Half of Tier 1 Networks Were Wide Open: Enforce First AS in BGP!

Hey there, it's Shii-chan! Today we're diving into something that quietly keeps the whole Internet on the rails: protecting BGP routing. It sounds low-key, but it really matters!

Cloudflare Blog blog.cloudflare.com

What was announced?

Cloudflare's Blog published a post called Enforcing the First AS in BGP AS PATHs. In short: if your router checks that the very first AS number in a route announcement is legit, you can block a big class of route hijacks.

The story so far

In BGP, every AS (network number) that passes a route along appends itself to the AS_PATH, a bit like package tracking. The leftmost entry is the AS that first advertised the route.

RFC 4271 Section 6.3 says the leftmost AS in the AS_PATH should equal the AS number of the peer that sent the message. But plenty of routers skip this check, and attackers love that. They craft a fake AS_PATH without their own ASN, impersonate a legit network, and hijack the route. Even RPKI-ROV and ASPA can't fully stop a forged announcement when the path information isn't there to begin with.

What changes

Turning on enforce-first-as makes the router verify that the first AS of a received route matches the peer that actually sent it. On a mismatch, the route is dropped using RFC 7606's treat-as-withdraw, so the BGP session stays up while the bad announcement gets rejected. That closes one door for hijackers and makes both your network and the wider Internet a little safer.

Dive Deep

The post shares a real hijack. It targeted 47.1.0.0/16 and 47.2.0.0/16 with a forged path of 199524 270118 17072 13335 36429. That slips Cloudflare's AS13335 in as if it were upstream of AS36429, but Cloudflare has zero adjacency with AS36429. The attacker hid their own ASN, advertised to Gcore (AS199524), and exploited the fact that AS199524 wasn't enforcing First AS.

Cloudflare also ran their own test: they advertised 162.159.82.0/24 with a foreign AS402542 prepended before their real AS13335, then watched which Tier 1 networks accepted it. The result:

Half of the Tier 1 networks are vulnerable to hijacks that violate the First AS rule.

Half of them! And most of the ones that let it through were running Juniper routers, which shows how vendor defaults turn straight into your security posture.

Enforce First AS by default: Cisco IOS/XE/XR, Arista EOS, Huawei, OpenBGPD, and FRR (since October 2023). Do not enforce by default: Junos, Nokia SR OS, Extreme SLX-OS, RouterOS, and BIRD.

There's one exception: IX route servers forward routes without appending their own AS, so sessions facing them need the check disabled. For every other EBGP session, turn it on.

Wrap-up

• First AS validation stops hijacks where the attacker hides their own ASN
• On a mismatch, only that route is dropped via treat-as-withdraw, and the session stays up
• Cisco, Arista, and Huawei enforce it by default; Junos, Nokia, and BIRD do not
• Cloudflare's test found half of Tier 1 networks weren't enforcing, many on Juniper gear
• Route-server sessions are the only exception; every other EBGP session should have it on

If you run a network, this is a setting worth flipping on today. Low-key, but it's a real step toward protecting the Internet for all of us!