BGP Private and Public AS Range: On the internet, we have 2 byte AS Numbers and 4 Byte AS Numbers. In this post, we will explain what are the BGP Private and Public AS Range for 2 byte AS and 4 byte AS numbers. Where Private BGP AS number is used and should be used and where Public AS Numbers in BGP is used and should be used. Not just where they should be used but also we will discuss where they shouldn't be used too.
What Is an Autonomous System Number?
An Autonomous System (AS) is a group of IP networks operated by one or more network operators with a single, clearly defined external routing policy. Each AS is assigned a unique number, the AS number (ASN), which BGP uses to identify networks, apply routing policies, and exchange routing and reachability information between autonomous systems.
Not all ASNs are meant for public use. Similar to the IP address space, the ASN space is split into public ranges, which must be globally unique, and private ranges, which are reserved for internal use and can be reused by any network.
BGP Private AS Range for 2 Byte AS Numbers
A 2 byte AS number is a 16-bit number. This format provides for 65536 ASNs (0 to 65535). From these ASNs, the Internet Assigned Numbers Authority (IANA) reserved 1,023 of them (64512 to 65534) for private/internal usage.
BGP Private AS Range for 2-byte AS Number is between 64512 to 65534.
So we have 1023 BGP AS Numbers to use in a 2-byte ASN schema. Private AS numbers, similar to the Private IP address range (RFC 1918), should be used internally in the networks.
Not, external networks, such as the Internet. On Internet, in the Global Routing table, which is also known as Default Free Zone, only Public IP Addresses should be seen.
Thus, Private AS numbers only is used internally. They shouldn't be leaked to the Global Internet, intentionally or unintentionally.
I strongly recommend checking the BGP Course course for those who want to learn more about this topic.
BGP Private AS Range for 4 Byte AS Numbers
A 4 byte AS number is a 32-bit number. This format provides for 232 or 4,294,967,296 ASNs (0 to 4294967295).
IANA reserved 94,967,295 ASNs (4200000000 to 4294967294) for private/internal usage.
Similar to 2-byte Private ASNs, the 4-byte Private BGP AS range shouldn't be leaked to the Global Internet.
BGP Public AS Range for 2 Byte AS Numbers
IANA reserved AS 1 to AS 64511 for Public AS usage. Public Autonomous Systems are used on the Internet. Common usage is between the networks on the Internet and Internet Exchange Points. IXPs mandate participants to use Public AS numbers to peer with each other.
Private ASNs are removed at the edge of the networks, commonly known as IGW (Internet Gateways), and only Public AS is used on the Internet.
BGP Public AS Range for 4 Byte AS Numbers
IANA reserved AS 0 to 4199999999 for Public 4-Byte AS usage. If BGP AS will be used on the Global Internet, and if 2-Byte AS is not available, we are seeing BGP 4-byte ASNs.
There are thousands of 4-Byte AS numbers announcing prefixes to the Global Internet.
Private vs Public AS Numbers: Key Differences
Public and private AS numbers both facilitate BGP routing and routing policy, but they serve different operational scopes. Public AS numbers are allocated by IANA and distributed through Regional Internet Registries (RIRs), so they are globally unique and can appear in the global routing table. Private AS numbers are not registered anywhere and can be reused freely in any number of private networks, as long as they never reach the global Internet.
AspectPublic AS NumbersPrivate AS Numbers Scope of useGlobal InternetLocal/private networks VisibilityInternet-wideWithin private networks Global uniquenessGlobally uniqueCan be reused across many networks RegistrationAllocated by IANA, assigned via RIRsNo registration required Cost and accessibilityRequires registration and feesFreely available for internal use Typical usersISPs, enterprises with global presenceEnterprises needing internal routing controlThe choice between them comes down to whether the network needs internet-wide visibility. If routing stays inside a private environment, a private ASN is sufficient; if the network must exchange routes with other networks on the global Internet under its own identity, a public ASN is required.
Where Private BGP AS Range is used?
