# MPLS Layer 3 VPN BGP AS Override
**URL:** https://forum.networklessons.com/t/mpls-layer-3-vpn-bgp-as-override/1323
**Category:** Lessons Discussion
**Created:** [December 29, 2016, 8:40pm UTC](https://forum.networklessons.com/t/mpls-layer-3-vpn-bgp-as-override/1323 "2016-12-29T20:40:33Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [December 29, 2016, 8:40pm UTC](https://forum.networklessons.com/t/mpls-layer-3-vpn-bgp-as-override/1323/1 "2016-12-29T20:40:33Z")
This topic is to discuss the following lesson:
> **[MPLS Layer 3 VPN BGP AS Override](https://networklessons.com/bgp/mpls-layer-3-vpn-bgp-override)**
>
> BGP AS override allows us to change the AS number in outgoing BGP updates. You can use this in MPLS VPN scenarios where a customer is using the same AS.
---
### Author:  [@shannon.sariman](https://forum.networklessons.com/u/shannon.sariman)
#### Post date: [June 14, 2016, 7:25am UTC](https://forum.networklessons.com/t/mpls-layer-3-vpn-bgp-as-override/1323/2 "2016-06-14T07:25:51Z")
Hi Rene,
So I’ve learned so far that BGP Allow\_AS\_IN and BPG Override achieve a similar outcome when confronted with using same ASes for MPLS VPN customer sites that use eBGP for the last mile, but from different end points: CE vs PE. So my question is, is there an advantage/disadvantage using one over another? Or in what context would one method be preferred over another?
Rgds,
Shannon
---
### Author:  [@andrew](https://forum.networklessons.com/u/andrew)
#### Post date: [June 14, 2016, 6:10pm UTC](https://forum.networklessons.com/t/mpls-layer-3-vpn-bgp-as-override/1323/3 "2016-06-14T18:10:46Z")
Shannon,
This is a good question, and there is a lot going on behind the scene to answer it. As you know, AllowAS-In and AS-Override are both essentially tricks that can be used to deal with what would normally be considered a BGP looped route (since the ASN number will appear in the AS Path).
The important consideration is whether the BGP “loop” route will actually be filtered on the PE side or the CE side. AllowAS-In assumes the filtering is being done on the CE side, but in reality, most PEs would have already filtered the route before it got to the CE.
For example, in IOS-XR, the default behavior in this situation is different than the regular IOS. With IOS-XR, the PE would do the filtering because it is more efficient to do this. The logic is that the PE router knows what the CE’s ASN is, so why bother sending it a BGP router that it “knows” the CE will filter anyway?
For this reason, it is probably best to have the PE control this situation, and therefore, use AS-Override instead of AllowAS-In.
---
### Author:  [@shannon.sariman](https://forum.networklessons.com/u/shannon.sariman)
#### Post date: [June 15, 2016, 7:55am UTC](https://forum.networklessons.com/t/mpls-layer-3-vpn-bgp-as-override/1323/4 "2016-06-15T07:55:54Z")
Hi Andrew,
Awesome response & much appreciated! It’s clear now, thank you.
Rgds,
Shannon
---
### Author:  [@Zaman.rubd](https://forum.networklessons.com/u/Zaman.rubd)
#### Post date: [February 6, 2017, 12:47pm UTC](https://forum.networklessons.com/t/mpls-layer-3-vpn-bgp-as-override/1323/5 "2017-02-06T12:47:43Z")
Hi Rene,
Thanks for your nice article !
Is AS Override only support on MPLS environment ??
br//
zaman
---
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [February 8, 2017, 8:01am UTC](https://forum.networklessons.com/t/mpls-layer-3-vpn-bgp-as-override/1323/6 "2017-02-08T08:01:08Z")
Hi Zaman,
It is a BGP feature so it’s not only for MPLS. MPLS VPN however is one of those situations where this can be useful.
Rene
---
### Author:  [@Zaman.rubd](https://forum.networklessons.com/u/Zaman.rubd)
#### Post date: [February 8, 2017, 9:34am UTC](https://forum.networklessons.com/t/mpls-layer-3-vpn-bgp-as-override/1323/7 "2017-02-08T09:34:04Z")
Hi Rene,
Got your point . Many Thanks
br//
zaman
---
### Author:  [@kanth.kapil](https://forum.networklessons.com/u/kanth.kapil)
#### Post date: [June 11, 2018, 5:20am UTC](https://forum.networklessons.com/t/mpls-layer-3-vpn-bgp-as-override/1323/9 "2018-06-11T05:20:10Z")
Hi Rene,
Thanks for the Great explanation. I was wondering how does MPLS work & configured between different autonomous systems. Like when there are more than 2 Service providers involved. I checked in google but couldn’t find any article in simple terms.. Could you please help ?
