Technical Tip: Using BGP local-AS configuration to replace a private ASN in the AS_PATH of IPv6 locally originated routes

Description

This article describes how to prevent a private ASN from being advertised in the IPv6 BGP AS_PATH when FortiGate advertises locally originated routes to an external BGP neighbor.

Scope

FortiGate.

Solution

The AS_PATH manipulation behavior differs between routes learned from a BGP neighbor and routes originated locally by the FortiGate. For locally originated routes, using route-map AS_PATH replacement can prevent the routes from being advertised. The article Technical Tip: How to use 'remove-private-as' and 'set-aspath-action replace' to hide private AS in advertised BGP routes describes the use of 'remove-private-as' and 'set-aspath-action replace' to remove or replace private AS numbers in BGP routes learned from one BGP neighbour before they are advertised to another BGP neighbor.

The following example demonstrates a FortiGate advertising a locally generated IPv6 prefix to an external BGP neighbor.

• The FortiGate is advertising the following IPv6 prefix: '2001:db8:100:10::/64'.

• The advertised AS_PATH contains '64496 65010'.

FortiGate [Advertising-Router]:

config router bgp
    set as 65010
    set ebgp-multipath enable
        config neighbor
            edit "2001::3"
                set remote-as 64486
                set local-as 64496
            next
        end
        config network6
            edit 1
                set prefix6 2001:db8:100:10::/64
            next
        end
    end

config system interface
    edit "vlan1005"
        set vdom "root"
            config ipv6
                set ip6-address 2001:db8:100:10::1/64 
                set ip6-allowaccess ping
            end
        set interface "port1"
        set vlanid 1005
    next
end

FortiGate [Receiving-Router]:

get router info6 bgp neighbors 2001::2 received-routes

VRF 0 BGP table version is 1, local router ID is 203.0.113.3
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network                 Next Hop                Metric  LocPrf Weight RouteTag Path
*> 2001:db8:100:10::/64  2001::2(fe80::9:fff:fe00:104)  0   0 64496 65010 i <0/0>

Total number of prefixes 1

• The requirement is to advertise only the public ASN: '64496'

• The private ASN '65010' must not be included in the advertised AS_PATH

Recommended configuration on local FortiGate:

For locally originated routes, use the BGP 'local-as' feature instead of route-map 'AS_PATH' replacement. Configure the 'local-as-replace-as' parameters on the BGP neighbor.

FortiGate [Advertising-Router]:

config router bgp
    set as 65010
    set ebgp-multipath enable
        config neighbor
            edit "2001::3"
                set remote-as 64486
                set local-as 64496
                set local-as-replace-as enable
            next
        end
        config network6
            edit 1
                set prefix6 2001:db8:100:10::/64
            next
        end

'set local-as-replace-as enable': Replaces the 'Router AS number' with the configured 'local AS' number in outgoing BGP updates. Default setting: 'Disable'.

Verifying the results on the receiving end FortiGate:

FortiGate [Receiving-Router]:

get router info6 bgp neighbors 2001::2 received-routes
VRF 0 BGP table version is 1, local router ID is 203.0.113.3
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric     LocPrf Weight RouteTag Path
*> 2001:db8:100:10::/64 2001::2(fe80::9:fff:fe00:104)  0        0 64496 i <0/0>

Total number of prefixes 1

get router info6 routing-table bgp
Routing table for VRF=0
B       2001:db8:100:10::/64 [20/0] via fe80::9:fff:fe00:104, port3, 00:26:07, [1024/0]

get router info6 bgp network 
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,             S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete
VRF 0 BGP table version is 1, local router ID is 203.0.113.3
   Network          Next Hop            Metric     LocPrf Weight RouteTag Path
*> 2001:db8:100:10::/64 2001::2(fe80::9:fff:fe00:104) 0  0  0 64486 64496 i <0/1>

Total number of prefixes 1