Interior vs Exterior: Understanding IGP and EGP

Consider a remarkable fact: the Internet connects over 5 billion users, hundreds of millions of servers, and billions of IoT devices across every continent—yet no single organization controls it. No master routing table exists that knows every path to every destination. No central authority decides how packets travel from Tokyo to Toronto or from São Paulo to Sydney.

How does this work?

The answer lies in a brilliant organizational principle called the Autonomous System (AS)—the fundamental administrative and routing domain of the Internet. Understanding Autonomous Systems is essential for grasping how the Internet's global routing infrastructure operates, why routing protocols are divided into interior and exterior categories, and how networks of vastly different sizes and purposes coexist harmoniously.

An Autonomous System (AS) is a collection of IP networks and routers under the control of a single organization or entity that presents a common, clearly defined routing policy to the Internet. More formally, RFC 1930 defines an AS as:

"A connected group of one or more IP prefixes run by one or more network operators which has a SINGLE and CLEARLY DEFINED routing policy."

Let's break this definition into its essential components:

Why Not One Big Network?

You might wonder: why not just have one massive interconnected network? The answer involves multiple dimensions:

1. Administrative Reality — The Internet grew organically from thousands of independent networks. No single entity owns or can feasibly manage the entire infrastructure.

2. Scalability — A flat global routing table tracking every individual network would be impossibly large. Grouping networks into ASes enables route aggregation and manageable table sizes.

3. Policy Independence — Different organizations have different needs. An ISP prioritizes traffic differently than a bank, university, or content provider. AS boundaries enable policy autonomy.

4. Fault Isolation — Problems within one AS (configuration errors, hardware failures, attacks) are contained and don't cascade globally.

5. Business Relationships — ASes are often commercial entities. The AS abstraction enables peering agreements, transit relationships, and the economic model of the Internet.

Every Autonomous System that participates in external routing must have a globally unique identifier called an Autonomous System Number (ASN). This number is essential for inter-domain routing protocols (particularly BGP) to identify source, path, and destination networks.

ASN Structure and Allocation:

Originally, ASNs were 16-bit numbers (0–65,535). As the Internet grew and ASNs became scarce, the IETF introduced 32-bit ASNs (RFC 4893, RFC 6793), expanding the space to over 4 billion possible values.

Who Assigns ASNs?

Autonomous System Numbers are allocated hierarchically:

1. IANA (Internet Assigned Numbers Authority) — Allocates large blocks of ASNs to Regional Internet Registries.

2. Regional Internet Registries (RIRs) — Five RIRs serve different geographic regions:

   • ARIN — North America
   • RIPE NCC — Europe, Middle East, Central Asia
   • APNIC — Asia-Pacific
   • LACNIC — Latin America and Caribbean
   • AFRINIC — Africa

3. Local/National Internet Registries (LIRs/NIRs) — In some regions, national registries handle local allocations.

Organizations requesting an ASN must demonstrate a legitimate need—typically, they need to connect to multiple upstream providers with distinct routing policies, or they need to participate in an Internet Exchange Point (IXP).

Notable ASNs:

Some ASNs are well-known in the networking community:

These ASNs appear frequently in traceroutes, BGP feeds, and network analysis, making them familiar landmarks in the Internet's topology.

Autonomous Systems can be classified by their connectivity patterns and role in the Internet topology. Understanding these types is crucial for network design, troubleshooting, and understanding routing behavior.

The ISP Tier System:

Transit ASes are often categorized into tiers based on their position in the Internet hierarchy:

Tier 1 ISPs:

• Can reach any destination on the Internet without paying for transit
• Peer with all other Tier 1 networks (settlement-free peering)
• Examples: Lumen (AS3356), Cogent (AS174), NTT (AS2914), Telia (AS1299)
• There are approximately 15-20 Tier 1 networks globally

Tier 2 ISPs:

• Purchase transit from at least one Tier 1 provider
• Also engage in peering with other networks
• May sell transit to smaller networks
• Most large regional and national ISPs are Tier 2

Tier 3 ISPs:

• Purely purchase transit from upstream providers
• Don't engage in significant peering
• Local or specialized service providers

This hierarchical structure creates a scalable architecture where routing complexity is concentrated at higher tiers, while lower tiers can operate with simpler configurations.

While an AS presents a unified face to the outside world, internally it can be arbitrarily complex. Large ASes may span multiple continents, contain thousands of routers, and carry petabytes of traffic daily. Understanding internal AS architecture is essential for network design and operation.