Thank you
---
### Author:  [@lagapidis](https://forum.networklessons.com/u/lagapidis)
#### Post date: [June 19, 2018, 10:39am UTC](https://forum.networklessons.com/t/mpls-layer-3-vpn-bgp-as-override/1323/10 "2018-06-19T10:39:07Z")
Hello Kapil
Rene doesn’t yet have a lesson on MPLS connectivity via dual ISPs, however, take a look at Cisco’s latest design guide concerning such a scenario.
> **[CVD-MPLSWANDesignGuide-AUG14.pdf](https://www.cisco.com/c/dam/en/us/td/docs/solutions/CVD/Aug2014/CVD-MPLSWANDesignGuide-AUG14.pdf)**
>
> 2.95 MB
(see pg 21)
If you would like Rene to take a more detailed look at the specific scenario in a future lesson, feel free to make a suggestion at the Lesson Ideas page of the Network Lessons forum:
> **[Lesson Ideas - NetworkLessons.com](https://networklessons.com/lesson-ideas)**
>
> This page allows networklessons members to share what content they would like to see in the future.
Here you can suggest additional topics to be covered in the future.
I hope this has been helpful!
Laz
---
### Author:  [@andysjunkmale](https://forum.networklessons.com/u/andysjunkmale)
#### Post date: [December 23, 2018, 10:55pm UTC](https://forum.networklessons.com/t/mpls-layer-3-vpn-bgp-as-override/1323/11 "2018-12-23T22:55:28Z")
Doesn’t using the Allow\_AS\_IN option set yourself up for a routing loop? What if CE2 received an update that included its own AS# and that update actually originated on that router? It just seems like the safest option would be to configure as-override on the PE router. Am I missing something?
---
### Author:  [@lagapidis](https://forum.networklessons.com/u/lagapidis)
#### Post date: [January 2, 2019, 1:49pm UTC](https://forum.networklessons.com/t/mpls-layer-3-vpn-bgp-as-override/1323/12 "2019-01-02T13:49:30Z")
Hello Andy
Take a look at @andrew’s response to a similar question below:
> [@MPLS Layer 3 VPN BGP AS Override](https://forum.networklessons.com/t/mpls-layer-3-vpn-bgp-as-override/1323/3):
>
> Shannon, This is a good question, and there is a lot going on behind the scene to answer it. As you know, AllowAS-In and AS-Override are both essentially tricks that can be used to deal with what would normally be considered a BGP looped route (since the ASN number will appear in the AS Path). The important consideration is whether the BGP “loop” route will actually be filtered on the PE side or the CE side. AllowAS-In assumes the filtering is being done on the CE side, but in reality, most …
If you have further questions, don’t hesitate to ask!
I hope this has been helpful!
Laz
---
### Author:  [@andysjunkmale](https://forum.networklessons.com/u/andysjunkmale)
#### Post date: [January 10, 2019, 2:39am UTC](https://forum.networklessons.com/t/mpls-layer-3-vpn-bgp-as-override/1323/13 "2019-01-10T02:39:10Z")
Thanks Lazaros. Makes sense now.
---
### Author:  [@staut\_stefanita](https://forum.networklessons.com/u/staut_stefanita)
#### Post date: [April 14, 2019, 9:05pm UTC](https://forum.networklessons.com/t/mpls-layer-3-vpn-bgp-as-override/1323/14 "2019-04-14T21:05:46Z")
Just being picky 😄 , I believe that “If you take a closer look, you can see that AS number 1 has been replaced with AS number 234.” should be replaced with “If you take a closer look, you can see that AS number 12 has been replaced with AS number 234.” Also the picture and interfaces from Configurations files are not the same (in this lesson and also the previous one).
A question would be why the PE routers are not configured as BGP neighbors with P router? I guess the MPLS VPN does the trick (haven’t read the MPLS lessons yet).
You make great lessons and comments! Thank you all,
Stefanita
---
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [April 23, 2019, 12:31pm UTC](https://forum.networklessons.com/t/mpls-layer-3-vpn-bgp-as-override/1323/16 "2019-04-23T12:31:13Z")
Hi Stefanita,
Thanks for letting me know about this error, I just fixed it.
