Course contents

Module 3: Path SelectionLesson 3.12 (12 of 13 in this module)21 of 43 in the BGP course

Controlling inbound traffic: AS-path prepending and MED

You cannot configure another network's routers. You can only change what they see. Inbound path control is the art of making one entrance to your network look less attractive than the other.

Advanced · 13 min read

You'll learn to use AS path prepending and MED to influence how other networks reach your prefix, and explain why the result depends on decisions made outside your AS.

The other half of the problem

The last lesson steered outbound traffic with local preference. Replies and new connections arrive the other way, and the path they take is decided by other networks reading the routes you advertise. If both ISPs carry 198.51.100.0/24 with the same attributes, remote networks pick whichever looks best to them, and half the world may arrive through the backup link.

Outbound and inbound control
Outbound and inbound controlYou decide where your traffic leaves. You can only influence where traffic enters.OutboundYour router decidesLocal preference, weightInboundOther networks decidePrepending, MED, communitiesvs

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Outbound uses commands on your router. Inbound depends on how other networks react.

You cannot overwrite their choice. You can make the backup path look worse.

AS path prepending

The best-path algorithm prefers a shorter AS_PATH. Prepending adds extra copies of your own AS number to the routes you send to one ISP, so that path looks longer. The route is still valid and still a backup.

Prepending makes one path look longer to the rest of the internet
Prepending makes one path look longer to the rest of the internetA remote network in AS 64510 hears the company prefix through ISP A with AS_PATH 64501 64500, length 2, and through ISP B with AS_PATH 64502 64500 64500 64500, length 4, because the company prepended its own AS twice on the ISP B session. The shorter path through ISP A wins.Remote networkAS 64510ISP AAS 64501ISP BAS 64502AS_PATH: 64501 64500length 2, preferredAS_PATH: 64502 64500 64500 64500length 4, less attractiveCompanyAS 64500set as-path prepend 64500 64500(on the session to ISP B)

On small screens, swipe sideways or focus the diagram and use the arrow keys.

The company adds copies of its own AS number on the ISP B session only. Remote routers compare AS_PATH length before they look at anything the company cannot influence.
route-map ISPB-OUT permit 10 match ip address prefix-list COMPANY-ONLY set as-path prepend 64500 64500 64500 router bgp 64500 address-family ipv4 unicast neighbor 192.0.2.5 route-map ISPB-OUT out exit-address-family end clear ip bgp 192.0.2.5 soft out

R2, global configuration mode, then privileged EXEC for the last line. Three extra copies of 64500 are added when advertising to ISP B. Always prepend your own AS number, not someone else's.

Check what a neighbour would receive without logging in to it:

Illustrative Cisco IOS XE output written for this lesson, not a router capture
R2#show ip bgp neighbors 192.0.2.5 advertised-routes
     Network          Next Hop            Metric LocPrf Weight Path
 *>  198.51.100.0     0.0.0.0                  0         32768 64500 64500 64500 64500 i

Total number of prefixes 1
The AS_PATH now carries the company AS four times: the normal one plus the three prepended copies. Routers beyond ISP B see a path of length 4 in addition to ISP B's own AS, while the path through ISP A is still length 1.

MED: a hint to a neighbouring AS

The multi-exit discriminator tells one neighbouring AS which of several links into your AS you prefer. Lower wins. It is useful if you connect to the same provider in two places.

MED works with one neighbouring AS, not across two
MED works with one neighbouring AS, not across twoLeft: R1 and R2 both connect to ISP A. The company sends MED 50 on one link and MED 100 on the other, and ISP A prefers MED 50. Right: the company connects to ISP A and ISP B with MED 50 and MED 100. Different ASes do not compare these values and MED is not passed on.Two links to the same ISP: MED worksLinks to two ISPs: MED does not steerISP AAS 64501R1AS 64500R2AS 64500MED 50MED 100ISP A prefers the lower MEDISP AAS 64501ISP BAS 64502CompanyAS 64500MED 50MED 100No router compares the two values.MED is not passed on to other ASes.

On small screens, swipe sideways or focus the diagram and use the arrow keys.

MED is a hint from one AS to one neighbouring AS. It cannot choose between two different providers.

MED has three limits. By default it is compared only between paths from the same neighbouring AS, so it cannot choose between ISP A and ISP B. The receiving AS does not pass it on to other ASes. And it ranks low in the order, below weight, local preference and AS_PATH length, so any of those can override it.

route-map TO-ISPA permit 10 match ip address prefix-list COMPANY-ONLY set metric 50 router bgp 64500 address-family ipv4 unicast neighbor 192.0.2.1 route-map TO-ISPA out

R1: advertises the company prefix to ISP A with MED 50. A second link to ISP A would advertise a higher MED so ISP A prefers this one.