Private BGP AS numbers is used internally. Your internal prefixes in the network should be carried with Private BGP ASN. Prefixes that you may want to announce to the internet should be carried within the Autonomous System is carried with BGP Private ASN numbers but at the Internet Gateway they should be removed.
But what is an Enterprise company receiving a service from Internet Service Provider?. In this case, Enterprise can use the Private BGP AS number to peer with its upstream Internet Service Provider(ISP).
But ISP, when it announces the prefixes to its transit ISPs or Settlement Free Peers, they need to remove Private BGP ASN.
Another usage for the Private ASN range is Massively Scale Datacenters.
As you can understand from RFC 7938, which is explaining the usage of BGP inside the Massively-Scale Datacenters, Private BGP ASNs are used in these networks to avoid accidental BGP Route leaking with someone else's BGP Public ASNs.
Other common scenarios where private ASNs fit well include:
- Behind a BGP speaker performing AS number translation, so the private ASN never appears externally.
- Large organizations that need to segment extensive internal routing domains.
- Mergers and acquisitions, where networks must be integrated without external coordination or renumbering.
- Cloud and hybrid environments, where virtual private clouds (VPCs) commonly use private ASNs for internal BGP routing.
Where Private BGP AS Range shouldn't be used?
As we explained in this post earlier, the BGP Private AS range shouldn't be used on the Global Internet. Can Internet Gateway Routers announce the prefixes to their BGP peer on the Internet, if it is BGP Private AS range?. Yes, of course, it can.
You can advertise Private/Internal RFC 1918 IP Addresses to your peer on the Global Internet as well. So, BGP doesn't stop this.
Your job is to remove those private IP addresses and private BGP AS numbers before advertising to the Global Internet.
Of course, in order to avoid problems, neighboring ASNs should filter the Private IP addresses or Private ASNs, if they shouldn't come as Private. As we mentioned before, if it is Enterprise to ISP connection, ISP might be allowing Private advertisement, but in turn, they remove those private IP addresses and private ASNs before advertising to their neighbors on the Global Internet.
Private AS in BGP Peering: Pros and Cons
Using a private ASN when peering with an upstream provider is a common and legitimate design, but it comes with trade-offs.
Advantages
Private AS numbers conserve the public ASN pool, which is a finite resource that must be justified before allocation. They are also cost efficient: they are free to use and require no registration process with a Regional Internet Registry. Finally, they give network administrators control and privacy — internal routing policies can be implemented without revealing them to the global Internet.
Disadvantages
The main drawback is extra configuration at the network edge: private ASNs must be stripped from the AS path before routes are advertised toward the global Internet, either by the network itself at its Internet Gateway or by the upstream ISP. Private ASNs are also confined to internal or single-upstream use, and in some peering discussions a private ASN can be perceived as carrying less operational credibility than a registered public ASN.
BenefitDrawback Cost-effective and easy to obtainExtra configuration required at the edge for external peering Conserves public AS numbersLimited to internal network use Enhanced control over internal routing policiesRequires coordination with external peers on removal and filteringWhere finer control is needed, BGP communities such as NO_EXPORT can be attached to routes so they are not propagated beyond direct peers. Combined with proper filtering at the Internet Gateway, this keeps the use of a private ASN transparent to the rest of the Internet and prevents internal routing information from leaking.
Moving from a Private to a Public AS Number
If a network grows to the point where it needs to announce prefixes to the global Internet under its own identity or peer with multiple external networks, it is time to obtain a public ASN. The transition involves:
- Requesting a public AS number from the responsible Regional Internet Registry (RIR), such as ARIN or RIPE NCC.
- Replacing the private ASN with the new public ASN in the BGP configuration of the relevant routers.
- Coordinating the change with upstream providers and peers so that routing and filtering policies are updated without disruption.
Summary
The BGP Private AS range is 64512 to 65534 for 2-byte (16-bit) AS numbers and 4200000000 to 4294967294 for 4-byte (32-bit) AS numbers. The remaining ASN space is public, allocated by IANA and assigned through the RIRs. Private ASNs belong inside the network — carried internally, optionally used toward an upstream ISP, and always removed at the Internet Gateway before routes reach the global routing table.