About your question, it’s indeed MPLS VPN that does the trick. The P routers only do label switching, they only need to know how to reach the PE routers. The PE routers require iBGP to exchange VPN routes. If you haven’t seen it before, take a look at this explanation:
> **[Introduction to MPLS](https://networklessons.com/mpls/introduction-to-mpls)**
>
> This lesson explains why we use MPLS (Multi Protocol Label Switching) and how it works.
That should help 🙂
Rene
---
### Author:  [@castrojuanj](https://forum.networklessons.com/u/castrojuanj)
#### Post date: [July 9, 2019, 11:18pm UTC](https://forum.networklessons.com/t/mpls-layer-3-vpn-bgp-as-override/1323/17 "2019-07-09T23:18:31Z")
I´ve used as-override in vpnv4 links, but now i am trying to apply it to ipv4 link and is not workng… are you sure it can be used whether the link is vpnv4 or ipv4 ?
---
### Author:  [@lagapidis](https://forum.networklessons.com/u/lagapidis)
#### Post date: [July 11, 2019, 8:05am UTC](https://forum.networklessons.com/t/mpls-layer-3-vpn-bgp-as-override/1323/18 "2019-07-11T08:05:44Z")
Hello Juan
When you say that it is not working, is the CLI not accepting the command or are the routers just not exchanging the expected prefixes?
Laz
---
### Author:  [@rodriarz](https://forum.networklessons.com/u/rodriarz)
#### Post date: [January 2, 2020, 1:33pm UTC](https://forum.networklessons.com/t/mpls-layer-3-vpn-bgp-as-override/1323/19 "2020-01-02T13:33:29Z")
As-override apply if I have another customer site CE3 with the AS number 12 in the same vrf connected to PE1 ? I mean, Will I have connectivity without AS -override between CE1 and CE3 even if they area connected to the same PE1 router?
---
### Author:  [@lagapidis](https://forum.networklessons.com/u/lagapidis)
#### Post date: [January 7, 2020, 1:28pm UTC](https://forum.networklessons.com/t/mpls-layer-3-vpn-bgp-as-override/1323/20 "2020-01-07T13:28:22Z")
Hello Rodrigo
If you have another customer site C3 connected to PE1 on the same VRF, you would still have the same problem because CE3 would still see its own AS in the AS path since the communication takes place from CE1 to PE1 to CE3, which means the AS path is 12 234 12, causing the loop mechanism to kick in.
I hope this has been helpful!
Laz
---
### Author:  [@tanmoymm23](https://forum.networklessons.com/u/tanmoymm23)
#### Post date: [March 29, 2020, 11:03am UTC](https://forum.networklessons.com/t/mpls-layer-3-vpn-bgp-as-override/1323/21 "2020-03-29T11:03:35Z")
Hi Laz ,
if we are talking about as-path override allowed-as in concept for the same topology , should I use both or can use only one ?
Either configure allowed-as in @CE side or can ok with configuration with as-path override @PE side.
which one is better & scalable ?
Thank you!
Tanmoy
---
### Author:  [@lagapidis](https://forum.networklessons.com/u/lagapidis)
#### Post date: [March 30, 2020, 6:42am UTC](https://forum.networklessons.com/t/mpls-layer-3-vpn-bgp-as-override/1323/22 "2020-03-30T06:42:49Z")
Hello Tanmoy
Let’s look at how each one functions. Both of these features are used in order to deal with BGP’s loop prevention mechanism which states “do not accept a prefix over eBGP that contains your AS in its path”.
**Allow-AS in** will cause the CE router to “make an exception” to the loop preventing rule and accept the prefix, even though its own AS is in the path. This is configured on CE routers.
**AS override** will bypass the loop prevention mechanism by changing the AS so that no loop condition will ever occur in the first place. This is configured on P routers.
Although you can, there’s no need to configure both, because if you do, AS override will change the AS anyway, so you will never have a case where Allow-AS would be triggered.
To be honest, even though the mechanism of each is different, there is very little difference to the end result. Personally, I think that which you will use depends primarily on your network topology. If you have more CE routers than P routers, then choose AS override. It’s just a matter of administrative overhead. Both are equally scalable.
I hope this has been helpful! Stay healthy and safe!
Laz
[Next page](https://forum.networklessons.com/t/mpls-layer-3-vpn-bgp-as-override/1323.md?page=2)