By default, a FortiGate advertises BGP routes using the AS number configured globally under config router bgp. This global AS is the identity of the FortiGate for all BGP sessions.  However, in certain scenarios, such as company mergers, network migrations, or peering with a partner whose BGP configuration is locked and cannot be changed, the FortiGate may need to present a different AS number to a specific neighbor, without modifying its global AS configuration.  The local-as command under the BGP neighbor configuration allows FortiGate to present a different AS number on a per-neighbor basis. Two additional options, local-as-no-prepend and local-as-replace-as, control exactly how this AS appears in outbound advertisements and inbound received routes.  Topology. The following topology is used for this demonstration:
+-------------------+ +-------------------+ | FortiGate | | Remote Peer | | | | | | Global AS: 65100 | <------ eBGP -----> | Global AS: 65300 | | local-as: 65200 | | Expects AS: 65200 | | IP: 10.1.1.1 | | IP: 10.1.1.2 | +-------------------+ +-------------------+
The remote peer's BGP configuration is locked with remote-as 65200. It will only accept a BGP session from a router presenting itself as AS 65200. Since the FortiGate's real AS is 65100, the local-as feature is used to satisfy this requirement without changing the global AS.
Behavior 1: local-as alone (default).
When only local-as is configured, the fake AS (65200) is prepended in front of the real AS (65100) in outbound UPDATE messages. Both AS numbers are visible to the remote peer. Â config router bgp
set as 65100
set router-id 10.1.1.1
config neighbor
edit "10.1.1.2"
set remote-as 65300
set local-as 65200
set next-hop-self enable
set soft-reconfiguration enable
next
end
end
 Outbound: What the remote peer sees for routes advertised by FortiGate:  Network Next Hop AS-PATH
192.168.10.0/24 10.1.1.1 65200 65100
192.168.20.0/24 10.1.1.1 65200 65100
 Inbound: What FortiGate's BGP RIB shows for routes received from remote peer:  Network Next Hop AS-PATH
172.16.10.0/24 10.1.1.2 65200 65300
172.16.20.0/24 10.1.1.2 65200 65300
 The fake AS (65200) also appears in the AS-PATH of routes received from the remote peer inside FortiGate's RIB. While this does not affect route installation or functionality in a simple two-peer setup, it can cause routes to be dropped if FortiGate re-advertises them to a third eBGP neighbor that genuinely belongs to AS 65200; that neighbor will see its own AS already in the AS-PATH and reject the routes as a routing loop.
Behavior 2: local-as + local-as-no-prepend.
local-as-no-prepend solves the inbound problem. When the remote peer sends routes to FortiGate, the fake AS (65200) is stripped from the AS-PATH before the routes are stored in FortiGate's BGP RIB. The outbound direction is not affected.
config neighbor
edit "10.1.1.2"
set remote-as 65300
set local-as 65200
set local-as-no-prepend enable
set next-hop-self enable
set soft-reconfiguration enable
next
end
 Outbound: What the remote peer sees (unchanged):  Network Next Hop AS-PATH
192.168.10.0/24 10.1.1.1 65200 65100
192.168.20.0/24 10.1.1.1 65200 65100
 Inbound: FortiGate RIB (now clean):
Network Next Hop AS-PATH
172.16.10.0/24 10.1.1.2 65300 172.16.20.0/24 10.1.1.2 65300
 The FortiGate RIB is now clean. However, the remote peer still sees the real AS (65100) in outbound advertisements. To fully hide AS 65100, local-as-replace-as must also be configured.
Behavior 3: local-as + local-as-replace-as.
local-as-replace-as solves the outbound problem. Instead of advertising both the fake AS (65200) and the real AS (65100) in the AS-PATH, it substitutes the real AS (65100) entirely. The remote peer receives only 65200 in the AS-PATH — the real AS (65100) is completely hidden.
config neighbor
edit "10.1.1.2"
set remote-as 65300
set local-as 65200
set local-as-replace-as enable
set next-hop-self enable
set soft-reconfiguration enable
next
end
Outbound: What the remote peer sees:
Network Next Hop AS-PATH
192.168.10.0/24 10.1.1.1 65200
192.168.20.0/24 10.1.1.1 65200
 Inbound: FortiGate RIB (fake AS still present without no-prepend):  Network Next Hop AS-PATH
172.16.10.0/24 10.1.1.2 65200 65300
172.16.20.0/24 10.1.1.2 65200 65300
 Local-as-replace-as alone fixes the outbound direction but does not clean the inbound RIB. Both options should be combined for a fully clean result.
Behavior 4: local-as + local-as-no-prepend + local-as-replace-as (recommended).
This is the recommended combination when full AS impersonation is required. Both directions are clean, the remote peer has no visibility of the real AS (65100), and FortiGate's RIB contains no phantom AS entries. Â config router bgp
set as 65100
set router-id 10.1.1.1
config neighbor
edit "10.1.1.2"
set remote-as 65300
set local-as 65200
set local-as-no-prepend enable
set local-as-replace-as enable
set next-hop-self enable
set soft-reconfiguration enable
next
end
end
 Outbound: What the remote peer sees:  Network Next Hop AS-PATH
192.168.10.0/24 10.1.1.1 65200 removed
192.168.20.0/24 10.1.1.1 65200
 Inbound: FortiGate RIB:  Network Next Hop AS-PATH
172.16.10.0/24 10.1.1.2 65300 <- Fake AS stripped; only remote peer's real AS remains
172.16.20.0/24 10.1.1.2 65300
 Behavior summary.
The table below summarizes the effect of each configuration option on both directions:
Configuration Outbound (Remote Peer Sees) Inbound (FortiGate RIB)
----------------------------------------- ------------------------------------- ---------------------------
local-as only 65200 65100 (2 hops, real AS visible) 65200 65300 (fake AS present)
local-as + no-prepend 65200 65100 (2 hops, real AS visible) 65300 (no phantom AS)
local-as + replace-as 65200 (1 hop, real AS hidden) 65200 65300 (fake AS present)
local-as + no-prepend + replace-as 65200 (1 hop, real AS hidden) 65300 (no phantom AS)
 Notes: The global set as command is always required. The BGP process cannot start without it. local-as is a per-neighbor mask only and does not replace the need for a global AS. Local-as-no-prepend and local-as-replace-as have no effect unless local-as is also configured on the same neighbor. Local-as-replace-as is also required when the remote peer's AS happens to match the configured local-as value. Without it, the remote peer would see its own AS number already present in the outbound AS-PATH and reject the routes as a routing loop. It is not possible to configure local-as under a BGP neighbor-group. It must be configured individually per neighbor. This configuration is CLI only until FortiOS v7.0. From FortiOS v7.2.0 onwards, it is also available in the GUI under the BGP neighbor configuration.
| 
