FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
sagha
Staff
Staff
Article Id 216780
Description This article describes the workaround for the issue on ForitGate when seeing 'Incorrect leftmost AS number' in BGP debugs
Scope FortiGate, FortiOS.
Solution

This issue will normally be seen when the BGP peering is not establishing. 

 

Enable BGP debugs: 

 

# diagnose ip router bgp all enable

  diagnose ip router bgp level info

  diagnose debug enable

 

The following would show up in debugs: 

 

BGP: 10.10.10.2-Outgoing [DECODE] Update: Starting UPDATE decoding... Bytes To Read (4005), msg_size (86)
BGP: 10.10.10.2-Outgoing [DECODE] Attr ASPATH: Incorrect leftmost AS number, should be 65001
BGP: 10.10.10.2-Outgoing [FSM] State: Established Event: 28
BGP: 10.10.10.2-Outgoing [ENCODE] Msg-Hdr: Type 3
BGP: %BGP-3-NOTIFICATION: sending to 10.10.10.2 3/11 (UPDATE Message Error/Malformed AS_PATH.) 13 data-bytes [40 02 0a 02 02 00 00 4f f9 00 00 f4 73]
id=20300 logdesc="BGP neighbor status changed" msg="BGP: %BGP-5-ADJCHANGE: VRF 0 neighbor 10.10.10.2 Down BGP Notification FSM-ERR"

 

Check on the BGP peer as to why FortiGate is receiving 'incorrect AS number' error. 

 

On FortiGate, a workaround would be to disable the command: 


# config router bgp
    set enforce-first-as disable
  end

 

When this setting is enabled, BGP does a comparison between remote AS number of BGP peer configured locally with first AS in the path of received routes.

Simply disabling this would resolve the issue. 

Contributors