BGP · Advanced BGP Features

Aggregate AS-SET

Understand historical AS-SET aggregation and build a modern summary with deliberate origin and export policy.

Separate historical behavior from current standards

An AS_SET is an unordered set of AS numbers that contributed to an aggregate. Older aggregation examples used it to preserve contributor information for loop detection. RFC 9774, published in 2025, prohibits AS_SET and AS_CONFED_SET use by default: compliant speakers do not advertise them and treat received routes containing them as withdrawn unless explicitly configured for a transition. Keep this topic for interpreting old labs, not as a new deployment recipe.

Two component prefixes and an external receiver

R2 and R3 advertise adjacent /25s to R1. R1 can summarize them as 198.51.100.0/24 toward R4. Each component must exist in BGP; a network statement or aggregate cannot invent end-to-end reachability.

Lab topologyPhysical links

Solid lines are physical links. Endpoint labels are the last octets of 192.0.2.x/30, first router then second router in the address table. Loopback0 is 10.255.0.N/32 on RN. Logical BGP peers are listed in the configurations.

Link	First endpoint	Second endpoint
R1–R2	GigabitEthernet1 192.0.2.1/30	GigabitEthernet1 192.0.2.2/30
R1–R3	GigabitEthernet2 192.0.2.5/30	GigabitEthernet1 192.0.2.6/30
R1–R4	GigabitEthernet3 192.0.2.9/30	GigabitEthernet1 192.0.2.10/30

Complete baseline configurations

R1

hostname R1
ip cef
interface Loopback0
 ip address 10.255.0.1 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.1 255.255.255.252
 no shutdown
exit
interface GigabitEthernet2
 ip address 192.0.2.5 255.255.255.252
 no shutdown
exit
interface GigabitEthernet3
 ip address 192.0.2.9 255.255.255.252
 no shutdown
exit
router bgp 65001
 bgp router-id 10.255.0.1
 no bgp default ipv4-unicast
 neighbor 192.0.2.2 remote-as 65002
 neighbor 192.0.2.6 remote-as 65003
 neighbor 192.0.2.10 remote-as 65004
 address-family ipv4 unicast
  no auto-summary
  neighbor 192.0.2.2 activate
  neighbor 192.0.2.6 activate
  neighbor 192.0.2.10 activate
 exit-address-family
end

R2

hostname R2
ip cef
interface Loopback0
 ip address 10.255.0.2 255.255.255.255
exit
interface Loopback10
 ip address 198.51.100.1 255.255.255.128
exit
interface GigabitEthernet1
 ip address 192.0.2.2 255.255.255.252
 no shutdown
exit
router bgp 65002
 bgp router-id 10.255.0.2
 no bgp default ipv4-unicast
 neighbor 192.0.2.1 remote-as 65001
 address-family ipv4 unicast
  no auto-summary
  neighbor 192.0.2.1 activate
  network 198.51.100.0 mask 255.255.255.128
 exit-address-family
end

R3

hostname R3
ip cef
interface Loopback0
 ip address 10.255.0.3 255.255.255.255
exit
interface Loopback10
 ip address 198.51.100.129 255.255.255.128
exit
interface GigabitEthernet1
 ip address 192.0.2.6 255.255.255.252
 no shutdown
exit
router bgp 65003
 bgp router-id 10.255.0.3
 no bgp default ipv4-unicast
 neighbor 192.0.2.5 remote-as 65001
 address-family ipv4 unicast
  no auto-summary
  neighbor 192.0.2.5 activate
  network 198.51.100.128 mask 255.255.255.128
 exit-address-family
end

R4

hostname R4
ip cef
interface Loopback0
 ip address 10.255.0.4 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.10 255.255.255.252
 no shutdown
exit
router bgp 65004
 bgp router-id 10.255.0.4
 no bgp default ipv4-unicast
 neighbor 192.0.2.9 remote-as 65001
 address-family ipv4 unicast
  no auto-summary
  neighbor 192.0.2.9 activate
 exit-address-family
end

Open plain-text configurations

Outputs are illustrative, not recorded router results. Each lab starts from its own baseline. Configuration and feature support vary by image and release; platform-specific examples identify their prerequisites.

