AWS directconnect documentation change
Summary
Expanded documentation about ASN ranges (including long ASN support) and clarified behavior of private ASN prepending
Security assessment
The changes clarify technical details about ASN ranges and routing behavior but do not address vulnerabilities or security incidents. The note about private ASNs being replaced with AWS ASN (7224) is a pre-existing security consideration to prevent route hijacking, but the update only adds formatting and long ASN examples without introducing new security controls.
Diff
diff --git a/directconnect/latest/UserGuide/routing-and-bgp.md b/directconnect/latest/UserGuide/routing-and-bgp.md index a3e4e39fb..7639589da 100644 --- a//directconnect/latest/UserGuide/routing-and-bgp.md +++ b//directconnect/latest/UserGuide/routing-and-bgp.md @@ -60 +60 @@ For more information about the ip-ranges.json file, see [AWS IP address ranges ] - * Public ASNs: You must own the ASN and have the right to announce it. AWS will verify your ownership of the ASN. + * Public ASNs: You must own the ASN and have the right to announce it. AWS will verify your ownership of the ASN. Both ASNs (1-2147483647) and long ASNs (1-4294967295) are supported. @@ -62 +62,7 @@ For more information about the ip-ranges.json file, see [AWS IP address ranges ] - * Private ASNs: You can use private ASNs (64512-65534, 4200000000-4294967294). However, AWS Direct Connect will replace the private ASN with the AWS ASN (7224) when advertising your prefixes to other AWS customers or the internet. + * Private ASNs: You can use private ASNs from the following ranges: + + * private ASNs: 64512-65534 + + * private long ASNs: 4200000000-4294967294 + +However, AWS Direct Connect will replace the private ASN with the AWS ASN (7224) when advertising your prefixes to other AWS customers or the internet. @@ -66 +72 @@ For more information about the ip-ranges.json file, see [AWS IP address ranges ] - * With a public ASN, prepending will work as expected, and your prepended ASN will be visible to other networks. + * With a public ASN (both ASN and long ASN), prepending will work as expected, and your prepended ASN will be visible to other networks. @@ -68 +74 @@ For more information about the ip-ranges.json file, see [AWS IP address ranges ] - * With a private ASN, any prepending you do will be stripped when AWS replaces your private ASN with 7224. This means ASN prepending is not effective for influencing routing decisions outside of AWS when using a private ASN on a public virtual interface. + * With a private ASN (both ASN and long ASN, any prepending you do will be stripped when AWS replaces your private ASN with 7224. This means ASN prepending is not effective for influencing routing decisions outside of AWS when using a private ASN on a public virtual interface. @@ -70 +76 @@ For more information about the ip-ranges.json file, see [AWS IP address ranges ] - * When establishing a BGP peering session with AWS over a public virtual interface, use 7224 for the autonomous system numbers (ASN) to establish the BGP session on the AWS side. The ASN on your router or customer gateway device should be different from that ASN. + * When establishing a BGP peering session with AWS over a public virtual interface, use 7224 for the autonomous system numbers (ASN) to establish the BGP session on the AWS side. The ASN on your router or customer gateway device should be different from that ASN. Your customer ASN can be either anASN (1-2147483647, excluding reserved ranges) or a long ASN (1-4294967295, excluding reserved ranges). @@ -202 +208 @@ Access to remote AWS Regions -Private virtual interface routing example +Long ASN support