cloudflareJun 3, 2026

Enforcing the First AS in BGP AS PATHs (opens in new tab)

Forged BGP AS_PATHs can let attackers impersonate legitimate networks, misdirect traffic, and conceal their true origin. Recent hijacks suggest some providers accept routes whose first AS does not match the customer peer that advertised them. Enforcing this “First AS” relationship check is a straightforward defense that complements RPKI and ASPA. ## Route Hijacks Involving Forged Paths - A reported hijack of Orange’s `90.98.0.0/15` included the path: `48237 1299 199524 270118 17072 41128`. - The path implied implausible commercial relationships: - `AS41128` was an unused Orange ASN. - `AS17072` was a Mexican ISP. - `AS270118` was a Mexican hosting provider. - `AS199524` was Gcore. - `AS1299` was Arelion, a Tier 1 provider. - Another hijack included Cloudflare’s ASN in the path: `199524 270118 17072 13335 36429`. - Cloudflare confirmed it had no adjacency with the unused `AS36429`, indicating that the path was fabricated. - The routes appeared to terminate behind Gcore rather than actually traversing the networks listed in the forged path. - The suspected attack sequence was: - Announce parked or unused prefixes. - Completely forge the AS_PATH without including the attacker’s ASN. - Send the route to Gcore. - Rely on the provider accepting the route without verifying its first AS. - Once accepted, the forged route could be propagated to upstream providers and peers. ## Why First AS Checking Matters - The BGP AS_PATH records the networks a route is expected to traverse. - It supports: - Route selection. - Loop prevention. - Operator routing policies. - BGP permits AS_PATH manipulation for legitimate purposes, such as AS prepending, but the same flexibility enables attackers to shorten or fabricate paths. - First AS enforcement verifies that the first AS in an advertised path matches the ASN of the customer or peer that sent the update. - Without this check, a customer can advertise a path that appears to originate from another network. ## Limits of RPKI and ASPA Alone - RPKI ROAs validate whether an origin ASN is authorized to announce a prefix. - ASPA validates provider-to-customer relationships. - However, an attacker may still bypass these mechanisms by: - Claiming an RPKI-valid origin ASN. - Including a legitimate ASPA provider in the forged path. - Omitting the attacker’s own ASN when the receiving provider does not enforce First AS. - In the example, a route forged to appear as though it originated from `AS64506` could remain RPKI-valid and attract traffic if `AS64502` accepted it without checking the peer’s first AS. ## Practical Recommendation Network operators should enable strict First AS checking on BGP sessions, alongside RPKI route-origin validation and ASPA deployment. These controls address different parts of the attack: RPKI validates the origin, ASPA checks authorized provider relationships, and First AS enforcement prevents a peer from presenting a path that does not begin with its own ASN.

rpkinetwork-securitybgpaspa+2

cloudflareFeb 27, 2026

ASPA: making Internet routing more secure (opens in new tab)

ASPA (Autonomous System Provider Authorization) extends RPKI-based routing security from verifying a route’s destination to validating the path it takes. By publishing cryptographically signed lists of authorized providers, networks can detect BGP route leaks and some forged-origin hijacks. Cloudflare Radar now tracks ASPA adoption and records across the five Regional Internet Registries. ## From Origin Validation to Path Validation - RPKI uses Route Origin Authorizations (ROAs) to verify that an Autonomous System (AS) is authorized to announce specific IP prefixes. - ROAs protect against origin hijacks, where an attacker falsely claims ownership of someone else’s address space. - ASPA complements ROAs by validating the AS_PATH—the sequence of networks through which a route propagates. - Each AS publishes its authorized upstream providers, allowing other networks to check whether the observed path follows approved relationships. ## Detecting Route Leaks - Normal Internet routing generally follows a “valley-free” pattern: - Traffic moves upward from a customer through providers. - It may cross a peering connection near the top. - It then moves downward through providers toward the destination. - A route leak creates a “valley,” such as traffic traveling down to a customer and then back up to another provider. - ASPA evaluates the path from both directions: - The “up-ramp” is checked from the route origin toward its providers. - The “down-ramp” is checked backward from the destination. - A path is valid when both authorized chains meet. If they leave a gap, the route is considered ASPA Invalid, indicating a likely leak or unauthorized propagation. ## Example of ASPA Validation - In the example, AS65539 receives a route from customer AS65538. - AS65538 improperly propagates traffic received from provider AS65537 toward another provider, acting as a bridge between providers. - The upstream validation chain ends at AS65537, while the downstream chain ends at AS65538. - Because the two chains do not connect, ASPA identifies the route as invalid. ## Protection Against Forged-Origin Hijacks - ASPA can detect attacks in which the legitimate origin AS is retained but the attacker fabricates the path leading to it. - The victim’s signed provider list reveals that the attacker is not an authorized provider, allowing the route to be rejected. - ASPA is not universal protection: the article notes that a provider may still forge a path advertisement to its customer, a case the supplied text does not fully explain. ## Monitoring ASPA Adoption - Cloudflare Radar’s ASPA deployment monitoring feature shows adoption trends across all five RIRs. - It also lets users inspect ASPA records and changes for individual Autonomous Systems. ASPA provides an important second layer of routing security: ROAs verify where traffic should end, while ASPA helps verify how it gets there. Wider publication and validation of ASPA records should make route leaks and path manipulation easier to detect and prevent.

rpkinetwork-securitybgpaspa+3