How many prepends

One extra copy of your AS number rarely changes anything, and ten is excessive: paths on the internet are mostly four to six ASes long, so a few additional copies are enough to push a path behind a rival that has the default local preference. Start with two or three, check the result from the outside, and add one at a time.

Prepending in steps
Prepending in stepsEach step makes the path longer by one AS hop.0 extra copiesPath length 1 to the rest of the world2 extra copiesLength 3: loses to a length 2 path4 extra copiesLength 5: loses to most alternativesMany moreNo extra effect, and some providersfilter very long paths

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Past about five extra copies you gain nothing a smaller number did not, and you make the path look suspicious to filters.

Splitting by prefix: some prefixes each way

Splitting inbound traffic by prefix
Splitting inbound traffic by prefixYour AS announces two prefixes to ISP A and ISP B. 198.51.100.0/25 is announced to ISP A normally and prepended toward ISP B, so the internet prefers ISP A for it. 198.51.100.128/25 is announced to ISP B normally and prepended toward ISP A, so the internet prefers ISP B for it.InternetISP AAS 64501ISP BAS 64502Your edgeAS 64500198.51.100.0/25normal: preferred here198.51.100.128/25 prepended198.51.100.128/25normal: preferred here198.51.100.0/25 prepended

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Each link carries one prefix as the preferred path and the other as the backup. Both prefixes stay reachable through both ISPs, so a failure moves traffic automatically.

Prepending the same on every prefix sends everyone to one provider. If you own two prefixes you can balance the links: prepend prefix A towards ISP B and prefix B towards ISP A. Each prefix has a primary path and the other is the backup.

ip prefix-list NET-A seq 5 permit 198.51.100.0/25 ip prefix-list NET-B seq 5 permit 198.51.100.128/25 ! route-map TO-ISPB permit 10 match ip address prefix-list NET-A set as-path prepend 64500 64500 64500 route-map TO-ISPB permit 20 ! route-map TO-ISPA permit 10 match ip address prefix-list NET-B set as-path prepend 64500 64500 64500 route-map TO-ISPA permit 20 ! router bgp 64500 address-family ipv4 unicast neighbor 192.0.2.5 route-map TO-ISPB out neighbor 192.0.2.1 route-map TO-ISPA out

R2 and R1. Traffic for NET-A comes in via ISP A and for NET-B via ISP B. The empty permit sequence at the end lets everything else through unchanged: without it the implicit deny would drop other routes.

Checking from the outside

You cannot see the other network's choice from your own router, so look from outside. Many providers and research projects run looking glass servers: web or command line tools that run show ip bgp from their router. Ask one in a distant AS for your prefix and read the AS path it chose.

A check from outside
A check from outsideThree steps.Soft resetclear ip bgpsoft outWaitA few minutesfor propagationLookLooking glass:which path is best?

On small screens, swipe sideways or focus the diagram and use the arrow keys.

A change you cannot verify from outside has not been verified.

Why this is a request, not a command

Inbound policy changes what neighbours see. It cannot change what they decide. A provider can set local preference on every route from a customer, ignore MED, strip prepends or filter them. Treat every inbound change as an experiment: apply it, then check from outside, for example with a looking glass that your provider publishes, and use a longer prepend only if the result does not move.

Why inbound control is only a request
Why inbound control is only a requestThe decision belongs to the remote network.You advertise a hintLocal pref winsThe remote network mayignore your prependingLonger prefix winsA more specific routebeats every hintWorks as hopedHint changes the choice

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Expect influence, not guarantees, and test the result.

Technical reference: RFC 4271 defines AS_PATH and MED. Output above is illustrative.

Check your inbound policy

Predict · scenario 1

You prepend three times on R2 toward ISP B. Remote networks still use ISP B. What is the likely reason?

Predict · scenario 2

You advertise MED 10 to ISP A and MED 20 to ISP B. Does that make remote networks prefer ISP A?

Predict · scenario 3

What does set as-path prepend 64500 64500 do on a route sent to an ISP?

FAQ

Why does prepending sometimes do nothing?
Other networks compare local preference before AS_PATH length. If a remote network gives your route through ISP B a higher local preference, for example because ISP B is its customer, a longer AS path through ISP B cannot change the choice.
How many times should I prepend?
Start with two or three. Most internet paths are only a handful of AS numbers long, so a few extra copies of your own AS is usually enough to make the path lose, and long prepends add nothing but bytes.
Is MED better than prepending?
They solve different problems. MED is a hint to one neighbouring AS about several entrances into your network and is ignored by default when paths come from different ASes. Prepending is visible to the whole internet.