Wrong/Unknown Remote AS Number

Lately I got asked how to find the remote AS number for a BPG peering, especially if you do not have access to that remote router. In real life I’d say you should know which AS’ you peer with but in the Lab it might be a question to find out the remote AS.

I first thought off using a debug command but the command debug ip bgp all did not do the trick, it does not show any AS number in its output. In reality the solution is even simpler. Every time BGP tries to create the peering and notices that the configured AS is wrong, you’ll get a message like this:

*Jul 27 18:40:55.494: %BGP-3-NOTIFICATION: sent to neighbor 116.1.13.3 2/2 (peer in wrong AS) 2 bytes 012C FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF 002D 0104 012C 00B4 7401 0D03 1002 0601 0400 0100 0102 0280 0002 0202 00

At least if you have logging active at the line you are logged in to (console/vty x). And the nice part is, this message shows everything you need to know the remote AS and change your configuration. To get this message I simply configured the following scenario:

The Backbone router knows the correct AS of R1, but I did not so I just configured any AS (in this case AS11) as remote-as:

router bgp 1
no synchronization
bgp log-neighbor-changes
neighbor 116.1.13.3 remote-as 11

Now after some time the above message appears and we have our remote AS. Just simply change the bold part from hex into decimal and you’ll have the correct remote AS:

*Jul 27 18:40:55.494: %BGP-3-NOTIFICATION: sent to neighbor 116.1.13.3 2/2 (peer in wrong AS) 2 bytes 012C

And here you go 012C in hex equals 300 in decimal.

So to solve this problem just configure any AS and wait for the message 🙂

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s