Public ASN vs Private ASN internally

[Steven Williams]

I am moving to BGP internally in my network core. I have an internet assigned ASN so my question is do people use their Public ASN internally so minimize the eBGP peering with their internet edge?

[Seth Beauchamp]

We use our public ASN internally, have not had any issues doing that.

[Steven Williams]

So even through your core network and or Datacenter you are using public ASN? So iBGP for your internal network and the only eBGP is from your CE to PE?

[Seth Beauchamp]

Yep, that's correct.

[Steven Williams]

And this is perfectly acceptable? I just assume if your RFC1918 networks were accidentally learned via your PE they would just drop. So I assume you run route-maps to make sure when your edge peering you are only advertising your public space.

[Seth Beauchamp · Accepted solution]

Yep, outbound advertisements are tightly controlled to allow only our public space.

[Steven Williams]

Ok good to know. Thanks for the advice/feedback.

[Steven Williams]

So working with my lab I have noticed that route reflectors are going to come into place with iBGP obviously. But I think I am going to need a few route reflectors here.

The following diagram BGP will be ran at Core-sw-01 and 02, PA-FW-01 and 02, and Edge-ASA-01 and 02.

So with me using the public ASN all the way to the ISP01 router My route reflectors would have to be the palo alto Fw and how does it work north of the Edge firewalls if I am using my public ASN and my ISP routers are my CEs running also my public ASN? So now I have iBGP running though from the Core-sw-01 and 02 all the way to the CE routers. All iBGP peers need to be directly connected to the route reflectors correct? So in this case the CEs would not be. So am I better running private ASN from Core-sw-01 and 02 all the way to Edge ASAs then eBGP from ASAs to ISP CEs?

[Steven Williams]

ASAs do not support RR or Communities so looks like I need to use a private ASN to the edge then ASAs and CEs peer eBGP.