Avaya Configuring IP Exterior Gateway Protocols (BGP and EGP) Instrukcja Użytkownika Pobierz pdf (Strona 82)

Configuring IP Exterior Gateway Protocols (BGP and EGP)

5-24

308628-14.00 Rev 00

Verifying MD5 Signatures on Received BGP TCP Packets

When TCP receives a packet, it checks whether the connection has been

configured for authentication. If it has, TCP verifies that the packet contains a

kind=19 option. If the packet does not contain that option, then TCP logs a “TCP

MD5 No Signature” event and discards the packet, but does not close the TCP

connection.

When TCP receives a packet with the kind=19 option, it first verifies that an MD5

authentication key has been configured for the TCP connection.

• If the key has not been configured, TCP logs a “TCP MD5 No Key

Configured” event and discards the packet but does not close the TCP

connection.

• If the key has been configured, TCP computes the expected MD5 signature

and compares the computed signature with the received MD5 signature. If the

signatures match, TCP sends the packet to BGP. If the signatures do not

match, TCP logs a “TCP MD5 Invalid Signature” event and discards the

packet but does not close the TCP connection.

• The occurrence of any of these errors increments the total count of TCP

connection MD5 errors (wfTcpConnMd5Errors).

You can enter an optional, variable-length ASCII authentication key for each BGP

peer. This key is stored in the wfBgpPeerTcpMd5Key MIB object. Entering the

authentication key also enables authentication for the peer connection. Both peers

must be configured with the same authentication key. When an authentication key

is stored in the MIB or the configuration file, it can optionally be encrypted using

DES with the NPK/MEK key, as selected by the wfBgpPeerTcpMd5KeyStorage

MIB object.

By default, BGP-4 MD5 authentication is disabled.

Use the Technician Interface secure shell or the Site Manager WEP Key Manager

to enter the message encryption key/node protection key (NPK/MEK) value

before setting the MD5 authentication parameters. For information on Technician

Interface secure shell, see Configuring IPsec Services. For information on DES,

WEP, and NPK, see Configuring Data Encryption Services.You can enter the

authentication keys through Site Manager or the BCC.

1 2 ... 77 78 79 80 81 82 83 84 85 86 87 ... 307 308

Brak uwag

Avaya Configuring IP Exterior Gateway Protocols (BGP and EGP) Instrukcja Użytkownika Strona 82