BGP runs over TCP port 179, so anyone who can send forged segments to a router can try to disturb a session. Authentication stops that. Timers decide how fast a dead neighbour is noticed.
Advanced · 12 min read
You'll learn to configure MD5 authentication for a BGP neighbour, explain what a mismatch looks like, and set keepalive and hold timers with the negotiation rule in mind.
Why authenticate a BGP session
A forged TCP reset sent to a BGP router can tear down a session. On a customer link the attacker needs to know only the two addresses and port 179. TCP MD5 authentication adds a signature to every segment, calculated with a password both routers know. A segment without the right signature is ignored.
What authentication protects against
On small screens, swipe sideways or focus the diagram and use the arrow keys.
R1. ISP A must configure the same password. Use a real secret in production; this value is an example.
TCP MD5 authentication: matching and mismatched passwords
On small screens, swipe sideways or focus the diagram and use the arrow keys.
A mismatch looks like a connectivity problem, not an authentication error, because the receiving router discards the segments.
When the passwords differ, nothing looks wrong on the cable. The router logs a message and the session never reaches Established, which can be confused with a reachability problem.
Illustrative Cisco IOS XE output written for this lesson, not a router capture
R1#show logging | include MD5
%TCP-6-BADAUTH: Invalid MD5 digest from 192.0.2.1(179) to 192.0.2.2(45123) tableid - 0
This message is the clue. The TCP connection arrived but the digest did not match, so the passwords differ or one side has none configured.
Timers and the hold-time rule
Keepalive 60 s, hold time 180 s: what a silent neighbour looks like
On small screens, swipe sideways or focus the diagram and use the arrow keys.
Every KEEPALIVE or UPDATE restarts the hold timer. Missing three keepalives in a row is what ends the session with the default timers.
The keepalive proves a neighbour is alive when there is nothing else to say. The hold time is how long a router waits without hearing anything before declaring the neighbour dead. Each side sends its proposed hold time in the OPEN message and the lower value is used.
router bgp 64500
neighbor 192.0.2.1 timers 20 60
R1: keepalive 20 seconds and hold time 60 seconds for this neighbour only. Setting them globally with timers bgp 20 60 applies to every neighbour.
Illustrative Cisco IOS XE output written for this lesson, not a router capture
R1#show ip bgp neighbors 192.0.2.1 | include hold|keepalive
Last read 00:00:10, last write 00:00:08, hold time is 60, keepalive interval is 20 seconds
If this shows a smaller hold time than you configured, the neighbour proposed a lower one and the lower value won. Check what the other side has configured.
Shorter timers detect failures faster but make sessions more sensitive to congestion. For link failures that need sub-second detection, use BFD, which the Advanced BGP course covers.
R1 proposes hold time 180 and the neighbour proposes 90. Which is used?
Predict · scenario 2
The neighbour is reachable by ping, but the BGP session never leaves Active and the log shows BADAUTH. What is wrong?
Predict · scenario 3
With the default keepalive of 60 seconds, what is the default hold time?
FAQ
What are the default timers?
Keepalive 60 seconds and hold time 180 seconds on Cisco IOS XE. The hold time is three times the keepalive.
Which hold time does a session use?
Each side sends its hold time in the OPEN message and both use the lower of the two. The keepalive is then one third of the negotiated hold time unless configured lower.
Is MD5 enough?
It proves the sender knows the shared secret and protects against spoofed segments, but MD5 is old. TCP-AO is the modern replacement where both ends support it.