Interior vs. Exterior Routing within an AS:

Inside an AS, Interior Gateway Protocols (IGPs) like OSPF, IS-IS, or EIGRP determine how traffic moves between internal routers. These protocols optimize for metrics like hop count, bandwidth, or delay.

At AS boundaries, Exterior Gateway Protocols (EGPs)—specifically BGP in the modern Internet—handle inter-domain routing. Border routers run both IGP (to communicate with internal routers) and BGP (to communicate with external ASes).

Internal BGP (iBGP):

Within a single AS, BGP is also used to distribute external routes learned from other ASes. This is called internal BGP (iBGP), and it ensures all border routers have consistent knowledge of external destinations. However, iBGP has special rules:

1. iBGP peers don't advertise routes learned from other iBGP peers (loop prevention)
2. This means iBGP requires either a full mesh of peerings or route reflectors
3. iBGP uses the IGP to determine the next-hop reachability

This separation—IGP for internal reachability, iBGP for external route distribution—is fundamental to scalable AS design.

To ground these concepts, let's examine how Autonomous Systems manifest in real Internet operations and why network engineers care deeply about AS topology.

Looking Up ASN Information:

Several tools and databases provide AS information:

• WHOIS databases — RIRs maintain WHOIS servers with ASN ownership information
• BGP Looking Glass servers — Show live BGP routes and AS paths from various vantage points
• PeeringDB — Community database of interconnection information
• Hurricane Electric BGP Toolkit — Comprehensive AS information and statistics
• RIPE RIS and RouteViews — BGP route collection projects for research and monitoring

BGP AS_PATH Attribute:

When BGP advertises a route, it includes the AS_PATH—a list of all ASes the route has traversed. This serves multiple purposes:

1. Loop Detection — If a router sees its own ASN in the AS_PATH, it rejects the route (it has already seen this route)
2. Path Selection — Shorter AS_PATHs are generally preferred (though other attributes can override this)
3. Troubleshooting — The AS_PATH reveals the Internet path between any two points
4. Policy Implementation — Networks can filter or prefer routes based on which ASes they traverse

Example AS_PATH: AS174 AS3356 AS15169

• This route entered our network from AS174 (Cogent)
• Originally came from AS3356 (Lumen)
• And originates from AS15169 (Google)

Autonomous Systems are not just organizational units; they're also security boundaries. Understanding AS-level security is increasingly critical as routing attacks become more sophisticated.

Securing the Routing System:

The Internet community has developed several mechanisms to improve routing security:

RPKI (Resource Public Key Infrastructure):

• Cryptographically binds ASNs to the prefixes they're authorized to announce
• Route Origin Authorizations (ROAs) are signed attestations that a specific AS can originate specific prefixes
• Routers can validate incoming routes against RPKI and reject unauthorized announcements
• Adoption has grown significantly, with major networks now performing RPKI validation

BGPsec:

• Extends RPKI to cryptographically sign AS_PATH, preventing path manipulation
• Still in early deployment due to computational overhead and operational complexity

IRR (Internet Routing Registry):

• Databases where ASes document their routing policies
• Used to generate prefix filters and validate route announcements
• Less secure than RPKI (not cryptographic) but widely used

BGP Community Best Practices:

• Using BGP communities to tag routes and implement consistent filtering
• MANRS (Mutually Agreed Norms for Routing Security) promotes coordinated security practices

Not every organization needs its own ASN. Understanding when an ASN is necessary (vs. when simpler solutions suffice) is an important practical skill for network architects.

The Process of Obtaining an ASN:

1. Determine eligibility — You generally need to demonstrate that you'll be multihomed and have a legitimate routing policy need

2. Apply through your RIR — Contact ARIN, RIPE, APNIC, LACNIC, or AFRINIC depending on your location

3. Provide documentation — Existing network information, justification for the ASN, and technical contacts

4. Pay applicable fees — RIRs charge annual fees for ASN maintenance (and often for IP allocation)

5. Configure BGP — Once assigned, configure your routers to use the ASN in BGP sessions

For organizations that need BGP but not a globally unique ASN, private ASNs can be used with upstream providers who strip them before advertising routes to the Internet. This is common in enterprise environments with single or limited provider connectivity.

We've explored the foundational concept that makes the Internet's global routing architecture possible. Let's consolidate the key insights:

What's Next:

With a solid understanding of Autonomous Systems, we're now ready to explore IGP protocols—the interior gateway protocols that govern routing within an AS. Understanding how OSPF, IS-IS, and EIGRP work internally prepares us to see why they're fundamentally different from exterior protocols like BGP, and why both categories exist.