Replace private AS path but keep the prepending

Yosefw · ‎05-07-2024

Hi i have kind of an unusual situation where i need to replace private asn to public asn but keep the asn prepend.

I have 3 FortiGate firewalls, FG11. FG2, and FG3.

I have a BGP between FG1 and FG2, and between FG1 and FG3.

fg1 asn is set to 1111 (Public ASN example)
fg2 asn is set to 64512 (Private ASN)
fg3 asn is set to 3333 (Public ASN example)

I have set as prepend on FG2 so now the advertisements include ASN 64512 64512 64512 64512.

I would like to manipulate the bgp settings so when FG1 re-advertise to FG3 a network learned from FG2 it would replace the asn so FG3 will see asn 1111 multiple times. how can i do it?

What i did so far is creating aspath-list:
config router aspath-list
edit "as-fg2"
config rule
edit 1
set action permit
set regexp "64512"

And then i have created a route map:
config router route-map
edit "ASPATH-REPLACE"
config rule
edit 1
set match-as-path "as-fg2"
set set-aspath-action replace
set set-aspath "1111"

I have assigned the route map to BGP peering towards FG3 (set route-map-out "ASPATH-REPLACE")

Before applying the route map i was able to see the AS prepending on FG3
*> 172.16.2.0/24 10.0.1.1 0 0 1111 64512 65412 65412 65412 i <-/->

After applying the route map:
*> 172.16.2.0/24 10.0.1.1 0 0 1111 1111 i <-/->

Desired result:
*> 172.16.2.0/24 10.0.1.1 0 0 1111 1111 1111 1111 1111 i <-/->

Toshi_Esumi · ‎05-09-2024

Yup. I was correct. I set up the same as on both sides with AS=64512, then the override happened.
[before]

FortiGate-70F # get router info bgp neighbors 10.10.1.2 received-routes
VRF 0 BGP table version is 1, local router ID is 10.10.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight RouteTag Path
*> 10.10.11.0/30 10.10.1.2 0 0 1111 64512 64512 64512 64512 ? < -/->
*> 10.253.240.0/20 10.10.1.2 0 0 1111 64512 64512 64512 64512 ? < -/->
*> 192.168.1.0 10.10.1.2 0 0 1111 64512 64512 64512 64512 ? < -/->

[after]

FortiGate-70F # get router info bgp network
VRF 0 BGP table version is 1, local router ID is 10.10.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight RouteTag Path
*> 10.10.11.0/30 10.10.1.2 0 0 0 1111 1111 1111 1111 1111 ? <-/1>
*> 10.253.240.0/20 10.10.1.2 0 0 0 1111 1111 1111 1111 1111 ? <-/1>
*> 192.168.1.0 10.10.1.2 0 0 0 1111 1111 1111 1111 1111 ? <-/1>

View solution in original post

Toshi_Esumi · ‎05-10-2024

I thought you had to elimate/replace all private ASNs. It still have "64512 and 64514".
But it depending on your final or real network set up, which you didn't explain. So it might work depending on the real topology.

Toshi

Replace private AS path but keep the prepending

Nominate a Forum Post for Knowledge Article Creation