Course contents

Module 1: BGP FoundationsLesson 1.1 (1 of 3 in this module)1 of 43 in the BGP course

Autonomous systems and why BGP exists

How can users still reach your company when one internet provider fails? Let's separate the route out of your network from the route back into it.

Advanced · 11 min read

You'll learn to explain what an autonomous system is, read and classify AS numbers, describe how the AS path carries routes and prevents loops, and decide whether a network needs BGP.

Why do we need more than a default route?

A default route against BGP at a two-ISP edge
A default route against BGP at a two-ISP edgeOn the left the edge router has one default route toward ISP A, so all traffic leaves there and ISP B sits idle until someone changes the configuration. On the right the edge router runs BGP with both providers, learns which prefixes each can reach, and picks the exit for each destination.Default routeInternetEdgeAS 64500ISP AISP BOne exit, chosen by configurationISP B only helps after manual changeBGPInternetEdgeAS 64500ISP AISP BExit chosen per prefixFailure moves traffic by itself

On small screens, swipe sideways or focus the diagram and use the arrow keys.

A default route is enough when there is one exit. As soon as there are two providers or your own address space, the edge needs to know what each provider can reach and to decide for itself.

Our example company in AS 64500 uses the address block 198.51.100.0/24 and buys internet access from two providers, ISP A and ISP B, so that it stays online if one of them fails. A static default route to each ISP gets traffic out, but it cannot solve the other half: the rest of the internet must learn that 198.51.100.0/24 is reachable through both ISPs. If one connection fails, affected networks need to learn that the old path is no longer available. BGP (Border Gateway Protocol) exchanges that reachability information between networks.

A default route against BGP
A default route against BGPLeft: a default route sends everything to one exit and cannot see beyond it. Right: BGP learns prefixes and chooses between exits.Default route onlyOne rule: send everythingto one next hopCannot see failures pastthe first routerBGPLearns many prefixesCompares paths per prefixReacts when a path iswithdrawnor

On small screens, swipe sideways or focus the diagram and use the arrow keys.

A default route is one rule for every destination. BGP gives the router a table of destinations to choose from.

A prefix is a block of IP addresses written with its length. Here /24 means that the first 24 bits identify the network. A user outside the company is trying to open a service at 198.51.100.10. The providers need a route to its prefix; a default route configured only inside the company does not announce that prefix to them.

A route that gets a request out of your network does not automatically provide the return route.

Autonomous systems

An autonomous system (AS) is a set of networks run by one organisation with one routing policy towards the outside: an ISP, a cloud provider, a university, or a company with its own addresses. Inside an AS, an IGP (interior gateway protocol) such as OSPF finds the shortest paths. Between autonomous systems, BGP carries routes, and each organisation decides what it accepts and what it announces.

AS numbers by range
AS numbers by rangePublic AS numbers, documentation numbers, private numbers and 4-byte numbers each have their own range.1 to 64495Public 16-bit numbers assigned by the registries64496 to 64511Reserved for documentation (RFC 5398), used in this course64512 to 65534Private 16-bit numbers, never sent to the internet65536 and above4-byte numbers, written as plain decimal (asplain)

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Documentation numbers are safe for lessons. Private numbers must not appear on the public internet.

Every AS is identified by an AS number (ASN). Public ASNs are assigned by the five regional internet registries (ARIN, RIPE NCC, APNIC, LACNIC and AFRINIC).

Autonomous systems
Autonomous systemsRange; Use. 1 – 64495: Public 2-byte range; individual assignments are recorded by IANA and the registries 64496 – 64511: Documentation and examples (RFC 5398), used in this course 64512 – 65534: Private, 2-byte (RFC 6996) 65536 – 65551: Documentation, 4-byte (RFC 5398) 131072 – 4199999999: 4-byte public allocation space, including unallocated blocks; not all numbers have been assigned 4200000000 – 4294967294: Private, 4-byte (RFC 6996) 0, 65535, 4294967295: ReservedRangeUse1 – 64495Public 2-byte range; individual assignments are recorded by IANA and theregistries64496 – 64511Documentation and examples (RFC 5398), used in this course64512 – 65534Private, 2-byte (RFC 6996)65536 – 65551Documentation, 4-byte (RFC 5398)131072 – 41999999994-byte public allocation space, including unallocated blocks; not allnumbers have been assigned4200000000 – 4294967294Private, 4-byte (RFC 6996)0, 65535, 4294967295Reserved

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Each item on the left, with what it means on the right.

