# -\> Enforcing First AS in BGP

DevFeed: [-\> Enforcing First AS in BGP](<https://devfeed.tech/articles/enforcing-first-as-in-bgp-36147.md>)

Original publisher: [Read original article](<https://lkhill.com//enforce-first-as/>)

Author: lindsay

Published: 2023-10-08T14:00:49Z

Content type: tutorial

Language: en

Sources: [BGPexpert](<https://devfeed.tech/sources/bgpexpert.md>)

Topics: [BGP](<https://devfeed.tech/topics/bgp.md>), [Security](<https://devfeed.tech/topics/security.md>), [Cisco](<https://devfeed.tech/topics/cisco.md>), [Network](<https://devfeed.tech/topics/network.md>), [Internet](<https://devfeed.tech/topics/internet.md>)

Tags: [bgp](<https://devfeed.tech/tags/bgp.md>), [cisco](<https://devfeed.tech/tags/cisco.md>), [juniper](<https://devfeed.tech/tags/juniper.md>), [network](<https://devfeed.tech/tags/network.md>), [router](<https://devfeed.tech/tags/router.md>), [security](<https://devfeed.tech/tags/security.md>)

## AI overview

This article explains the BGP First AS requirement for eBGP peers, including the security and loop-prevention reasons for enforcing it. It discusses Juniper and Cisco behavior, route-server exceptions at internet exchanges, and the limitation that some routers expose the setting globally rather than per neighbor.

## Source excerpt

The BGP RFCs state that external BGP peers should insert their own AS into the AS PATH advertised to eBGP peers. Some peers strip their AS, generally for commercial gain. Juniper and Cisco have opposite default behaviors for handling this. Make sure you set bgp enforce-first-as on Juniper routers. Caveats apply. The annoying part here is that you want to disable this check for internet exchange route servers, but keep it enabled for everything else for security reasons. But that's not universally possible, as on some routers this is a global setting, rather than a per-neighbor one.