eBGP Underlay ASN Plan for Two Pods with 20,000 Tenant Routes
A financial services firm is building two pods, each with 6 spines and 24 leaves, joined by a 2×100G DCI. The underlay is eBGP; the overlay is EVPN iBGP with spines as route reflectors. Border leaves advertise 20,000 tenant prefixes to a WAN router that supports 50,000 routes. The design team proposes ASN 65000 on every spine and leaf, with border leaves injecting a default route into the fabric and redistributing all tenant routes to the WAN. Requirements are no transit between pods, deterministic forwarding, sub-second underlay convergence, and no WAN route leaks. The WAN team also wants a summary, not 20,000 prefixes. The network architect asks you to review the proposal before the pilot.
1. Review the single-ASN 65000 proposal and provide an ASN plan that supports deterministic eBGP underlay forwarding.
Read the worked answer
The single-ASN proposal is not viable for an eBGP underlay. eBGP speakers reject routes containing their own ASN, so two devices both using 65000 cannot form a normal session without allowas-in, which weakens loop prevention and makes accidental transit harder to detect. Use unique private ASNs per device or per role. For example, leaves use 65001–65048, pod spines use 65101–65112, border leaves use 65201–65204, and the DCI uses 65301 and 65302. Each leaf peers eBGP with all local spines and advertises only its loopback and point-to-point link subnet; spines advertise only the loopbacks of their leaf peers and do not peer with each other. This gives deterministic best paths and ECMP across spines. If 16-bit private space is exhausted, use 4-byte private ASNs in the 4200000000–4294967294 range; Junos supports 4-byte ASN.
2. How should the 20,000 tenant prefixes be advertised to the WAN while preventing transit and route leaks?
Read the worked answer
Summarize at the border leaves into a small set of aggregates, for example four /16 or /20 summaries that cover the tenant address plan, and advertise only those aggregates to the WAN. Apply an explicit export policy on the WAN-facing sessions that permits the aggregates and denies all else; apply an import policy that accepts only the default route and approved partner prefixes from the WAN, denying everything else. Do not redistribute the full tenant table into the WAN. Within the fabric, carry tenant routes as EVPN Type-5 routes, not as WAN routes. To prevent pod-to-pod transit through a border, do not advertise WAN-learned routes into the fabric except the default, and ensure pod-to-pod traffic uses the DCI EVPN path rather than a border leaf. Use max-prefix limits and AS-path filters on the WAN sessions, and test the policy with a route leak simulation before the pilot.
3. What underlay and overlay convergence design would you recommend to meet sub-second underlay convergence?
Read the worked answer
Run BFD on every underlay eBGP session with 300 ms × 3, and set BGP hold time to 9 seconds or less; BFD provides sub-second failure detection while BGP withdraws the failed next hop. Enable BGP multipath and ECMP across all spines so a single spine failure does not reduce a leaf to one path. Use redundant route reflectors on the spines and ensure the overlay EVPN sessions also have fast detection, either through BFD or through underlay-triggered next-hop withdrawal. Keep the underlay policy tight: only loopbacks and link subnets, no tenant routes, so convergence is not tied to 20,000 prefixes. For the EVPN overlay, use anycast gateway and Type-5 routes at the border, and test reconvergence with a spine failure and a leaf failure. Sub-second underlay convergence is achievable with BFD; the overlay may take slightly longer, so measure end-to-end traffic loss.