Before two routers can run BGP together, they need identities. Not usernames and passwords, though those exist too. What BGP actually cares about is the autonomous system number. That ASN is the foundation of how BGP figures out where routes came from, whether they’re legitimate, and how to prevent loops.
If you’ve glossed over ASNs before, this is the post that fixes that.
What an Autonomous System Actually Is
An autonomous system is a network or collection of networks under a single administrative control that presents a common routing policy to the internet. Your company’s entire network, managed by your team, operating under your routing policies. That’s an autonomous system.
The AS is the unit of routing at the BGP level. BGP doesn’t care about the individual routers inside your AS. It cares about what routes your AS is advertising to the world and what attributes those routes carry.
The ASN is the number that uniquely identifies your autonomous system. When you establish a BGP session, one of the first things exchanged is the AS number. eBGP sessions require different AS numbers on each side. iBGP sessions require the same AS number on both sides. That single rule is how BGP knows whether it’s looking at an internal or external peer.
The Original ASN Range: 2-Byte
The original BGP ASN space was 16-bit, which gives you a range of 1 through 65535. That’s 65,535, as defined, possible autonomous system numbers.
IANA manages ASN allocation through regional internet registries (RIRs) like ARIN, RIPE, APNIC, and others. Public ASNs were handed out to organizations that needed to connect to the internet with unique identities. For a long time this worked fine.
Then the internet got bigger and we started running out of public ASN space. Same story as IPv4 addresses, just with a smaller number to start with.
The reserved ranges in the 2-byte space:
- 1 to 64511: Public ASNs. Need to be registered with a RIR. Routable on the public internet.
- 64512 to 65534: Private ASNs. Same concept as RFC 1918 private IP space. Use these inside your network without registering anything. Should be stripped before advertising to the public internet.
- 65535: Reserved.
Private ASNs are what most enterprise networks use for internal BGP or for peering with service providers when the enterprise doesn’t have its own public ASN. Your ISP assigns you a private ASN, you run BGP between your edge and their edge, and they strip the private ASN before passing routes further into the internet.
The Move to 4-Byte ASNs
RFC 4893 introduced 4-byte ASNs in 2007 and they became the standard with RFC 6793 in 2012. The total possible ASNs expanded from roughly 65,000 to over four billion. Over four billion possible autonomous system numbers. That should hold us for a while.
The 2-byte private ASN range (64512-65534) still exists and still works. The 4-byte space adds a new private range: 4200000000 to 4294967294.
Here’s where notation gets interesting. There are two ways to write 4-byte ASNs.
ASplain notation writes the full number as a single integer. ASN 65546, for example. Simple, unambiguous, and the default on most modern platforms.
ASdot notation splits the 4-byte number into two 16-bit values separated by a period. The number 65546 becomes 1.10 in ASdot (because 65546 = 1*65536 + 10). Some organizations and engineers prefer this format because it’s cleaner looking, but it caused real interoperability headaches when 4-byte ASNs were first being adopted because different vendors implemented ASdot differently.
On Cisco IOS-XE and most modern platforms, both notations are accepted. Just know which one your team is using and stick to it, because mixing notations in documentation is a great way to confuse whoever’s on call at 3am.
All of this ASN structure comes into play the moment two routers try to establish a session.
BGP’s OPEN Message and ASN Exchange
When a BGP session initializes, the routers exchange OPEN messages. The OPEN message contains the sender’s AS number along with the BGP version, hold time and router ID.
If you’re configuring a 2-byte ASN session between old gear, this works as expected. But when a 4-byte ASN router peers with a router that only understands 2-byte ASNs, there’s a compatibility mechanism. The 4-byte router uses AS 23456 (AS_TRANS) as a placeholder in the standard OPEN message fields and passes the actual 4-byte number in a separate optional capability field. Old gear doesn’t understand the capability field, but at least the session comes up.
This is mostly historical at this point. Virtually all current-generation equipment handles 4-byte ASNs natively. But if you’re ever peering with something ancient and seeing AS 23456 show up in your BGP table, now you know why.
Where ASNs Matter Beyond the Session
ASNs show up in two critical places beyond just identifying BGP peers.
The AS_PATH attribute. Every time a BGP route crosses an AS boundary via eBGP, the originating AS number is prepended to the AS_PATH. When you receive a route and look at its AS_PATH, you’re seeing the exact list of autonomous systems that route has traveled through, from right to left. The rightmost AS in the path is where the route originated. The leftmost is the most recent AS that handled it.
AS_PATH is also BGP’s primary loop prevention mechanism. When a BGP router receives an update, it checks whether its own AS number appears in the AS_PATH. If it does, the route is discarded. The router assumes it’s seeing its own advertisement looping back.
AS path prepending. You can artificially inflate the AS_PATH by prepending your own AS number multiple times when advertising routes. This makes your path look longer, which makes it look less preferred in BGP’s path selection algorithm. It’s a technique for influencing which ISP gets your inbound traffic by making one path look artificially worse than another.
Getting Your Own ASN
If you’re an enterprise that needs a public ASN for genuine internet connectivity, you apply through your regional internet registry. ARIN handles North America. RIPE handles Europe. APNIC handles Asia-Pacific. The others cover the remaining regions.
You’ll need to justify the need. Single-homed organizations with a single ISP generally won’t qualify for a public ASN because there’s no routing policy to differentiate. Multi-homed organizations with multiple ISPs have a valid use case.
If you’re building a lab or doing internal BGP work without internet connectivity, use a private ASN. Pick something in 64512-65534 or the 4-byte private range (4200000000-4294967294) and don’t overthink it.