PacketLab
Protocols/BGP/Advanced BGP Features
BGP · Advanced BGP Features

Allow AS In

Allow a bounded occurrence of the local AS on a customer edge in a shared-AS VPN.

Two sites share one customer AS

CE1/R1 and CE2/R5 both use AS65015, connected through PE1/R2, P/R3 and PE2/R4 in the provider AS65024. The provider carries customer routes in VRF CUSTOMER over VPNv4; LDP and OSPF resolve the PE loopbacks. This complete baseline needs an image supporting MPLS L3VPN.

Lab topologyPhysical links
.1 / .2.5 / .6.9 / .10.13 / .14R1CE1 · AS 65015R2PE1 · AS 65024R3P · OSPF/LDPR4PE2 · AS 65024R5CE2 · AS 65015
Solid lines are physical links. Endpoint labels are the last octets of 192.0.2.x/30, first router then second router in the address table. Loopback0 is 10.255.0.N/32 on RN. Logical BGP peers are listed in the configurations.
LinkEndpoints /30
R1–R2GigabitEthernet1 192.0.2.1 / GigabitEthernet1 192.0.2.2
R2–R3GigabitEthernet2 192.0.2.5 / GigabitEthernet1 192.0.2.6
R3–R4GigabitEthernet2 192.0.2.9 / GigabitEthernet1 192.0.2.10
R4–R5GigabitEthernet2 192.0.2.13 / GigabitEthernet1 192.0.2.14
Complete baseline configurations

R1

hostname R1
ip cef
interface Loopback0
 ip address 10.255.0.1 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.1 255.255.255.252
 no shutdown
exit
router bgp 65015
 bgp router-id 10.255.0.1
 neighbor 192.0.2.2 remote-as 65024
 address-family ipv4 unicast
  neighbor 192.0.2.2 activate
  network 10.255.0.1 mask 255.255.255.255
 exit-address-family
end

R2

hostname R2
ip cef
ip vrf CUSTOMER
 rd 65024:100
 route-target both 65024:100
exit
interface Loopback0
 ip address 10.255.0.2 255.255.255.255
exit
interface GigabitEthernet1
 ip vrf forwarding CUSTOMER
 ip address 192.0.2.2 255.255.255.252
 no shutdown
exit
interface GigabitEthernet2
 ip address 192.0.2.5 255.255.255.252
 no shutdown
 mpls ip
exit
mpls label protocol ldp
mpls ldp router-id Loopback0 force
router ospf 1
 router-id 10.255.0.2
 network 10.255.0.2 0.0.0.0 area 0
 passive-interface Loopback0
 network 192.0.2.5 0.0.0.0 area 0
exit
router bgp 65024
 bgp router-id 10.255.0.2
 no bgp default ipv4-unicast
 neighbor 10.255.0.4 remote-as 65024
 neighbor 10.255.0.4 update-source Loopback0
 address-family vpnv4
  neighbor 10.255.0.4 activate
  neighbor 10.255.0.4 send-community extended
 exit-address-family
 address-family ipv4 vrf CUSTOMER
  neighbor 192.0.2.1 remote-as 65015
  neighbor 192.0.2.1 activate
 exit-address-family
end

R3

hostname R3
ip cef
interface Loopback0
 ip address 10.255.0.3 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.6 255.255.255.252
 no shutdown
 mpls ip
exit
interface GigabitEthernet2
 ip address 192.0.2.9 255.255.255.252
 no shutdown
 mpls ip
exit
mpls label protocol ldp
mpls ldp router-id Loopback0 force
router ospf 1
 router-id 10.255.0.3
 network 10.255.0.3 0.0.0.0 area 0
 passive-interface Loopback0
 network 192.0.2.6 0.0.0.0 area 0
 network 192.0.2.9 0.0.0.0 area 0
exit
end

R4

hostname R4
ip cef
ip vrf CUSTOMER
 rd 65024:100
 route-target both 65024:100
exit
interface Loopback0
 ip address 10.255.0.4 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.10 255.255.255.252
 no shutdown
 mpls ip
exit
interface GigabitEthernet2
 ip vrf forwarding CUSTOMER
 ip address 192.0.2.13 255.255.255.252
 no shutdown
exit
mpls label protocol ldp
mpls ldp router-id Loopback0 force
router ospf 1
 router-id 10.255.0.4
 network 10.255.0.4 0.0.0.0 area 0
 passive-interface Loopback0
 network 192.0.2.10 0.0.0.0 area 0
exit
router bgp 65024
 bgp router-id 10.255.0.4
 no bgp default ipv4-unicast
 neighbor 10.255.0.2 remote-as 65024
 neighbor 10.255.0.2 update-source Loopback0
 address-family vpnv4
  neighbor 10.255.0.2 activate
  neighbor 10.255.0.2 send-community extended
 exit-address-family
 address-family ipv4 vrf CUSTOMER
  neighbor 192.0.2.14 remote-as 65015
  neighbor 192.0.2.14 activate
 exit-address-family
end

