On Thu, Jun 25, 2026 at 02:56:54PM +0200, Robert Scheck wrote:
> Given your clarification I now noticed that this Vodafone transit is some
> alien/monster/... transit: While it's Vodafone, they still have configured
> AS6830 on their side. The local ISP was acquired long time ago by Liberty
> Global, they updated their configuration to AS6830. Some years ago that
> part was split out and sold to Vodafone, but they kept AS6830 there, even
> it's AS3209 (and they refused to change it). So my AS_PATH begins always
> with "AS6830 AS3209" instead of "AS3209".
>
> I might not have understood ASPA completely (and I know I'm not the only
> one), but my understanding so far is that "AS6830 AS3209" instead of just
> "AS3209" in AS_PATH leads to the wrong result.
>
> I thought it would be clever to remove AS6830 from the beginning of the
> AS_PATH but there doesn't seem to be a function for this in BIRD? Because
> my
>
> if bgp_path.first = 6830 then {
> bgp_path = delete(bgp_path, 6830);
> }
>
> removed AS6830 from any place in the AS_PATH. This leads to an ASPA result
> that could be more correct (compared with the other transit), but the ROA
> check now filters any ROAs with prefixes originating in AS6830, which is
> indeed wrong (and caused by my delete()).
>
> So...is there any solution for this mess - other than cancelling Vodafone
> transit or not performing ASPA checks?
To clarify → you get routes from Vodafone which always begin
6830-3209-something, and 6830 has ASPA 0, the 3209 is at best an apex of
an up-path. Therefore, if 3209 is actually using another transit or
peering with ASPA, that route gets marked downstream invalid.
If this part is no longer Liberty Global, they should stop using 6830,
as that is not their ASN.
But the real question comes in the other direction. How do your routes
look like after passing 3209? Can you find them somewhere in looking
glasses? Because if they send routes looking like 3209-6830-yourasn
to their peers or providers, their peers will refuse them as an outright
leak.
> > Note: a situation like this, in a simplified form, happened with the
> > RIPE network and CZ.NIC, which has been affected by Hurricane Electric
> > leaking CZ.NIC routes.
> >
> > https://ripe92.ripe.net/programme/meeting-plan/sessions/109/ZT9NYU/
>
> I saw this (remotely) and I had the hope to not run into any ASPA fun, but
> they, here I am now! ;-(
Welcome to the party!
--
Maria Matejka (she/her) | BIRD Team Leader | CZ.NIC, z.s.p.o.
