Thank you all for your assistance thus far. I wanted to confirm with my customer that it was okay to share more details and they said it was okay. We did just send an email to Akamai net support and awaiting their reply. The customer is NYULH (AS 394666). They currently use NYU (AS 12) for internet connectivity. They advertise the following prefixes to NYU: 216.165.124.0/24 216.165.125.0/24 216.165.126.0/24 216.165.127.0/24 NYU aggregates the above prefixes, strips NYULH's AS number, and replaces it with their own AS number (AS 12). The aggregates are as follows: 216.165.124.0/23 216.165.126.0/23 Below is a sample /23 route seen from one of the looking glass servers with origin AS 12: 216.165.124.0/23 [DIGITALOCEAN3 2017-11-11 from 162.243.188.2] * (100/-) [AS12i] Type: BGP unicast univ BGP.origin: IGP BGP.as_path: 393406 3630 12 BGP.next_hop: 162.243.188.2 BGP.local_pref: 100 BGP.atomic_aggr: BGP.aggregator: 192.168.255.3 AS12 BGP.community: (14061,2000) (14061,2002) (14061,3000) (14061,3001) (65363,714) (65363,2906) (65363,13335) (65363,13414) (65363,14061) (65363,20940) (65363,32934) (65363,41690) (65363,46489) (65363,65340) BGP.ext_community: (RPKI Origin Validation State: not-found) With their routes originating from AS 12, all their internet connectivity works fine. However when they failover to their secondary path which is F5 Silverline DDOS protection over Optimimum Lightpath, they are unable to connect to any Akamai hosted websites. The difference between their primary path and secondary path is that the secondary path does not strip their origin AS 394666. To answer Job's question, yes the originating router is AS4 capable. I checked the looking glass link you provided and see the correct origin AS 394666. See below: 216.165.124.0/24 [DIGITALOCEAN5 14:14:44 from 5.101.111.2] * (100/-) [AS394666i] Type: BGP unicast univ BGP.origin: IGP BGP.as_path: 202109 2914 55002 394666 BGP.next_hop: 5.101.111.2 BGP.local_pref: 100 BGP.community: (2914,410) (2914,1203) (2914,2201) (2914,3200) (14061,2100) (14061,2101) (14061,4000) (14061,4001) BGP.ext_community: (RPKI Origin Validation State: not-found) However we noticed some of Level 3's looking glass routers only see the AS_Trans 23456 as shown in the output below. I'm assuming that means some of Level3's routers are not AS4 capable, but does that mean they will drop the routes? Report generated from: car1.jan1 Route results for 216.165.124.0/24 from Jackson, MS BGP routing table entry for 216.165.124.0/24 Paths: (2 available, best #2) 1299 55002 23456 AS-path translation: { TELIANET DEFENSENET-1 AS23456 } ear3.Dallas1 (metric 43807) Origin IGP, metric 100000, localpref 86, valid, internal Community: North_America Lclprf_86 United_States Level3_Peer Dallas Level3:10497 Originator: ear3.Dallas1 1299 55002 23456 AS-path translation: { TELIANET DEFENSENET-1 AS23456 } ear3.Dallas1 (metric 43807) Origin IGP, metric 100000, localpref 86, valid, internal, best Community: North_America Lclprf_86 United_States Level3_Peer Dallas Level3:10497 Originator: ear3.Dallas1 Thanks, Greg Gregory Gombas CCIE# 19649 - R&S Network Consulting Engineer Advanced Services grgombas@cisco.com Office: +1-212-714-4497 Mobile: +1-201-675-9457 Cisco Systems Limited One Penn Plaza 6th & 9th Floors New York, NY 10119 United States Cisco.com Think before you print. This email may contain confidential and privileged material for the sole use of the intended recipient. Any review, use, distribution or disclosure by others is strictly prohibited. If you are not the intended recipient (or authorized to receive for the recipient), please contact the sender by reply email and delete all copies of this message. For corporate legal information go to: http://www.cisco.com/web/about/doing_business/legal/cri/index.html -----Original Message----- From: Job Snijders [mailto:job@ntt.net] Sent: Tuesday, November 14, 2017 11:36 AM To: Greg Gombas -X (grgombas) <grgombas@cisco.com> Cc: nanog@nanog.org Subject: Re: Issues with 4-octet BGP AS and Akamai? Hi, What prefix and ASN is this about? Are you sure you are advertising from an AS4 capable router? Do you see the expected 4-byte ASN as origin in a aggregator looking glass like http://lg.ring.nlnog.net/prefix_detail/lg01/ipv4?q=www.nlnog.net ? Kind regards, Job