R5

hostname R5
ip cef
interface Loopback0
 ip address 10.255.0.5 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.14 255.255.255.252
 no shutdown
exit
router bgp 65015
 bgp router-id 10.255.0.5
 neighbor 192.0.2.13 remote-as 65024
 address-family ipv4 unicast
  neighbor 192.0.2.13 activate
  network 10.255.0.5 mask 255.255.255.255
 exit-address-family
end

Open plain-text configurations

Outputs are illustrative, not recorded router results. Each lab starts from its own baseline. Configuration and feature support vary by image and release; platform-specific examples identify their prerequisites.

Locate the AS-loop rejection

R4# show ip bgp vpnv4 vrf CUSTOMER 10.255.0.1/32
BGP routing table entry for 65024:100:10.255.0.1/32
  65015
    10.255.0.2 from 10.255.0.2
      Origin IGP, localpref 100, valid, internal, best
R5# show ip bgp 10.255.0.1/32
% Network not in table

PE2 has the remote route, but its export toward CE2 would contain 65024 65015. CE2’s ordinary loop check rejects its own 65015. Confirm the route target, VPN path and transport labels before attributing a missing customer route solely to AS-loop detection.

Apply the narrowly scoped change

CE2 / R5

router bgp 65015
 address-family ipv4 unicast
  neighbor 192.0.2.13 allowas-in 1
 exit-address-family

CE1 / R1

router bgp 65015
 address-family ipv4 unicast
  neighbor 192.0.2.2 allowas-in 1
 exit-address-family

The CE permits up to one occurrence of its local AS in routes from that specific PE. Configure both sites for bidirectional reachability. The AS path itself is unchanged.

Verify the remote route and return path

R5# show ip bgp
     Network          Next Hop        Metric LocPrf Weight Path
*>   10.255.0.1/32    192.0.2.13           0             0 65024 65015 i
R5# ping 10.255.0.1 source 10.255.0.5
Success rate is 100 percent (5/5)

A successful return path requires the corresponding policy at the other site as well. The CE-to-PE next hop is directly connected; the provider still needs working VPN and transport labels to forward the packet.

Preserve loop protection elsewhere

Both solutions deliberately alter ordinary AS-loop handling. Keep the change specific to the affected customer/session, retain prefix filters, and consider site-of-origin controls for multi-homed VPN sites. Do not combine allowas-in and AS override merely because both are available; choose the behavior the design needs. Neither feature repairs a missing route target or broken label-switched path.

Restore the rejection experiment

R5

router bgp 65015
 address-family ipv4 unicast
  no neighbor 192.0.2.13 allowas-in
 exit-address-family

R1

router bgp 65015
 address-family ipv4 unicast
  no neighbor 192.0.2.2 allowas-in
 exit-address-family

Re-evaluate the affected routes after removal. The saved baseline intentionally lacks the exception, so the remote same-AS route is again rejected. Use a scoped VPN-family outbound refresh on each PE or a CE inbound refresh supported by the image; do not reset every provider session.

Key Takeaways

  • Repeated customer ASNs can trigger legitimate AS-loop rejection.
  • Confirm VPN transport and route-target import before changing loop policy.
  • Allowas-in accepts a bounded occurrence without rewriting the path.
  • AS override rewrites the customer ASN on PE export.
  • Bidirectional reachability requires matching treatment at both sites.

Allow AS In Quiz

Six questions · four options each · select one answer per question. Submit all answers to see your score and explanations.

1. Why does the unmodified CE reject the remote prefix?
2. Where is allowas-in applied in this example?
3. Where is AS override applied?
4. Does allowas-in itself rewrite AS_PATH?
5. What path does the one-occurrence override example show on CE2?
6. Will either feature fix a missing VPN route-target import?
Protocol and command references

AS-path loop handling · BGP/MPLS VPN architecture · Router-symbol attribution.

← Route Refresh CapabilityAS Override →