Remove Private AS Numbers

Private customer and provider boundary

R1 uses private AS65001. R2 and R3 use documentation ASNs 64496 and 64497 as stand-ins for allocated provider ASNs in this isolated lab. R2 receives the customer path and exports it to R3.

hostname R1
ip cef
interface Loopback0
 ip address 10.255.0.1 255.255.255.255
exit
interface Loopback10
 ip address 198.51.100.1 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.1 255.255.255.252
 no shutdown
exit
router bgp 65001
 bgp router-id 10.255.0.1
 no bgp default ipv4-unicast
 neighbor 192.0.2.2 remote-as 64496
 address-family ipv4 unicast
  no auto-summary
  neighbor 192.0.2.2 activate
  network 198.51.100.1 mask 255.255.255.255
 exit-address-family
end

hostname R2
ip cef
interface Loopback0
 ip address 10.255.0.2 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.2 255.255.255.252
 no shutdown
exit
interface GigabitEthernet2
 ip address 192.0.2.5 255.255.255.252
 no shutdown
exit
router bgp 64496
 bgp router-id 10.255.0.2
 no bgp default ipv4-unicast
 neighbor 192.0.2.1 remote-as 65001
 neighbor 192.0.2.6 remote-as 64497
 address-family ipv4 unicast
  no auto-summary
  neighbor 192.0.2.1 activate
  neighbor 192.0.2.6 activate
 exit-address-family
end

hostname R3
ip cef
interface Loopback0
 ip address 10.255.0.3 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.6 255.255.255.252
 no shutdown
exit
router bgp 64497
 bgp router-id 10.255.0.3
 no bgp default ipv4-unicast
 neighbor 192.0.2.5 remote-as 64496
 address-family ipv4 unicast
  no auto-summary
  neighbor 192.0.2.5 activate
 exit-address-family
end

R3# show ip bgp
     Network          Next Hop        Metric LocPrf Weight Path
*>   198.51.100.1/32  192.0.2.5            0             0 64496 65001 i

Remove an all-private received path

router bgp 64496
 address-family ipv4 unicast
  neighbor 192.0.2.6 remove-private-as
 exit-address-family

R2# clear ip bgp 192.0.2.6 soft out

R3# show ip bgp
     Network          Next Hop        Metric LocPrf Weight Path
*>   198.51.100.1/32  192.0.2.5            0             0 64496 i

R2 removes the private AS from its export and adds its normal local-AS prepend. R2’s own received entry still contains 65001. The command is an outbound transformation, not a rewrite of every local path.

Handle a mixed path explicitly

The plain historical form can leave a path unchanged when public/non-private and private ASNs are mixed. In a constructed received path 64498 65001 65002, the all keyword removes private tokens even though a non-private token is present.

router bgp 64496
 address-family ipv4 unicast
  neighbor 192.0.2.6 remove-private-as all
 exit-address-family

These mixed-path rows illustrate transformation semantics; the two additional origin ASes are not part of the three-router baseline. Verify exceptions involving the neighbor’s own ASN and confederation segments on the target release.

Replace removed ASNs when required

router bgp 64496
 address-family ipv4 unicast
  neighbor 192.0.2.6 remove-private-as all replace-as
 exit-address-family

R2# clear ip bgp 192.0.2.6 soft out

R3# show ip bgp
     Network          Next Hop        Metric LocPrf Weight Path
*>   198.51.100.1/32  192.0.2.5            0             0 64496 64496 i

One replacement of 65001 plus the normal local prepend yields two copies of 64496. For the mixed example, the export would be 64496 64498 64496 64496. Replacement preserves the length contribution of removed tokens, which can affect remote path selection.

Restore and check origin policy

router bgp 64496
 address-family ipv4 unicast
  no neighbor 192.0.2.6 remove-private-as
 exit-address-family

R2# clear ip bgp 192.0.2.6 soft out

R3# show ip bgp
     Network          Next Hop        Metric LocPrf Weight Path
*>   198.51.100.1/32  192.0.2.5            0             0 64496 65001 i

This restores the lab’s intentionally unsanitized export. In a real public deployment, keep the intended private-AS removal policy and ensure prefix authorization/ROAs reflect the resulting externally visible origin. AS removal is not prefix-ownership validation.