LAB 10 / 20

BGP Confederation — Sub-AS Architecture

BGP ConfederationSub-ASEBGP within ASAS-Path

Active Nodes

10 BGP CONFEDERATION Confederation — Active: CORE-1,CORE-2,CORE-3,CORE-4 See master topology for full 20-router diagram Active Nodes: CORE-1,CORE-2,CORE-3,CORE-4 Confederation CORE-1,CORE-2,CORE-3,CORE-4 Refer to lab.html for complete step-by-step configuration and verification commands for each active router Active Zone Inactive (dimmed) Ioannis (John) Alexander Konstas

Active routers: CORE-1, CORE-2, CORE-3, CORE-4, EDGE-1, EDGE-4, BORDER-1, BORDER-2

Key Concepts

BGP Confederation Architecture

Confederation divides the AS (65000) into multiple sub-ASs. Routers within a sub-AS use iBGP. Between sub-ASs, they use a special form of eBGP that behaves like iBGP for NEXT_HOP, LOCAL_PREF, and MED attributes — unlike regular eBGP. The confederation sub-AS numbers are stripped from the AS-path before advertising to external neighbors, so the confederation structure remains hidden to the outside world. In this lab: sub-AS 65010 = CORE-1/2, sub-AS 65020 = CORE-3/4, sub-AS 65030 = EDGE routers.

Confederation AS-Path

Within the confederation, AS-path carries both regular AS numbers and confederation sub-AS numbers in parentheses: e.g., "65001 (65030 65010)". The sub-AS components in parentheses are stripped when advertising outside the confederation, so external peers see only "65001 65000". BGP loop prevention still works within the confederation — a router rejects routes containing its own sub-AS in the confederation segment of the AS-path.

Confederation vs Route Reflection

Confederation is more complex to configure but provides more autonomous routing domains within a single AS. Each sub-AS can have its own routing policies. In practice, large ISPs often combine both: route reflectors within each sub-AS, and confederation between sub-ASs. For the CCIE exam, know how to configure, verify, and troubleshoot confederation AS-path manipulation and attribute behavior across sub-AS boundaries.

Confederation Configuration

CORE-1Sub-AS 65010 — Confederation BGP
router bgp 65010
 bgp confederation identifier 65000
 bgp confederation peers 65020 65030
 bgp router-id 10.255.1.1
 !
 neighbor 10.255.1.2 remote-as 65010
 neighbor 10.255.1.2 update-source Loopback0
 !
 neighbor 10.255.1.3 remote-as 65020
 neighbor 10.255.1.3 update-source Loopback0
 neighbor 10.255.1.3 ebgp-multihop 2
 !
 address-family vpnv4
  neighbor 10.255.1.2 activate
  neighbor 10.255.1.2 send-community extended
  neighbor 10.255.1.3 activate
  neighbor 10.255.1.3 send-community extended

Verification

show ip bgp summary
Expected: Confederation peers listed. State shows Established. AS-number in "AS" column shows sub-AS number for confederation peers.
show ip bgp 10.255.6.1/32
Expected: AS-path shows confederation segments in parentheses: e.g., "(65030 65010)". This is normal — not an error.
show ip bgp neighbors 10.255.1.3 advertised-routes
Expected: Routes advertised to sub-AS 65020 neighbor carry confederation AS-path segments. MED and LOCAL_PREF preserved.

Research and direction by Ioannis (John) Konstas; compiled and finalized with AI assistance.

Initial Configs — Load These First
⬇ CORE-1-initial.cfg ⬇ CORE-2-initial.cfg ⬇ CORE-3-initial.cfg ⬇ CORE-4-initial.cfg