Snippet: BGP as a non-transit AS

In the example below we have three BGP autonomous systems (AS1, AS2 and AS3) each with one router in it.

In this example assume that AS3 is a customer of AS1 and AS2 and is multihoming their connection with the two upstream providers for redundancy if one of the providers was to fail.

In its default configuration BGP will re-advertise any routes advertised into the AS to all other peers, this means that if route x.x.x.x/24 was advertised to AS3 from AS2 then AS3 would advertise that route back out to AS1, this in most cases is a bad idea as your network could operate as a transit as (AS1 would use you to reach AS2) which could cause an increase in bandwidth use/costs.

In most cases you only want traffic destined for your network entering your network.

Luckily BGP offers a couple of really simple ways to stop your AS becoming a transit as:

AS-path filtering #

Using this method applied to a neighbour statement will filter all advertisements that are not local advertisements before sending them to peer 1.1.1.1 (router R1’s loopback).

The regex statement used (^$) will allow all networks that have an empty AS-path in them, which would only include the networks that have originated from your AS.

router bgp 3
?neighbor 1.1.1.1 filter-list 1 out
!
ip as-path access-list 1 permit ^$

BGP Communities #

Another method would be to use BGP communities. There is a well-known BGP community which is called ‘no-export’ which when set will stop that route from being advertised to any external peer.

This method is useful as you set the community on the route as it comes into your AS, so effectively you only mark them once and then the networks will not be advertised to any of your other peers.

router bgp 3
 neighbor 2.2.2.2 route-map non_transit in

!
route-map non_transit permit 10
 set community no-export additive