Replace private AS path but keep the prepending

[Yosefw]

Hi i have kind of an unusual situation where i need to replace private asn to public asn but keep the asn prepend.

I have 3 FortiGate firewalls, FG11. FG2, and FG3.

I have a BGP between FG1 and FG2, and between FG1 and FG3.

fg1 asn is set to 1111 (Public ASN example)
fg2 asn is set to  64512 (Private ASN)
fg3 asn is set to 3333 (Public ASN example)

I have set as prepend on FG2 so now the advertisements include ASN 64512 64512 64512 64512.

I would like to manipulate the bgp settings so when FG1 re-advertise to FG3 a network learned from FG2 it would replace the asn so FG3 will see asn 1111 multiple times. how can i do it?

What i did so far is creating aspath-list:
config router aspath-list
edit "as-fg2"
config rule
edit 1
set action permit
set regexp "64512"

And then i have created a route map:
config router route-map
edit "ASPATH-REPLACE"
config rule
edit 1
set match-as-path "as-fg2"
set set-aspath-action replace
set set-aspath "1111"

I have assigned the route map to BGP peering towards FG3 (set route-map-out "ASPATH-REPLACE")


Before applying the route map i was able to see the AS prepending on FG3
*> 172.16.2.0/24 10.0.1.1 0 0 1111 64512 65412 65412 65412 i <-/->

After applying the route map:
*> 172.16.2.0/24 10.0.1.1 0 0 1111 1111 i <-/->

Desired result:
*> 172.16.2.0/24 10.0.1.1 0 0 1111 1111 1111 1111 1111 i <-/->

[Toshi_Esumi]

Perhaps you're looking for the behavior of "as-override" option.
https://community.fortinet.com/t5/FortiGate/Technical-Tip-BGP-allowas-in-enable-or-as-override-when-...
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Replace-as-path-chain-in-BGP-advertisement...

However I have more fundamental questions what you're trying to do.
1) if BGP peerings are only between your three FGTs, why do you need public ASNs? Do you have to peer with your ISPs as well?
2) The topology is hub(fg1) and spoke(fg2 and fg3) and no redundant paths. Then, why do you need to prepend?

Toshi

[Yosefw]

hi @Toshi_Esumi thank you for your reply, i will give it a try.

This is in a lab environment. Essentially AWS would not honor AS prepending if the ASN is private. so i'm going to set public ASN in one location and prepend the private ASN but i want that AWS will see the prepending as public ASN 

[Yosefw]

I'm still unable to dynamically replace the private ASN.

The idea is that my customer (FG2) will be able to prepend as many private ASN they would like and that my FG (FG1) will replace the private ASN with public ASN based on the amount of Private ASN received from FG2.

Any suggestion?

[Toshi_Esumi]

I tested with 7.0.14. But the "as-override" doesn't seem to override actually. I recommend you open a ticket at TAC to get looked at. It could be a bug because there is not much to be misconfigured unless the KB I referred to is missing something necessary for this to work.

Toshi

[Toshi_Esumi]

Or, the "override" might happen ONLY when it sees the conflict of AS on both sides like in the example in the KB, 65001 1111 65001.

[Toshi_Esumi · Accepted solution]

Yup. I was correct. I set up the same as on both sides with AS=64512, then the override happened.
[before]

FortiGate-70F # get router info bgp neighbors 10.10.1.2 received-routes
VRF 0 BGP table version is 1, local router ID is 10.10.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight RouteTag Path
*> 10.10.11.0/30 10.10.1.2 0 0 1111 64512 64512 64512 64512 ? < -/->
*> 10.253.240.0/20 10.10.1.2 0 0 1111 64512 64512 64512 64512 ? < -/->
*> 192.168.1.0 10.10.1.2 0 0 1111 64512 64512 64512 64512 ? < -/->

[after]

FortiGate-70F # get router info bgp network
VRF 0 BGP table version is 1, local router ID is 10.10.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight RouteTag Path
*> 10.10.11.0/30 10.10.1.2 0 0 0 1111 1111 1111 1111 1111 ? <-/1>
*> 10.253.240.0/20 10.10.1.2 0 0 0 1111 1111 1111 1111 1111 ? <-/1>
*> 192.168.1.0 10.10.1.2 0 0 0 1111 1111 1111 1111 1111 ? <-/1>

[Toshi_Esumi]

So, you probably need to do something like this to match the particular private AS and hide them.
https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-use-remove-private-as-and-set-aspat...

Toshi

[Toshi_Esumi]

Just be aware that you can't replace portions of entire as-pass received from the private AS neighbor with some prepended path and replace them per portion. It would replace the entire path with like "1111" you specified at your fg1. If it always come with "64512 64512 64512" and you want to replace them with "1111 1111 1111", you have to set like below:

config router route-map
  edit "replace64512to1111"
    config rule
      edit 1
        set match-as-path "match_64512"
        set set-aspath-action replace
        set set-aspath "1111 1111 1111"
      next
      edit 2
        set match-as-path "match_rest"
      next
    end
  next
end

Toshi

[Yosefw]

@Toshi_Esumi thank you so much!
I was able to get to work using the following settings:
FG1:

FortiGate-VM64-KVM # config router bgp

FortiGate-VM64-KVM (bgp) # show
config router bgp
set as 1111
set router-id 10.0.1.1
set graceful-restart enable
config neighbor
edit "10.0.1.2"
set advertisement-interval 1
set bfd enable
set soft-reconfiguration enable
set remote-as 3333
set keep-alive-timer 1
set holdtime-timer 3
next
edit "10.0.0.2"
set advertisement-interval 1
set allowas-in-enable enable
set bfd enable
set soft-reconfiguration enable
set remote-as 64514
set local-as 64512
set route-map-in "FROM-FG2"
set keep-alive-timer 1
set holdtime-timer 3
next
end
config redistribute "connected"
set status enable

On FG2:

config router route-map
edit "PREPEND"
config rule
edit 1
set set-aspath "1111 1111 1111"
next

config router bgp
set as 64514
set graceful-restart enable
config neighbor
edit "10.0.0.1"
set advertisement-interval 1
set bfd enable
set soft-reconfiguration enable
set remote-as 64512
set route-map-out "PREPEND"
set keep-alive-timer 1
set holdtime-timer 3
next
end
config network
edit 1
set prefix 172.16.2.0 255.255.255.0
next

on FG3 i can now see the following:

FortiGate-VM64-KVM # get router info bgp neighbors 10.0.1.1 received-routes
VRF 0 BGP table version is 1, local router ID is 172.16.3.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight RouteTag Path
*> 10.0.0.0/30 10.0.1.1 0 0 1111 ? <-/->
*> 10.0.1.0/30 10.0.1.1 0 0 1111 ? <-/->
*> 172.16.1.0/24 10.0.1.1 0 0 1111 ? <-/->
*> 172.16.2.0/24 10.0.1.1 0 0 1111 64512 64514 1111 1111 1111 i <-/->