R4# show ip bgp
     Network          Next Hop        Metric LocPrf Weight Path
*>   198.51.100.0/25  192.0.2.9            0             0 65001 65002 i
*>   198.51.100.128/25
                      192.0.2.9            0             0 65001 65003 i

Create a summary without an AS_SET

router bgp 65001
 address-family ipv4 unicast
  aggregate-address 198.51.100.0 255.255.255.0 summary-only
 exit-address-family

R1# clear ip bgp 192.0.2.10 soft out

R4# show ip bgp
     Network          Next Hop        Metric LocPrf Weight Path
*>   198.51.100.0/24  192.0.2.9            0             0 65001 i

Summary-only suppresses component advertisements while the aggregate is active. Contributing specifics remain available locally. An aggregate discard route prevents traffic to an uncovered part of the summary from looping through a less-specific route. The aggregate may remain while only one component exists, so check what reachability is actually available.

Interpret the historical set

Older software could use the following syntax in an isolated legacy exercise. It is shown for recognition and is not the recommended configuration for the current baseline.

aggregate-address 198.51.100.0 255.255.255.0 summary-only as-set

Historical external path	Interpretation
65001 {65002,65003}	65001 is the aggregator; the braces contain unordered contributors.
65001	Summary without the contributor set; origin/export policy must avoid sending it back unsafely.

An unordered set is not an ordinary sequence, so do not interpret its order as a transit path. Modern origin validation does not consider such a route Valid.

Protect contributors and validate the summary

The aggregator should not send a summary back to its contributing ASes when doing so could create a loop or attract traffic for unavailable destinations. Replace the summary-only aggregate with an ordinary aggregate so components are eligible for export again, then use neighbor filters to send only component routes toward R2/R3 and only the summary toward R4. A prefix-list permit alone does not undo global suppression.

ip prefix-list SUMMARY seq 5 permit 198.51.100.0/24
ip prefix-list COMPONENTS seq 5 permit 198.51.100.0/24 ge 25 le 25

router bgp 65001
 address-family ipv4 unicast
  no aggregate-address 198.51.100.0 255.255.255.0
  aggregate-address 198.51.100.0 255.255.255.0
  neighbor 192.0.2.2 prefix-list COMPONENTS out
  neighbor 192.0.2.6 prefix-list COMPONENTS out
  neighbor 192.0.2.10 prefix-list SUMMARY out
 exit-address-family

R1# clear ip bgp 192.0.2.2 soft out
R1# clear ip bgp 192.0.2.6 soft out
R1# clear ip bgp 192.0.2.10 soft out

R2# show ip bgp
     Network          Next Hop        Metric LocPrf Weight Path
*>   198.51.100.128/25
                      192.0.2.1            0             0 65001 65003 i

R3# show ip bgp
     Network          Next Hop        Metric LocPrf Weight Path
*>   198.51.100.0/25  192.0.2.5            0             0 65001 65002 i

R2 receives R3’s component and R3 receives R2’s component; normal AS-loop checks prevent each contributor from accepting its own route back. Neither receives the summary, while R4 receives only the /24. The externally authorized aggregate origin must match the selected aggregation policy and its ROA.

Restore the component-only baseline

router bgp 65001
 address-family ipv4 unicast
  no aggregate-address 198.51.100.0 255.255.255.0
  no neighbor 192.0.2.2 prefix-list COMPONENTS out
  no neighbor 192.0.2.6 prefix-list COMPONENTS out
  no neighbor 192.0.2.10 prefix-list SUMMARY out
 exit-address-family

R1# clear ip bgp 192.0.2.10 soft out

R4# show ip bgp
     Network          Next Hop        Metric LocPrf Weight Path
*>   198.51.100.0/25  192.0.2.9            0             0 65001 65002 i
*>   198.51.100.128/25
                      192.0.2.9            0             0 65001 65003 i

Key Takeaways

AS_SET is an unordered contributor set, not a transit sequence.
RFC 9774 deprecates its advertisement and requires default treat-as-withdraw handling.
A summary can be originated without an AS_SET.
Summary-only suppresses component advertisements, not necessarily local routes.
Contributor filtering and origin authorization remain necessary.

Protocol and command references

AS_SET deprecation · BGP aggregation · Router-symbol attribution.

← AS Override Multipath eBGP and iBGP →