Private AS paths are not removed after they appear after a public AS

When shutting down the primary interfaces to force traffic over the redundant ISP link, we observed that internet routes were no longer available, resulting in a loss of client connectivity. Upon further investigation, we identified that BGP was not removing private ASNs when they appear after a public ASN in the AS-PATH. This seems to prevent the remote-private attribute from functioning as intended.

As part of the troubleshooting, we modified the configuration to use private ASNs for prepending instead of public ones. However, once the primary path was restored, the route was still preferred via the secondary link. This occurred because the private ASNs were stripped from the AS-PATH, causing the route selection to favor the redundant link.

This behavior is expected as per BGP design.

"

When advertising AS paths to remote systems, have the local system strip private AS numbers from the AS path. The numbers are stripped from the AS path starting at the left end of the AS path (the end where AS paths have been most recently added). The routing device stops searching for private ASs when it finds the first nonprivate AS or a peer’s private AS. If the AS path contains the AS number of the external BGP (EBGP) neighbor, BGP does not remove the private AS number.

"

https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/remove-private-edit-protocols-bgp.html