Summary

  • RFC 5065 lets one administration partition a large BGP domain into Member-ASes while external peers see a single Confederation Identifier.
  • The abstraction does not delegate policy authority to the protocol: every member must support the extension, internal path and attribute rules still shape selection, and bad topology or tie-breaking can duplicate routes, delay convergence or sustain oscillation.

One external identity, several internal policy domains

An AS Confederation is a collection of autonomous systems represented and advertised as one AS number to BGP speakers outside the group. RFC 5065 names that public number the AS Confederation Identifier. Inside the boundary, each subdivision uses a Member-AS Number that is visible only to other members.

That distinction is more than naming. A member MUST use the Confederation Identifier in transactions with non-members and its Member-AS Number with peers inside the same confederation. As an update crosses between Member-ASes, an AS_CONFED_SEQUENCE records the ordered internal traversal. When the route leaves the confederation, all confederation path segments are removed and the Confederation Identifier is placed in the ordinary AS path.

External peers therefore receive the identity of the administered whole, not a map of its internal subdivisions. The internal path is hidden at the boundary, but the decisions that produced it are not made irrelevant. They remain the responsibility of the operator whose single AS number now represents the result.

Loop protection follows both identities

RFC 5065 preserves loop checks on both sides of the abstraction. A speaker that sees its own Confederation Identifier in the ordinary AS path treats the route as it would a path containing its own AS number. Inside the confederation, a speaker does the same when AS_CONFED_SEQUENCE contains its own Member-AS Number.

The external boundary is strict. A speaker MUST NOT transmit AS_CONFED_SEQUENCE or AS_CONFED_SET to a non-member. A confederation peer also has to present the expected confederation sequence at the front of the path. These rules make membership and configuration part of the authorization model: a router is not a member merely because it can establish a BGP session, and a path is not safe merely because the public Confederation Identifier looks familiar.

Every participating speaker must understand the confederation extensions. External speakers do not need to. That compatibility asymmetry is the source of the scaling benefit and also a deployment constraint: the abstraction works only if the internal estate agrees on its meaning before the outside can remain unaware of it.

The current standard removes the unordered branch

RFC 5065 originally defined both AS_CONFED_SEQUENCE, an ordered list of Member-ASes, and AS_CONFED_SET, an unordered set produced by aggregation. RFC 9774 updated the standard in 2025. Unless an operator explicitly configures a transition exception, a BGP speaker MUST NOT advertise an AS_CONFED_SET and must apply treat-as-withdraw when one is received in AS_PATH or AS4_PATH.

That change matters to current operations. It deprecates the unordered confederation set, not the confederation architecture or AS_CONFED_SEQUENCE. The remaining ordered sequence still carries internal traversal, while RFC 6793 separately forbids confederation segments in AS4_PATH. A current implementation plan has to read RFC 5065 through those updates rather than reproduce every 2007 path type as though its status were unchanged.

Attribute freedom moves risk into design

Between neighboring Member-ASes, RFC 5065 permits an unchanged NEXT_HOP and MED and removes the ordinary restriction on sending LOCAL_PREF across an AS boundary. It also defines special comparison rules: confederation segments are skipped for certain MED comparisons, are not counted for AS-path length, and routes learned elsewhere in the same confederation are treated as internal for the internal-versus-external rule.

Those exceptions give one administration room to preserve internal intent across Member-AS boundaries. They also mean that topology and policy cannot be reviewed separately. RFC 5065 warns that improper configuration can duplicate routing information, waste resources, cause route flaps and delay convergence. It also points to permanent route oscillation when confederations or route reflectors expose different candidate sets and MED or other tie-breakers interact badly.

The evidence supports a design warning, not a prediction about any named network. Whether an actual confederation oscillates depends on its topology, advertisements and policy. The durable control is to make those dependencies explicit before the public AS identity conceals them from outside observers.

Evidence and limits

RFC 5065 defines the identities, path changes, loop rules, compatibility requirements and documented deployment risks. RFC 9774 supplies the current prohibition on ordinary AS_CONFED_SET advertisement and treat-as-withdraw handling. RFC 6793 fixes the AS4_PATH boundary, RFC 4456 defines the distinct route-reflection alternative, and RFC 3345 analyzes persistent oscillation conditions.

The sources do not state a universal network size at which confederations are best, report current adoption, or quantify savings for a particular operator. Claims about accountability, beneficiaries and operational ownership are analysis derived from the standards. Hiding Member-AS numbers from external peers is an abstraction; it is not a confidentiality or cryptographic guarantee.

Sources