Course contents

Module 4: BGP PolicyLesson 4.5 (5 of 8 in this module)27 of 43 in the BGP course

Preventing transit AS

Connect to two ISPs and BGP will happily pass routes from one to the other, because that is what it does with every route it learns. Unless you stop it, your small company becomes a transit network, and a mistake of yours can disrupt other networks.

Advanced · 12 min read

You'll learn to explain what a transit AS is and why a multihomed company must avoid being one, and apply and compare four filters that prevent it.

What a transit AS is

A transit AS carries traffic that neither starts nor ends inside it. ISPs are transit networks on purpose: they are paid to. A company with two providers can become one by accident. R1 learns routes from ISP A and, by default, advertises them to ISP B. ISP B then sees a path to ISP A networks through the company, and may use it.

The company must not become a path between two ISPs
The company must not become a path between two ISPsThe company is connected to ISP A and ISP B. If it re-advertises routes learned from ISP A to ISP B, ISP B can send traffic for ISP A networks through the company links. A filter on the session to ISP B that allows only routes with an empty AS path stops this.Without a filterWith an outbound filterISP AISP BCompanyroutes from AISP AISP BCompanyroutes from AleakedISP B can now route through youOnly ^$ (your own routes) leaves

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Left: unfiltered, the company becomes a transit AS and carries traffic for other networks over links sized for its own. Right: an outbound filter lets only the company's own prefixes out.

The consequences are practical: unexpected traffic floods links sized for the company, other networks see paths that bypass what they paid for, and a misconfiguration can leak the routes of your providers to the world.

Four ways to stop it

All four work by controlling what you advertise to each provider so that only your own prefixes leave. They differ in how they identify those prefixes.

Four filters for the same goal
Four filters for the same goalEach identifies your own routes in a different way.AS-path filterPermit only an empty AS path(^$): routes your AS originatedNo-export communityTag routes learned from a providerso they are not advertised outsidePrefix listPermit only your prefixes byaddress and lengthDistribute listAn access list on the session,older and less flexible

On small screens, swipe sideways or focus the diagram and use the arrow keys.

They all go on the outbound side of the session to each ISP.

Method 1: AS-path filter

A route originated inside your AS, including one learned from another router of yours over iBGP, has an empty AS path. The expression ^$ matches exactly those routes.

ip as-path access-list 20 permit ^$ ! router bgp 64500 address-family ipv4 unicast neighbor 192.0.2.1 filter-list 20 out neighbor 192.0.2.5 filter-list 20 out end clear ip bgp * soft out

R1 and R2 each apply it to their own provider. Routes learned from either ISP have a non-empty path and are not advertised. New prefixes you originate are allowed automatically.

Method 2: the no-export community

The well-known community no-export tells a router not to advertise a route to any eBGP neighbour. If you tag everything you learn from your providers with it, nothing they send can be passed on.

route-map FROM-ISPS permit 10 set community no-export additive ! router bgp 64500 address-family ipv4 unicast neighbor 192.0.2.1 route-map FROM-ISPS in neighbor 192.0.2.5 route-map FROM-ISPS in end clear ip bgp * soft in

R1 and R2. Routes arrive tagged no-export, so the router keeps them for its own use and tells no eBGP neighbour. additive keeps any community the provider already set.

Method 3: prefix list

ip prefix-list COMPANY-ONLY seq 5 permit 198.51.100.0/24 ! router bgp 64500 address-family ipv4 unicast neighbor 192.0.2.1 prefix-list COMPANY-ONLY out neighbor 192.0.2.5 prefix-list COMPANY-ONLY out end clear ip bgp * soft out

R1 and R2. Names exactly the prefix you own. This is the most explicit, and also the one that needs an edit every time you add a prefix.

Method 4: distribute list

A distribute list uses an access list on the session. It works, but a prefix list can express prefix lengths directly and is easier to read, so use a distribute list only when something forces you to. The next lesson covers it. A neighbour cannot have both a distribute list and a prefix list in the same direction.

Pick one clear control
Pick one clear controlExplicit prefix versus automatic origin.Prefix listLists your prefixesEdit when they changeMost explicitAS-path ^$Matches routes youoriginatedNo edit for new onesor

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Many operators combine a prefix list for what to advertise with an AS-path filter as a second safety net.

Verify what you advertise

Three checks on each provider session
Three checks on each provider sessionVerify from the neighbour out.AdvertisedOnly your prefixlisted?ReceivedProvider routesstill arriving?TableBest pathsunchanged?

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Check the sent routes, then the received ones, then the table.
Illustrative Cisco IOS XE output written for this lesson, not a router capture
R1#show ip bgp neighbors 192.0.2.1 advertised-routes
     Network          Next Hop            Metric LocPrf Weight Path
 *>  198.51.100.0/24  0.0.0.0                  0         32768 i

Total number of prefixes 1
Only the company prefix is advertised to ISP A, and it carries weight 32768 because it is locally originated. If you see a provider prefix here, the filter is missing or applied in the wrong direction.

Test the filters with show ip bgp neighbors ... advertised-routes after each change, and confirm the provider routes still arrive with routes. Output above is illustrative. A filter applied inbound by mistake can drop every route you needed.

Check your understanding

Predict · scenario 1

A company with two ISPs has no outbound filters. What happens to routes learned from ISP A?

Predict · scenario 2

Which AS-path expression permits only routes your AS originated?

Predict · scenario 3

You tag routes from ISP A with no-export inbound. What does R1 do with them?

FAQ

Does BGP stop transit by default?
No. By default a router advertises its best path for each prefix to every eBGP neighbour, whichever neighbour it came from. Transit prevention is always a configured filter.
Which of the four methods is best?
A prefix list names exactly what you advertise, so it is the most explicit. An AS-path filter for ^$ adapts when you add prefixes. Many networks use both. Prefer either to a distribute list.
Is a leak only a problem for the leaking company?
No. Other networks may send traffic through you because the path looks short. Your links can saturate, and the leak affects networks that never configured anything wrong.