Avaya Configuring IP Exterior Gateway Protocols (BGP and EGP) Instrukcja Użytkownika Pobierz pdf (Strona 105)

Configuring BGP Peers

308628-15.0 Rev 00

4-23

When you enable BGP-4 TCP MD5 authentication, the router computes an MD5

signature for each TCP packet, based on the TCP packet and a per-peer secret key.

The router adds this MD5 signature to the TCP packet containing a BGP message

and sends it with the packet, but it does not send the secret key.

The receiver of the TCP packet also knows the secret key and can verify the MD5

signature. A third party trying to masquerade as the sender, however, cannot

generate an authentic signature because it does not know the secret key.

The per-peer secret keys provide the security. If the keys are compromised (for

example, by transfer of the configuration file), then the authentication itself is

compromised. To prevent this, the secret keys can be stored in encrypted form in

the configuration file and the MIB, using the Technician Interface secure shell to

encrypt the per-peer secret keys. The secure shell uses DES to encrypt the secret

keys, and the DES key (the NPK/MEK) is stored in the router’s nonvolatile RAM

(NVRAM).

Use the Technician Interface secure shell to enter the message encryption key/

node protection key (NPK/MEK) value before you set the MD5 authentication

parameters. For information about the Technician Interface secure shell, see

Configuring IPsec Services. You can enter the authentication keys using the BCC

or Site Manager.

Entering and Storing MD5 Authentication Keys

To configure BGP TCP MD5 authentication, set the wfBgpPeerTcpAuthentication

MIB object to MD5. You can then enter an optional, variable-length ASCII

authentication key for each BGP-4 peer. This key is stored in the

wfBgpPeerTcpMd5Key MIB object. Setting the authentication key also enables

authentication for the peer connection. Both peers must be configured with the

same authentication key.

When an authentication key is stored in the MIB or the configuration file, it can

optionally be encrypted using DES with the NPK/MEK key, as selected by the

wfBgpPeerTcpMd5KeyStorage MIB object.

1 2 ... 100 101 102 103 104 105 106 107 108 109 110 ... 275 276

Brak uwag

Avaya Configuring IP Exterior Gateway Protocols (BGP and EGP) Instrukcja Użytkownika Strona 105