Advanced BGP features: MP-BGP, private AS removal, allowas-in, AS override, aggregation, dampening and backdoors

Multiprotocol BGP (MP-BGP)

The original BGP-4 carried only IPv4 unicast routes. Multiprotocol extensions (RFC 4760) add address families, so one protocol, and often one session, can carry IPv6 unicast, IPv4 multicast, MPLS VPN routes (VPNv4 and VPNv6), EVPN and more. Each neighbour must be activated per address family. A session over IPv4 can carry IPv6 routes, but the next hop must then be an IPv6 address, so many networks run separate IPv4 and IPv6 sessions to keep things simple.

router bgp 64500
 no bgp default ipv4-unicast
 neighbor 2001:db8:ffff::1 remote-as 64510
 address-family ipv6 unicast
  network 2001:db8:4400::/48
  neighbor 2001:db8:ffff::1 activate

no bgp default ipv4-unicast stops IOS automatically activating every neighbour for IPv4, which keeps multi-family configurations clear.

Private and 4-byte AS numbers

Customers often peer with their provider using a private ASN. Before the provider passes those routes to the internet, it strips the private ASN with neighbor x remove-private-as. 4-byte ASNs work with older 2-byte-only routers through a placeholder, AS_TRANS (23456): the old router sees 23456 in the AS path, while the real 4-byte path travels in an extra attribute.

Sites that share an ASN: allowas-in and as-override

A company with several branch offices connected through a provider's MPLS VPN might use the same private ASN, say 65010, at every site. When branch A's route reaches branch B, its AS path contains 65010, and branch B rejects it as a loop. Two fixes exist:

• allowas-in on the customer router: accept routes containing my own ASN, up to a set number of times.
• as-override on the provider router: replace the customer's ASN in the path with the provider's own ASN before sending it to the next site.

Both disable a loop check, so take care where a site also has a backdoor link between branches.

Aggregation and AS_SET

aggregate-address creates a summary when at least one more specific route exists. By default the summary has an empty AS path from your AS and the ATOMIC_AGGREGATE attribute, which hides the original paths. Adding as-set includes all the contributing ASNs as an unordered set so that loop detection still works. RFC 6472 now recommends against using AS_SET in new designs, partly because it complicates origin validation with RPKI, so prefer advertising summaries you originate yourself.

Dampening and backdoor routes

Route flap dampening gives a route a penalty each time it flaps (on Cisco, 1000 per flap). Above the suppress limit the route is not advertised until the penalty decays below the reuse limit, halving every half-life (15 minutes by default). Early aggressive settings suppressed good routes for too long; RFC 7196 recommends much higher suppress thresholds, and many networks leave dampening off.

Backdoor routes solve a different problem. Two sites learn each other's networks over eBGP through a provider (AD 20) and also over a private link through OSPF (AD 110). The eBGP path wins, so traffic goes the long way. network 10.20.0.0 mask 255.255.0.0 backdoor gives that eBGP route an AD of 200, so the IGP route over the private link is used.

Real-world example: a retail chain moved twelve stores to a provider's MPLS VPN, with every store router using private ASN 65010 and eBGP to the provider. After the cut-over, stores could reach head office but not each other. show ip bgp on a store router showed none of the other stores' routes: each was rejected because its AS path already contained 65010. The provider enabled as-override on its edge routers, store-to-store traffic started flowing, and the chain's engineers documented the reason for future changes.