MD5 Authentication

BGP (Border Gateway Protocol) IPv6 MD5 Authentication is a security mechanism designed to protect the integrity and authenticity of BGP routing updates in IPv6 networks. It involves the use of MD5 cryptographic hashing to generate a checksum, or hash, for BGP messages exchanged between routers. By configuring MD5 authentication keys on participating routers, administrators can ensure that only trusted routers with matching keys can exchange BGP updates. This adds a layer of security against unauthorized or malicious attempts to manipulate routing information. BGP IPv6 MD5 Authentication is an essential practice for safeguarding the stability and trustworthiness of BGP-based communication in IPv6 environments.

Lab:

Task 1: Configure IPv6 BGP Process for Autonomous

Step 1: In the configuration mode of router configure IPv6 BGP Process by following command:

R1: 
interface Serial2/0
ipv6 address 12::1/64
no shutdown
interface loopback 1
ipv6 address 11:11:11::11/64
exit

ipv6 route 22:22:22::22/64  12::2

ipv6 unicast-routing
router bgp 65000
bgp router-id 1.1.1.1
neighbor 22:22:22::22 remote-as 65000
neighbor 22:22:22::22 update-source loopback 1
address-family ipv6
neighbor 22:22:22::22 activate
exit

R2: 
interface Serial2/0
ipv6 address 12::2/64
no shutdown
interface loopback 1
ipv6 address 22:22:22::22/64
exit
ipv6 route 11:11:11::11/64  12::1

ipv6 unicast-routing
router bgp 65000
bgp router-id 2.2.2.2
neighbor 11:11:11::11 remote-as 65000
neighbor 11:11:11::11 update-source loopback 1
address-family ipv6
neighbor 11:11:11::11 activate
exit

Task 2: Configure IPv6 BGP MD5 Authentication

Step 1: Configure IPv6 BGP MD5 Authentication by following command

R1:
router bgp 65000
neighbor 22:22:22::22 remote-as 65000
neighbor 22:22:22::22 password cisco
exit

clear bgp ipv6 unicast *

Step 2: Verify IPv6 BGP MD5 Authentication

R1:
R1# debug bgp ipv6
*Oct 26 03:36:57.250: %TCP-6-BADAUTH: No MD5 digest from 22:22:22::22(179) to 11:11:11::11(14249) tableid - 0
R1#
*Oct 26 03:36:59.252: %TCP-6-BADAUTH: No MD5 digest from 22:22:22::22(179) to 11:11:11::11(14249) tableid - 0
R1#
*Oct 26 03:37:06.205: %TCP-6-BADAUTH: No MD5 digest from 22:22:22::22(42104) to 11:11:11::11(179) tableid - 0
R1#
*Oct 26 03:37:08.205: %TCP-6-BADAUTH: No MD5 digest from 22:22:22::22(42104) to 11:11:11::11(179) tableid - 0
R1#
*Oct 26 03:37:11.257: %TCP-6-BADAUTH: No MD5 digest from 22:22:22::22(179) to 11:11:11::11(14249) tableid - 0
*Oct 26 03:37:11.261: %TCP-6-BADAUTH: No MD5 digest from 22:22:22::22(179) to 11:11:11::11(14249) tableid - 0
*Oct 26 03:37:12.205: %TCP-6-BADAUTH: No MD5 digest from 22:22:22::22(42104) to 11:11:11::11(179) tableid – 0
*Oct 26 03:38:15.329: %TCP-6-BADAUTH: No MD5 digest from 22:22:22::22(179) to 11:11:11::11(26195) tableid - 0

If a router has a password configured for a neighbor, but the neighbor router does not, a message such as this is displayed while the routers attempt to establish a BGP session between them:
%TCP−6−BADAUTH: No MD5 digest from [peer's IP address]:11003 to [local router's IP address]:179
Similarly, if the two routers have different passwords configured, a message such as this is displayed: 
%TCP−6−BADAUTH: Invalid MD5 digest from [peer's IP address]:11004 to [local router's IP address]:179

R1#show bgp ipv6 unicast neighbors
BGP neighbor is 22:22:22::22,  remote AS 65000, internal link
BGP version 4, remote router ID 0.0.0.0
BGP state = Active
Neighbor sessions:
0 active, is not multisession capable (disabled)
Stateful switchover support enabled: NO for session 0

Step 3: Configure authentication on router R2.

R2:
router bgp 65000
neighbor 11:11:11::11 remote-as 65000
neighbor 11:11:11::11 password cisco
exit

Step 4: Verify IPv6 BGP MD5 Authentication.

R1:

*Oct 26 03:41:57.961: %BGP-5-ADJCHANGE: neighbor 22:22:22::22 Up

R1#show bgp ipv6 unicast neighbors
BGP neighbor is 22:22:22::22,  remote AS 65000, internal link
BGP version 4, remote router ID 2.2.2.2
BGP state = Established, up for 00:01:17
Last read 00:00:25, last write 00:00:18, hold time is 180, keepalive interval is 60 seconds
Neighbor sessions:
1 active, is not multisession capable (disabled)
Neighbor capabilities:
Route refresh: advertised and received(new)
Four-octets ASN Capability: advertised and received
Address family IPv6 Unicast: advertised and received
Enhanced Refresh Capability: advertised and received

R2:

*Oct 26 03:41:57.957: %BGP-5-ADJCHANGE: neighbor 11:11:11::11 Up

R2#show bgp ipv6 unicast neighbors
BGP neighbor is 11:11:11::11,  remote AS 65000, internal link
BGP version 4, remote router ID 1.1.1.1
BGP state = Established, up for 00:02:47
Last read 00:00:58, last write 00:00:56, hold time is 180, keepalive interval is 60 seconds
Neighbor sessions:
1 active, is not multisession capable (disabled)
Neighbor capabilities:
Route refresh: advertised and received(new)
Four-octets ASN Capability: advertised and received
Address family IPv6 Unicast: advertised and received
Enhanced Refresh Capability: advertised and received

R1:
R1#show bgp ipv6 unicast summary
BGP router identifier 1.1.1.1, local AS number 65000
BGP table version is 1, main routing table version 1

Neighbor        	V    AS 	     MsgRcvd  MsgSent   TblVer  InQ   OutQ   Up/Down    State/PfxRcd
22:22:22::22    	4    65000       7          7         1      0     0     00:03:29       0


R2:
R2#show bgp ipv6 unicast summary
BGP router identifier 2.2.2.2, local AS number 65000
BGP table version is 1, main routing table version 1

Neighbor          V      AS      MsgRcvd  MsgSent   TblVer   InQ   OutQ     Up/Down   State/PfxRcd
11:11:11::11      4     65000      8        8         1       0      0      00:03:57      0