This is a learning summary, not an allocation authority. AS 23456 has the special AS_TRANS purpose described below; 65552–131071 are also reserved. Check the IANA AS-number registry before choosing a public number.

AS numbers were 16 bits (2 bytes) until the registries began to run out; 4-byte ASNs (RFC 6793) raised the limit to 4 294 967 295. Cisco IOS shows them in asplain notation by default (65546) and can show asdot notation instead (1.10, meaning 1 × 65536 + 10). A router that only understands 2-byte ASNs sees a 4-byte AS as AS 23456 (AS_TRANS), a placeholder, while the real number travels in a separate attribute.

Private ASNs work like private IP addresses: fine inside an organisation or between a customer and its provider, but they should not appear in public-internet AS paths. Removing or replacing them requires an agreed provider configuration; BGP does not automatically remove every private ASN.

How the AS path carries a route

BGP is a path-vector protocol. When a router sends a route to another AS, it adds its own ASN to the front of the route's AS_PATH attribute. An attribute is information attached to a route. In this simple example, the path lists the ASes through which the announcement travelled. By default, a router rejects a received route whose AS path contains its own ASN. That stops the same announcement being accepted after travelling back around a loop.

An AS path grows as a route crosses autonomous systems
An AS path grows as a route crosses autonomous systemsThe prefix 203.0.113.0/24 starts in AS 64501. Each AS that passes it on adds its own number, and an AS that sees its own number rejects the route.OriginAS 64501203.0.113.0/24path: 64501Received by R1AS 64500path: 64501R1 advertises onadds 64500path: 64500 64501Back at AS 64501own number seenroute rejected

On small screens, swipe sideways or focus the diagram and use the arrow keys.

The AS path records where a route has been. It is both a distance measure and the loop check.

The four router symbols below represent the borders of four autonomous systems. The lines show BGP relationships between those systems. They do not show individual Ethernet cables, interface addresses or the path of a web packet. The moving labels are route announcements travelling away from the company; user packets for its service travel towards it.

CompanyAS 64500ISP AAS 64501ISP BAS 64502Remote networkAS 64503

Device key: Company, ISP A, ISP B, Remote network (router)

Lines show the example’s network connections. The coloured path and envelope follow the current step; its text identifies the sender, receiver and traffic type.

  1. 1. The company announces its block. It sends 198.51.100.0/24 to both providers with AS path 64500.
  2. 2. ISP A passes it on. ISP A adds 64501 to the front, so the remote network sees two ASes on the way.
  3. 3. ISP B does the same. The remote network now has two paths and picks one by its own policy.
  4. 4. ISP A also hears it from ISP B. With no other policy set, ISP A keeps the direct path: the shorter AS path wins.
  5. 5. Loop prevention. If ISP A sends the selected route back to the company, the company sees its own 64500 in the path and rejects it.
The same company prefix reaches the remote AS through two providers. AS_PATH describes the announcement's AS-level path, not its IP-interface hops.

Notice what BGP does not compare: link speed. OSPF picks the lowest total cost; BGP picks by attributes, in a fixed order, and the length of the AS path is only one step in that order. The administrator can override it, for example to keep ISP B as a backup even when its path is shorter. The course covers those attributes in Module 3.

Why the internet needs a protocol of its own

Why an internet-wide protocol differs from an IGP
Why an internet-wide protocol differs from an IGPThe internet has many independent operators, business policy and a very large number of prefixes, so a link-state protocol that shares every link would not fit.The internetMany operatorsEach AS has its ownrules and its owninternal protocolBusiness policyCustomers, peers andproviders are treateddifferentlyScale and stabilityCarries prefixes, notevery link, so a localchange stays local

On small screens, swipe sideways or focus the diagram and use the arrow keys.

BGP shares reachability and policy, not the internal topology of each network.
  • Scale. BGP exchanges reachable prefixes without requiring every organisation to share one detailed link-state map. After the initial exchange, updates normally describe changes. This does not mean BGP uses no memory or processing power: large tables still need suitable hardware.
  • Policy. An ISP must decide which neighbours may send it traffic for which destinations, because that is what customers pay for. BGP's attributes and filters express those business rules.
  • Separate administration. Each AS controls its own routing policy. BGP does not require neighbours to share a complete internal topology. A received announcement still needs filtering and validation; an AS path is not proof that the advertised route is legitimate.

Does this network need BGP?

