On Thu, Jun 25, 2026 at 02:56:54PM +0200, Robert Scheck wrote:

Given your clarification I now noticed that this Vodafone transit is some alien/monster/… transit: While it’s Vodafone, they still have configured AS6830 on their side. The local ISP was acquired long time ago by Liberty Global, they updated their configuration to AS6830. Some years ago that part was split out and sold to Vodafone, but they kept AS6830 there, even it’s AS3209 (and they refused to change it). So my AS_PATH begins always with “AS6830 AS3209” instead of “AS3209”.

I might not have understood ASPA completely (and I know I’m not the only one), but my understanding so far is that “AS6830 AS3209” instead of just “AS3209” in AS_PATH leads to the wrong result.

I thought it would be clever to remove AS6830 from the beginning of the AS_PATH but there doesn’t seem to be a function for this in BIRD? Because my

if bgp_path.first = 6830 then { bgp_path = delete(bgp_path, 6830); }

removed AS6830 from any place in the AS_PATH. This leads to an ASPA result that could be more correct (compared with the other transit), but the ROA check now filters any ROAs with prefixes originating in AS6830, which is indeed wrong (and caused by my delete()).

So…is there any solution for this mess - other than cancelling Vodafone transit or not performing ASPA checks?

To clarify → you get routes from Vodafone which always begin 6830-3209-something, and 6830 has ASPA 0, the 3209 is at best an apex of an up-path. Therefore, if 3209 is actually using another transit or peering with ASPA, that route gets marked downstream invalid.

If this part is no longer Liberty Global, they should stop using 6830, as that is not their ASN.

But the real question comes in the other direction. How do your routes look like after passing 3209? Can you find them somewhere in looking glasses? Because if they send routes looking like 3209-6830-yourasn to their peers or providers, their peers will refuse them as an outright leak.

Note: a situation like this, in a simplified form, happened with the RIPE network and CZ.NIC, which has been affected by Hurricane Electric leaking CZ.NIC routes.

https://ripe92.ripe.net/programme/meeting-plan/sessions/109/ZT9NYU/

I saw this (remotely) and I had the hope to not run into any ASPA fun, but they, here I am now! ;-(

Welcome to the party!

–
Maria Matejka (she/her) | BIRD Team Leader | CZ.NIC, z.s.p.o.