Filtering Bogon ASNs

Bogon ASN filtering

Original publication: http://as2914.net/bogon_asns/configuration_examples.txt

Purpose

Private or Reserved ASNs have no place in the public DFZ. Barring these from the DFZ helps improve accountability and dampen accidental exposure of internal routing artifacts.

All modern devices support 4-byte ASNs. Any occurrence of “23456” in the DFZ is a either a misconfiguration or software issue.

Rejecting all EBGP routes which contain a Bogon ASN anywhere in the AS_PATH is a form of Fail-fast.

Configuration Examples

Junos

policy-options {
    as-path-group bogon-asns {
        /* RFC7607 */
        as-path zero ".* 0 .*";
        /* RFC4893 AS_TRANS */
        as-path as_trans ".* 23456 .*";
        /* RFC5398 and documentation/example ASNs */
        as-path examples1 ".* [64496-64511] .*";
        as-path examples2 ".* [65536-65551] .*";
        /* RFC6996 Private ASNs */
        as-path reserved1 ".* [64512-65534] .*";
        as-path reserved2 ".* [4200000000-4294967294] .*";
        /* RFC7300 Last 16 and 32 bit ASNs */
        as-path last16 ".* 65535 .*";
        as-path last32 ".* 4294967295 .*";
        /* IANA reserved ASNs */
        as-path iana-reserved ".* [65552-131071] .*";
    }
    policy-statement import_from_ebgp {
        term bogon-asns {
            from as-path-group bogon-asns;
            then reject;
        }
        term .....
    }
}

IOS-XR

as-path-set bogon-asns
  # RFC7607
  ios-regex '_0_',
  # 2 to 4 byte ASN migrations
  passes-through '23456',
  # RFC5398
  passes-through '[64496..64511]',
  passes-through '[65536..65551]',
  # RFC6996
  passes-through '[64512..65534]',
  passes-through '[4200000000..4294967294]',
  # RFC7300
  passes-through '65535',
  passes-through '4294967295',
  # IANA reserved
  passes-through '[65552..131071]'
end-set

route-policy import_from_ebgp
  if as-path in bogon-asns then
    drop
  else
    ......
  endif
end-policy

BIRD

define BOGON_ASNS = [
  0,                      # RFC 7607
  23456,                  # RFC 4893 AS_TRANS
  64496..64511,           # RFC 5398 and documentation/example ASNs
  64512..65534,           # RFC 6996 Private ASNs
  65535,                  # RFC 7300 Last 16 bit ASN
  65536..65551,           # RFC 5398 and documentation/example ASNs
  65552..131071,          # RFC IANA reserved ASNs
  4200000000..4294967294, # RFC 6996 Private ASNs
  4294967295 ];           # RFC 7300 Last 32 bit ASN

function reject_bogon_asns()
int set bogon_asns;
{
  bogon_asns = BOGON_ASNS;

  if ( bgp_path ~ bogon_asns ) then {
    print "Reject: bogon AS_PATH: ", net, " ", bgp_path;
    reject;
  }
}

...

filter transit_in {
  reject_invalids();
  reject_bogon_asns();
  reject_bogon_prefixes();
  reject_long_aspaths();
  reject_small_prefixes();
  reject_default_route();

...

  honor_graceful_shutdown();
  accept;
}

filter ixp_in {
  reject_invalids();
  reject_bogon_asns();
  reject_bogon_prefixes();
  reject_long_aspaths();
  reject_transit_paths();
  reject_small_prefixes();
  reject_default_route();

...

  honor_graceful_shutdown();
  accept;
}


Nokia SR OS

bgp
    error-handling
        # RFC 7607 AS 0
        update-fault-tolerance
    exit
exit

policy-options
    begin
    as-path-group "bogon-asns"
        # RFC4893 AS_TRANS
        entry 10 expression ".* 23456 .*"
        # RFC5398 and documentation/example ASNs
        entry 15 expression ".* [64496-64511] .*"
        entry 20 expression ".* [65536-65551] .*"
        # RFC6996 private ASNs
        entry 25 expression ".* [64512-65534] .*"
        entry 30 expression ".* [4200000000-4294967294] .*"
        # RFC7300 last 16-bit and 32-bit ASNs
        entry 35 expression ".* 65535 .*"
        entry 40 expression ".* 4294967295 .*"
        # IANA reserved ASNs
        entry 45 expression ".* [65552-131071] .*"
    exit
    policy-statement "import_from_ebgp"
        entry 10
            from
                as-path-group "bogon-asns"
            exit
            action reject
        exit
    exit
    commit
exit

