no bgp enforce-first-as on Cisco Router

[mahesh18]

Hi Everyone,

Our Internet router is connected to ISP and running BGP.

Need to know what does below command do?

 no bgp enforce-first-as

Regards

Mahesh

[Reza Sharifi · Accepted solution]

Hi Mahesh,

By default, Cisco routers deny any updates recived from an eBGP peer that does not list the AS number in the path of an incoming update.  So, "no bgp enforce-first-as" will diable that.

Here is more info from the command reference guide:

http://www.cisco.com/c/en/us/td/docs/ios/iproute_bgp/command/reference/irg_book/irg_bgp1.html#wp1114079

HTH

Reza

[Masoud Pourshabanian · Accepted solution]

Hello,

BGP peers list their AS number as the first segment in the AS_PATH attribute. Under BGP command you specify a neighbour and its AS number. As an example,

"Neighbor 192.8.7.9 remote-as 64352".

If you apply "bgp enforce-first-as", BGP checks the updates from 192.8.7.9 to make sure AS number 64352 is listed in AS_PATH attribte.

Enabling this command prevents a misconfigured or unauthorized peer from misdirecting traffic.

You will disable this feature If you apply "no bgp enforce-first-as".

Hope it helps,

Masoud

[dudus20122]

@Masoud Pourshabanian but how. I am thinking this concept is now invalid where you have to peer with IXP - Internet Exchange Point. IXPs peers with ISPs, CDNs, and SPs suing route servers. and route servers, do not include their ASs in the BGP paths. So, leaving "bgp enforce-first-as" check in place would impact the experience of such provider. 

[mahesh18]

Many thanks Reza.

Regards

Mahesh