Skip to content

Enforcing the First AS in BGP AS_PATHs#

NANOG 98 digest Program Core pick 19–21 October 2026

Abstract Slides Recording

Bryton Herdes – Cloudflare

Play the recording: Enforcing the First AS in BGP AS_PATHs

  • Why: The hijack class neither ROV nor ASPA catches — stripping/padding enough of the path that the origin and provider attestations look fine — and the fix is a single, existing config knob. Ten minutes, immediately actionable.
  • What: Forged AS_PATHs where the adjacent peer's AS doesn't match the first AS in the path defeat both ROV and ASPA. An active test (advertised a prefix with a forged first AS, e.g. as-path-prepend 402542 ahead of localAS 13335) found half of Tier-1 networks not enforcing First AS. Vendor defaults are the culprit: JunOS/JunOS EVO, Nokia SR OS, Extreme SLX-OS, RouterOS, and BIRD ship with enforcement OFF by default; Cisco IOS XE/XR, Arista EOS, Huawei, OpenBGPD, and FRR ship ON.
  • How: Reject routes where peerAS != firstAS on eBGP neighbors, with documented exceptions (transparent IX route servers, iBGP, deliberate anycast probe cases). Per-implementation config knobs are listed in the deck.
  • Where applicable: Universal — any eBGP edge; check your configs, especially if your vendor defaults insecurely.