{"id":7143,"date":"2021-10-07T14:46:34","date_gmt":"2021-10-07T14:46:34","guid":{"rendered":"https:\/\/rax-stg-wp-aws.com\/blogs\/md5-authentication-between-bgp-peers-on-cisco-device\/"},"modified":"2026-11-03T19:27:55","modified_gmt":"2026-11-03T19:27:55","slug":"md5-authentication-between-bgp-peers-on-cisco-device","status":"publish","type":"blogs","link":"https:\/\/www.rackspace.com\/en-gb\/blogs\/md5-authentication-between-bgp-peers-on-cisco-device\/","title":{"rendered":"MD5 Authentication Between BGP Peers on Cisco Device"},"content":{"rendered":"

Introduction<\/strong><\/p>\n

The Border Gateway Protocol (BGP) is a standardized exterior gateway protocol designed to exchange routing information across autonomous systems (AS) on the Internet. As BGP is mostly used over internet, it is essential to keep the network secure.<\/p>\n

BGP peers can be configured with an MD5 algorithm (introduced in RFC 2385) which support routing authentication. When MD5 authentication is enabled, it computes an MD5 cryptographic hash over the TCP \u201cpseudo header\u201d, which includes the IP addresses used, the BGP packet carried in the TCP segment and a secret password. The resulting MD5 hash is then put in a TCP option in the TCP header and the packet is sent on its way (The password isn\u2019t transmitted.) The other side performs the same MD5 calculation and checks the result against the MD5 hash in the TCP header. If the two MD5 hashes are same, then we can be reasonably sure of two things:<\/p>\n

1.    The sender of the packet also knows the secret password
\n2.    The TCP segment and its contents weren\u2019t modified during transit
\nIf any attacker sends spoofed TCP reset packets, the MD5 hash will be missing, or it will be incorrect. The router simply ignores those packets and the BGP session is unaffected.<\/p>\n

Overview<\/strong><\/p>\n

There are a few steps that need to be performed to complete this activity. Such as, creating network topology, configure hostname, configure interface IP, Configure External Border Gateway Protocol (EBGP) between Site A & site B, configure MD5 authentication, verification, and troubleshooting.<\/p>\n

Topology<\/strong><\/p>\n

\"md5<\/p>\n

Configuration<\/strong>
\nSite A<\/strong>: 
\nRouter#conf t<\/em><\/p>\n

Router(config-if)#hostname siteA<\/em><\/p>\n

siteA(config)#interface gig0\/0<\/em><\/p>\n

siteA(config-if)#ip address 192.168.1.100 255.255.255.0<\/em><\/p>\n

siteA(config)# no shut<\/em><\/p>\n

siteA(config)#interface loopback 1<\/em><\/p>\n

siteA(config-if)#ip address10.10.10.1 255.255.255.0<\/em><\/p>\n

%LINK-5-CHANGED: Interface GigabitEthernet0\/0, changed state to up<\/em><\/p>\n

%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0\/0, changed state to up<\/em><\/p>\n

siteA(config-if)#router bgp 100<\/em><\/p>\n

siteA(config-router)#neighbor 192.168.1.101 remote-as 200<\/em> <\/p>\n

siteA(config-router)#%BGP-5-ADJCHANGE: neighbor 192.168.1.101 Up<\/em><\/p>\n

siteA(config-router)#neighbor 192.168.1.101 password cisco123<\/em><\/p>\n

siteA(config-router)#network 10.10.10.1 mask 255.255.255.0<\/em><\/p>\n

Site B: <\/strong>
\nRouter#conf t<\/em><\/p>\n

Router(config)#hostname siteB<\/em><\/p>\n

siteB(config-if)#ip address 192.168.1.101 255.255.255.0<\/em><\/p>\n

siteB(config-if)#no shut<\/em><\/p>\n

siteB(config)#interface loopback 1<\/em><\/p>\n

siteB(config-if)#ip address 20.20.20.1 255.255.255.0<\/em><\/p>\n

%LINK-5-CHANGED: Interface GigabitEthernet0\/0, changed state to up<\/em><\/p>\n

%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0\/0,<\/em><\/p>\n

changed state to up<\/em><\/p>\n

siteB(config)#router bgp 200<\/em><\/p>\n

siteB(config-router)#neighbor 192.168.1.100 remote-as 100<\/em><\/p>\n

siteB(config-router)#%BGP-5-ADJCHANGE: neighbor 192.168.1.100 Up<\/em><\/p>\n

siteB(config-router)#neighbor 192.168.1.101 password cisco123<\/em><\/p>\n

siteB(config-router)#network 20.20.20.1 mask 255.255.255.0<\/em><\/p>\n

Verification<\/strong><\/p>\n

When BGP is configured with MD5 & neighborship is formed, then it implies that authentication is working perfectly, otherwise neighborship won\u2019t be formed & you will be able to ping another end network.<\/p>\n

\n`$ sqlplus system\/[system password] \\
\n`@$AU_TOP\/patch\/115\/sql\/auclondb.sql 12`<\/em><\/p>\n

siteA#sh ip bgp summary<\/strong><\/em> 
\nBGP router identifier 10.10.10.1, local AS number 100<\/p>\n

BGP table version is 5, main routing table version 6<\/em><\/p>\n

2 network entries using 264 bytes of memory<\/em><\/p>\n

2 path entries using 104 bytes of memory<\/em><\/p>\n

1\/1 BGP path\/bestpath attribute entries using 184 bytes of memory<\/em><\/p>\n

2 BGP AS-PATH entries using 48 bytes of memory<\/em><\/p>\n

\n0 BGP route-map cache entries using 0 bytes of memory<\/em><\/p>\n

0 BGP filter-list cache entries using 0 bytes of memory<\/em><\/p>\n

Bitfield cache entries: current 1 (at peak 1) using 32 bytes of memory<\/em><\/p>\n

