS 64500 in this lesson. The sub-AS numbers are removed when a route leaves.
Which attributes survive between sub-ASes?
Next hop, MED and local preference are kept when a route crosses a confederation boundary, so policy stays consistent across the whole AS.