diff --git a/bgpd/bgp_vty.c b/bgpd/bgp_vty.c
index 311051ae4306..22fbb1bb21cd 100644
--- a/bgpd/bgp_vty.c
+++ b/bgpd/bgp_vty.c
@@ -18783,7 +18783,11 @@ static void bgp_config_write_peer_global(struct vty *vty, struct bgp *bgp,
 
 	/* enforce-first-as */
 	if (CHECK_FLAG(bgp->flags, BGP_FLAG_ENFORCE_FIRST_AS)) {
-		if (!peergroup_flag_check(peer, PEER_FLAG_ENFORCE_FIRST_AS))
+		/* The `no` form is printed because by default this enforcing
+		 * is enabled, thus we need to print it inverted.
+		 * See peer_new().
+		 */
+		if (peergroup_flag_check(peer, PEER_FLAG_ENFORCE_FIRST_AS))
 			vty_out(vty, " no neighbor %s enforce-first-as\n", addr);
 	} else {
 		if (peergroup_flag_check(peer, PEER_FLAG_ENFORCE_FIRST_AS))
diff --git a/bgpd/bgpd.c b/bgpd/bgpd.c
index c1b278fffa73..a244e15fb8ec 100644
--- a/bgpd/bgpd.c
+++ b/bgpd/bgpd.c
@@ -1560,8 +1560,13 @@ struct peer *peer_new(struct bgp *bgp)
 
 	SET_FLAG(peer->sflags, PEER_STATUS_CAPABILITY_OPEN);
 
-	if (CHECK_FLAG(bgp->flags, BGP_FLAG_ENFORCE_FIRST_AS))
-		peer_flag_set(peer, PEER_FLAG_ENFORCE_FIRST_AS);
+	/* By default this is enabled, thus we need to mark it as
+	 * inverted in order to display correctly in the configuration.
+	 */
+	if (CHECK_FLAG(bgp->flags, BGP_FLAG_ENFORCE_FIRST_AS)) {
+		SET_FLAG(peer->flags_invert, PEER_FLAG_ENFORCE_FIRST_AS);
+		SET_FLAG(peer->flags, PEER_FLAG_ENFORCE_FIRST_AS);
+	}
 
 	if (CHECK_FLAG(bgp->flags, BGP_FLAG_SOFT_VERSION_CAPABILITY))
 		peer_flag_set(peer, PEER_FLAG_CAPABILITY_SOFT_VERSION);
diff --git a/tests/topotests/bgp_route_server_client/r1/bgpd.conf b/tests/topotests/bgp_route_server_client/r1/bgpd.conf
index d379f7df4527..5cbb7956beec 100644
--- a/tests/topotests/bgp_route_server_client/r1/bgpd.conf
+++ b/tests/topotests/bgp_route_server_client/r1/bgpd.conf
@@ -2,10 +2,12 @@
 router bgp 65001
  bgp router-id 10.10.10.1
  no bgp ebgp-requires-policy
- no bgp enforce-first-as
- neighbor 2001:db8:1::1 remote-as external
- neighbor 2001:db8:1::1 timers 3 10
- neighbor 2001:db8:1::1 timers connect 1
+ neighbor pg peer-group
+ neighbor pg remote-as external
+ neighbor pg timers 1 3
+ neighbor pg timers connect 1
+ no neighbor pg enforce-first-as
+ neighbor 2001:db8:1::1 peer-group pg
  address-family ipv6 unicast
   redistribute connected
   neighbor 2001:db8:1::1 activate