Autonomous System Confederations for BGP
obsoletes
- rfc-3065 — Autonomous System Confederations for BGP
updated by
- rfc-9774 — Deprecation of AS_SET and AS_CONFED_SET in BGP
Extracted elements (23)
BGP requires all IBGP speakers within a single AS to be fully meshed, requiring n*(n-1)/2 unique sessions for n speakers. Confederations address this scaling problem by subdividing a large AS into smaller Member-ASes that appear as a single AS externally, reducing intra-domain connection complexity to the inter-domain model.
LOCAL_PREF is permitted between confederation members (removing the restriction that applies to external peers) because confederation members share a common administration and LOCAL_PREF is a useful intra-confederation policy tool.
The AS Confederation Identifier hides internal topology from the public Internet — Member-AS numbers are visible only within the confederation, while the single Confederation Identifier is the externally advertised AS number. This allows internal restructuring without affecting external BGP policy or routing.
Any BGP speaker not supporting the AS_CONFED_SET and AS_CONFED_SEQUENCE extensions will generate a NOTIFICATION message with 'UPDATE Message Error' and sub-code 'Malformed AS_PATH'. All confederation participants MUST support confederations; external BGP speakers need not.
Confederations and route reflectors have been shown (RFC 3345) to cause permanent oscillation between candidate routes when using BGP tie-breaking rules. Care must be taken when selecting MED values and tie-breaking policy; one mitigation is configuring inter-Member-AS IGP metrics higher than intra-Member-AS IGP metrics.
When aggregation is performed within a confederation, AS_SET substitutes with AS_CONFED_SET and AS_SEQUENCE with AS_CONFED_SEQUENCE. Confederation-type segments (AS_CONFED_SET, AS_CONFED_SEQUENCE) MUST be kept separate from non-confederation segments (AS_SET, AS_SEQUENCE).
A BGP speaker MUST NOT transmit updates containing AS_CONFED_SET or AS_CONFED_SEQUENCE attributes to peers that are not members of the local confederation.
A BGP speaker receiving an AS_PATH attribute containing its own AS Confederation Identifier or an AS_CONFED_SEQUENCE/AS_CONFED_SET containing its own Member-AS Number SHALL treat the path as if it contained its own AS number (loop detection).
A member of a BGP confederation MUST use its Member-AS Number in all transactions with peers that are members of the same confederation as the local BGP speaker.
A route learned from a peer in the same confederation (not necessarily the same Member-AS) SHALL be treated as 'internal' when applying IBGP vs EBGP preference rules in path selection.
All BGP speakers participating as members of a confederation MUST recognize the AS_CONFED_SET and AS_CONFED_SEQUENCE segment type extensions to the AS_PATH attribute.
If a BGP speaker receives an UPDATE with AS_CONFED_SEQUENCE or AS_CONFED_SET segments from a neighbor not in the same confederation, it SHALL treat the message as having a malformed AS_PATH per BGP-4 Section 6.3 UPDATE Message Error Handling.
It is an error for a BGP speaker to receive an UPDATE from a confederation peer not in the same Member-AS where AS_CONFED_SEQUENCE is not the first segment; such messages SHALL be treated as having a malformed AS_PATH.
MEDs of two routes SHOULD only be compared if the first autonomous systems in the first AS_SEQUENCE in both routes are the same, skipping AS_CONFED_SET and AS_CONFED_SEQUENCE entries.
Path selection criteria for information received from members inside a confederation MUST follow the same rules used for information received from members inside the same autonomous system, as specified in BGP-4.
The restriction against sending the LOCAL_PREF attribute to peers in a neighboring autonomous system is removed for confederation peers — LOCAL_PREF may be sent to peers within the same confederation.
When advertising to a BGP speaker in the same Member-AS, the advertising speaker SHALL NOT modify the AS_PATH attribute associated with the route.
When advertising to a confederation peer in a neighboring Member-AS, the speaker prepends its own Member-AS Number to an AS_CONFED_SEQUENCE segment. If prepending would overflow 255 ASes, it SHOULD prepend a new AS_CONFED_SEQUENCE segment.
When advertising to an external (non-confederation) peer, all AS_CONFED_SEQUENCE and AS_CONFED_SET path segments MUST be removed from the AS_PATH attribute before prepending the AS Confederation Identifier.
When comparing routes using AS_PATH length, CONFED_SEQUENCE and CONFED_SETs SHOULD NOT be counted, ensuring internal confederation hops do not disadvantage routes.
AS_CONFED_SEQUENCE (type 3) is an ordered set of Member Autonomous Systems in the local confederation that the UPDATE message has traversed. AS_CONFED_SET (type 4) is an unordered set of Member Autonomous Systems in the local confederation that the UPDATE message has traversed.
This extension to BGP does not change the underlying security issues inherent in the existing BGP protocol, such as those described in RFC 2385 (TCP MD5 Signature) and RFC 4272 (BGP Security Vulnerabilities Analysis). No new security properties are introduced or removed.
AS_PATH segment type is a 1-octet field. This document adds type 3 (AS_CONFED_SEQUENCE) and type 4 (AS_CONFED_SET) to the existing types 1 (AS_SET) and 2 (AS_SEQUENCE) defined in BGP-4. Each segment is encoded as a triple: path segment type, path segment length, path segment value.