Does this network need BGP?
Does this network need BGP?Situation; Usually enough. One ISP, addresses from the ISP: A static default route; no BGP Two ISPs, addresses from each, outbound failover: Tracked default routes and a suitable NAT design may be enough; existing sessions may break Two ISPs and the organisation's own address block: eBGP to both, with a public ASN Connecting to a cloud provider over a private link: eBGP, usually with a private ASN (AWS Direct Connect and Azure ExpressRoute both use BGP) Large campus or data centre fabric, SD-WAN, MPLS VPN: BGP inside the organisation as wellSituationUsually enoughOne ISP, addresses from theISPA static default route; no BGPTwo ISPs, addresses fromeach, outbound failoverTracked default routes and a suitable NAT design may be enough; existingsessions may breakTwo ISPs and theorganisation's own addressblockeBGP to both, with a public ASNConnecting to a cloudprovider over a privatelinkeBGP, usually with a private ASN (AWS Direct Connect and AzureExpressRoute both use BGP)Large campus or data centrefabric, SD-WAN, MPLS VPNBGP inside the organisation as well

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Each item on the left, with what it means on the right.

In practice, many enterprises run BGP today without ever touching the public internet table: towards a cloud provider, an MPLS provider or inside an SD-WAN. The protocol is the same; only the scale and the policy differ.

Does this network need BGP?
Does this network need BGP?The number of exits and ownership of address space decide whether BGP is needed.How many exits?One ISPA default route is enoughBGP adds work, no gainTwo ISPsBGP or tracked staticroutes. BGP gives per-prefixchoice and policyOwn addresses and ASBGP is how otherslearn your prefixes(provider-independent)

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Most single-ISP sites need only a default route.

If static routes and floating static routes are unfamiliar, the CCNA floating static routes lesson covers the no-BGP option.

The trade-off: control adds responsibility

BGP gives you control over accepted and announced routes. It also gives you more ways to make a mistake. A wrong outbound filter can announce routes your company should not carry. A missing inbound limit can accept far more routes than the router was sized for. Start with explicit permitted prefixes and the smallest route set your design needs, rather than requesting a full internet table by habit.

What BGP gives and what it asks of you
What BGP gives and what it asks of youControl over exits and advertisements comes with responsibility for filters and monitoring.Control gainedChoose the exit per prefixInfluence inbound trafficAdvertise only what you ownResponsibilityFilter what you send andaccept, never become transitWatch the table and logswith

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Every control also creates a way to make a mistake that other networks can see.

A short reading lab

Use an existing Cisco IOS or IOS XE BGP lab with the course AS numbers. These are privileged EXEC checks, not a complete BGP configuration. No router is started by this page.

show ip bgp summary show ip bgp 198.51.100.0 255.255.255.0 show ip route 198.51.100.10

On a provider-side lab router: check the company peer, inspect its prefix and AS path, then check which route forwards packets for the company service.

  1. In the summary, find the company neighbour and its AS. A prefix count in the final column means the session is established; a state name such as Active means it is not.
  2. Read the AS path from the nearest AS towards the originating AS. On ISP A, the directly learned company path is 64500. On the remote AS through ISP A, it is 64501 64500.
  3. Compare the BGP entry with the IP route. Learning a route, selecting it in BGP and installing it for forwarding are separate checks.

Technical references: BGP-4, RFC 4271, the IANA ASN registry and Cisco's BGP troubleshooting guide. The examples are written for teaching, not captured from a running router.

Test yourself on autonomous systems

Predict · scenario 1

A router in AS 64500 receives a route with AS path 64502 64500 64510. What does it do?

Predict · scenario 2

Which AS number is private?

Predict · scenario 3

A branch has one internet connection and uses the provider's addresses. What does it need to reach the internet?

Predict · scenario 4

What does BGP compare first when OSPF would compare total cost?

FAQ

Do I need a public AS number to run BGP?
BGP itself does not require a public ASN. Private ASNs can be used in a lab or in an agreed customer-provider design. An independently identified AS on the public internet needs a globally unique public ASN. Assignment requirements depend on the regional registry; having two providers is not a rule built into BGP.
Is BGP a distance-vector or a link-state protocol?
BGP is normally described as path-vector, a form of distance-vector routing that carries AS-path information rather than a simple hop-count metric. OSPF instead shares link-state information to build a topology map. BGP uses route attributes and local policy when choosing a path.
Why does BGP converge so slowly compared with OSPF?
Detection timers, policy, alternate paths and the number of networks that must receive an update all affect recovery. Cisco IOS commonly defaults to a 180-second hold time, but a directly detected link failure can remove a path earlier. BGP is not required to wait three minutes for every failure.