BGP using 632 total bytes of memory<\/em><\/p>\n

BGP activity 2\/0 prefixes, 2\/0 paths, scan interval 60 secs<\/em><\/p>\n

`Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up\/Down State\/PfxRcd<\/em>
\n192.168.1.101 4 200 73 72 5 0 0 00:48:41 4<\/em><\/p>\n

siteA#ping – <\/strong>192.168.1.101<\/p>\n

Type escape sequence to abort.
\nSending 5, 100-byte ICMP Echos to 192.168.1.101, timeout is 2 seconds:<\/em>
\n!!!!!<\/em>
\nSuccess rate is 100 percent (5\/5), round-trip min\/avg\/max = 0\/0\/1 ms<\/em><\/p>\n

siteA#ping 20.20.20.1<\/strong><\/p>\n

Type escape sequence to abort.<\/p>\n

Sending 5, 100-byte ICMP Echos to 20.20.20.1, timeout is 2 seconds:
\n!!!!!
\nSuccess rate is 100 percent (5\/5), round-trip min\/avg\/max = 0\/0\/1 ms<\/p>\n

siteB#sh ip bgp summary <\/strong>
\nBGP router identifier 20.20.20.1, local AS number 200<\/p>\n

BGP table version is 6, main routing table version 6<\/em><\/p>\n

2 network entries using 264 bytes of memory<\/em><\/p>\n

2 path entries using 104 bytes of memory<\/em><\/p>\n

1\/1 BGP path\/bestpath attribute entries using 184 bytes of memory<\/em><\/p>\n

2 BGP AS-PATH entries using 48 bytes of memory<\/em><\/p>\n

0 BGP route-map cache entries using 0 bytes of memory<\/em><\/p>\n

0 BGP filter-list cache entries using 0 bytes of memory<\/em><\/p>\n

Bitfield cache entries: current 1 (at peak 1) using 32 bytes of memory<\/em><\/p>\n

BGP using 632 total bytes of memory<\/em><\/p>\n

BGP activity 2\/0 prefixes, 2\/0 paths, scan interval 60 secs<\/em><\/p>\n

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up\/Down State\/PfxRcd<\/em><\/p>\n

192.168.1.100 4 100 79 75 6 0 0 00:51:10 4<\/em><\/p>\n

siteB#ping: 192.168.1.100<\/strong>
\nType escape sequence to abort.
\n`Sending 5, 100-byte ICMP Echos to 192.168.1.100, timeout is 2 seconds:`
\n`!!!!!`
\nSuccess rate is 100 percent (5\/5), round-trip min\/avg\/max = 0\/0\/1 ms<\/em><\/p>\n

siteB#ping 10.10.10.1<\/strong><\/p>\n

Type escape sequence to abort.
\nSending 5, 100-byte ICMP Echos to 10.10.10.1, timeout is 2 seconds:<\/em>
\n!!!!!<\/em>
\nSuccess rate is 100 percent (5\/5), round-trip min\/avg\/max = 0\/0\/1 ms<\/em><\/p>\n

Troubleshooting<\/strong><\/p>\n

Peering succeeds only if both routers are configured for authentication and have the same password. If a router has a password configured for a neighbor, but the neighbor router does not, then the following message is  displayed on the console while the routers attempt to establish a BGP session between them:<\/p>\n

%TCP-6-BADAUTH: No MD5 digest from [peer’s IP address]:11003 to<\/em>
\n[local router’s IP address]:179<\/em><\/p>\n

Similarly, if the two routers have different passwords configured, the following message will pop on the screen:<\/p>\n

%TCP-6-BADAUTH: Invalid MD5 digest from [peer’s IP
\naddress]:11004 to [local router’s IP address]<\/em><\/p>\n

Conclusion<\/em><\/strong><\/p>\n

By following the above steps, you can easily configure BGP with the MD5 authentication.  However, you should always implement other security & compliance mechanisms as a layered structure to strengthen the overall network security.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

MD5 Authentication Between BGP Peers on Cisco Device<\/p>\n","protected":false},"author":2,"featured_media":7145,"menu_order":0,"comment_status":"open","ping_status":"open","template":"","format":"standard","meta":{"content-type":"","nid":"26281","content_type":"blog","created_by":"10130","authored_on":"2023-11-22T15:46:34+00:00","field_article_industries":"","tag_category":"Technical","field_blog_author_text":"by Mayukh Mandal, Network Security Engineer, Rackspace Technology","seo_description":"Get a step-by-step guide on implementing MD5 authentication between BGP peers using Cisco devices for enhanced network security.\r\n","field_featured_image":"","insights_image":"\/wp-content\/uploads\/2026\/blog_technical_images\/26281-insights_image-security-technical-blog-1-insights.jpg","field_partners":"","rxt_platforms":"Cloud-Native Security","product":"","publisheddate":"2021-10-07T14:46:34","rxt_solutions":"Security Operations","opengraph_tag":"","x_tag":"","teaser_flag":"Technical Blog","seo_titile":"MD5 Authentication with BGP on Cisco | Rackspace Technology","field_topics":"","field_slug":"md5-authentication-between-bgp-peers-on-cisco-device","footnotes":""},"categories":[178],"tags":[204],"class_list":["post-7143","blogs","type-blogs","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-technical"],"_links":{"self":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/7143","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs"}],"about":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/types\/blogs"}],"author":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/comments?post=7143"}],"version-history":[{"count":2,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/7143\/revisions"}],"predecessor-version":[{"id":9032,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/7143\/revisions\/9032"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/media\/7145"}],"wp:attachment":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/media?parent=7143"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/categories?post=7143"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/tags?post=7143"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}