Router generates and checks the MD5 digest of every segment sent on the TCP connection Router authenticates the source of each routing update packet that it receives
BGP neighbor authentication can be configured on a router so that the router authenticates the source of each routing update packet that it receives. This is accomplished by the exchange of an authenticating key (sometimes referred to as a password) that is known to both the sending and the receiving router.
BGP supports MD5 neighbor authentication. MD5 sends a message digest (also called a hash) that is created using the key and a message. The message digest is then sent instead of the key. The key itself is not sent, to prevent it from being read by an eavesdropper on the line while it is being transmitted.
To enable MD5 authentication on a TCP connection between two BGP peers, use the neighbor {ip-address | peer-group-name} password string router configuration command.
6-72 Building Scalable Cisco Internetworks (BSCI) v3.0 © 2006 Cisco Systems, Inc.
The neighbor password Command Parameters
The table describes the syntax of the neighbor password command.
The table describes the syntax of the neighbor password command.
|
Parameter |
Description |
|
ip-address |
IP address of the BGP-speaking neighbor. |
|
peer-group-name |
Name of a BGP peer group. |
|
string |
Case-sensitive password of up to 25 characters. The first character cannot be a number. The string can contain any alphanumeric characters, including spaces. You cannot specify a password in the format number-space-anything. The space after the number can cause authentication to fail. |
You can configure MD5 authentication between two BGP peers, meaning that each segment sent on the TCP connection between the peers is verified. MD5 authentication must be configured with the same password on both BGP peers; otherwise, the connection between them will not be made. Configuring MD5 authentication causes Cisco IOS software to generate and check the MD5 digest of every segment sent on the TCP connection.
Caution If the authentication string is configured incorrectly, the BGP peering session will not be
established. It is recommended that you enter the authentication string carefully and verify that the peering session is established after authentication is configured.
If you specify a BGP peer group by using the peer-group-name argument, all the members of the peer group will inherit the characteristic configured with this command.
If a router has a password configured for a neighbor, but the neighbor router does not, a message such as the following will appear on the console when the routers attempt to send BGP messages between themselves:
%TCP-6-BADAUTH: No MD5 digest from 10.1.0.2(179) to 10.1.0.1(20236)
Similarly, if the two routers have different passwords configured, a message such as the following will appear on the screen:
%TCP-6-BADAUTH: Invalid MD5 digest from 10.1.0.1(12293) to 10.1.0.2(179)
If you configure or change the password or key used for MD5 authentication between two BGP peers, the local router will not tear down the existing session after you configure the password. The local router will attempt to maintain the peering session using the new password until the BGP hold-down timer expires. The default time period is 180 seconds. If the password is not entered or changed on the remote router before the hold-down timer expires, the session times out.
Note Configuring a new timer value for the holddown timer will only take effect after the session
has been reset. It is not possible to change the configuration of the hold-down timer to avoid resetting the BGP session.
© 2006 Cisco Systems, Inc. Implementing BGP 6-73
Continue reading here: Example show ip bgp Command Output
Was this article helpful?