Private and Public AS Numbers

Why AS identity matters

R1 and R3 intentionally use the same AS in this isolated example. R2 can accept R1’s route, but a normal R3 rejects an advertisement containing its own AS. This is why unrelated publicly routed networks need appropriate unique identities.

hostname R1
ip cef
interface Loopback0
 ip address 10.255.0.1 255.255.255.255
exit
interface Loopback10
 ip address 198.51.100.1 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.1 255.255.255.252
 no shutdown
exit
router bgp 65001
 bgp router-id 10.255.0.1
 no bgp default ipv4-unicast
 neighbor 192.0.2.2 remote-as 65002
 address-family ipv4 unicast
  no auto-summary
  neighbor 192.0.2.2 activate
  network 198.51.100.1 mask 255.255.255.255
 exit-address-family
end

hostname R2
ip cef
interface Loopback0
 ip address 10.255.0.2 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.2 255.255.255.252
 no shutdown
exit
interface GigabitEthernet2
 ip address 192.0.2.5 255.255.255.252
 no shutdown
exit
router bgp 65002
 bgp router-id 10.255.0.2
 no bgp default ipv4-unicast
 neighbor 192.0.2.1 remote-as 65001
 neighbor 192.0.2.6 remote-as 65001
 address-family ipv4 unicast
  no auto-summary
  neighbor 192.0.2.1 activate
  neighbor 192.0.2.6 activate
 exit-address-family
end

hostname R3
ip cef
interface Loopback0
 ip address 10.255.0.3 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.6 255.255.255.252
 no shutdown
exit
router bgp 65001
 bgp router-id 10.255.0.3
 no bgp default ipv4-unicast
 neighbor 192.0.2.5 remote-as 65002
 address-family ipv4 unicast
  no auto-summary
  neighbor 192.0.2.5 activate
 exit-address-family
end

R2# show ip bgp
     Network          Next Hop        Metric LocPrf Weight Path
*>   198.51.100.1/32  192.0.2.1            0             0 65001 i

R3# show ip bgp 198.51.100.1/32
% Network not in table

Read the reserved ranges

A number being outside the private ranges does not mean you may use it on the Internet. Check its actual assignment in the registry. Public AS15169 is an example assigned to Google; an operator must use its own authorized allocation.

Use a private ASN inside an agreed boundary

Private AS numbers can be reused in independent networks and inside confederations. A single-homed customer may use one by agreement with its provider, which then removes or replaces private AS information at the public export boundary. This modifies a control-plane path; it does not translate packets or require NAT-style per-flow mappings.

Distinguish width from uniqueness

Four-byte AS capability expands the identifier space but does not change the basic loop check. Private four-byte ASNs are still private. Documentation ASNs are reserved for examples, not allocated public identities. When changing an ASN, plan peer expectations, policies, communities and route-origin authorizations together.

Audit before deployment

Check the local and remote AS in the neighbor configuration, the received AS path, and the IANA/RIR assignment. In this lab, make R3 a distinct ASN only as a separate test: update both ends of the R2–R3 session consistently. Using allowas-in instead changes loop acceptance and belongs to a different lesson.