OpenBGPD

Copied from openbsd examples

deny from any AS 23456                          # AS_TRANS
deny from any AS 64496 - 64511                  # Reserved for use in docs and code RFC5398
deny from any AS 64512 - 65534                  # Reserved for Private Use RFC6996
deny from any AS 65535                          # Reserved RFC7300
deny from any AS 65536 - 65551                  # Reserved for use in docs and code RFC5398
deny from any AS 65552 - 131071                 # Reserved
deny from any AS 4200000000 - 4294967294        # Reserved for Private Use RFC6996
deny from any AS 4294967295                     # Reserved RFC7300

FRR (vtysh)

bgp as-path access-list bogon-asns deny 23456
bgp as-path access-list bogon-asns deny 64496-131071
bgp as-path access-list bogon-asns deny 4200000000-4294967295

Mikrotik

This is not recommanded. Mikrotik will take a very very long time to process all those routes and has some issues with BGP.

/routing filter add chain=GENERIC_PREFIX_LIST bgp-as-path="_0_" protocol=bgp action=discard comment="RFC 7607"
/routing filter add chain=GENERIC_PREFIX_LIST bgp-as-path="_23456_" protocol=bgp action=discard comment="RFC 4893 AS_TRANS"
/routing filter add chain=GENERIC_PREFIX_LIST bgp-as-path="_(6449[6-9])_|_(6450[0-9])_|_(6451[0-1])_|_(6553[6-9])_|_(6554[0-9])_|_(6555[0-1])_" protocol=bgp action=discard comment="RFC 5398 and documentation/example ASNs"
/routing filter add chain=GENERIC_PREFIX_LIST bgp-as-path="_6(4(5(1[2-9]|[2-9][0-9])|[6-9][0-9][0-9])|5([0-4][0-9][0-9]|5([0-2][0-9]|3[0-5])))_" protocol=bgp action=discard comment="RFC 6996 Private ASNs"
/routing filter add chain=GENERIC_PREFIX_LIST bgp-as-path="_6555[2-9]_|_655[6-9][0-9]_|_65[6-9][0-9][0-9]_|_6[6-9][0-9][0-9][0-9]_" protocol=bgp action=discard comment="RFC IANA reserved ASNs"
/routing filter add chain=GENERIC_PREFIX_LIST bgp-as-path="_[7-9][0-9][0-9][0-9][0-9]_|_1[0-2][0-9][0-9][0-9][0-9]_|_130[0-9][0-9][0-9]_" protocol=bgp action=discard comment="RFC IANA reserved ASNs"
/routing filter add chain=GENERIC_PREFIX_LIST bgp-as-path="_1310[0-6][0-9]_|_13107[0-1]_" protocol=bgp action=discard comment="RFC IANA reserved ASNs"
/routing filter add chain=GENERIC_PREFIX_LIST bgp-as-path="_42[0-8][0-9][0-9][0-9][0-9][0-9][0-9][0-9]_" protocol=bgp action=discard comment="RFC 6996 Private ASNs"
/routing filter add chain=GENERIC_PREFIX_LIST bgp-as-path="_(429[0-3][0-9][0-9][0-9][0-9][0-9][0-9])_|_(4294[0-8][0-9][0-9][0-9][0-9][0-9])_" protocol=bgp action=discard comment="RFC 6996 Private ASNs"
/routing filter add chain=GENERIC_PREFIX_LIST bgp-as-path="_(42949[0-5][0-9][0-9][0-9][0-9])_|_(429496[0-6][0-9][0-9][0-9])_" protocol=bgp action=discard comment="RFC 6996 Private ASNs"
/routing filter add chain=GENERIC_PREFIX_LIST bgp-as-path="_(4294967[0-1][0-9][0-9])_|_(42949672[0-8][0-9])_|_(429496729[0-4])_" protocol=bgp action=discard comment="RFC 6996 Private ASNs"

Arista

ip as-path regex-mode asn

ip as-path access-list bogon-asns permit _0_ any
ip as-path access-list bogon-asns permit _23456_ any
ip as-path access-list bogon-asns permit _[64496-64511]_ any
ip as-path access-list bogon-asns permit _[65536-65551]_ any
ip as-path access-list bogon-asns permit _[64512-65534]_ any
ip as-path access-list bogon-asns permit _[4200000000-4294967294]_ any
ip as-path access-list bogon-asns permit _65535_ any
ip as-path access-list bogon-asns permit _4294967295_ any
ip as-path access-list bogon-asns permit _[65552-131071]_ any

route-map Import-Peer deny 7
   match as-path bogon-asns
!