Avaya Configuring IP Exterior Gateway Protocols (BGP and EGP) Manuel d'utilisateur télécharger pdf (Page 81)

Configuring and Customizing BGP

308628-14.00 Rev 00

5-23

Configuring BGP Authentication

You can configure BGP MD5 authentication using the BCC or Site Manager. This

guide describes how to configure the BGP TCP MD5 authentication attributes

with the BCC and Site Manager interfaces. The BCC, Site Manager, and secure

shell interfaces accept and display the authentication keys as unencrypted

character strings, regardless of whether the underlying storage is clear or

encrypted. That is, these interfaces can encrypt a key before saving it and decrypt

it before displaying it. They also handle the necessary conversion from character

string to octet string. The Technician Interface, however, displays a key just as it is

stored in the MIB.

The attributes that you must configure within the MIB entry wfBgpPeerEntry are

wfBgpTcpAuthentication, which enables authentication, wfBgpPeerTcpMd5Key

and wfBgpPeerTcpMd5KeyStorage. TCP monitors the authentication using the

attribute wfTcpConnMd5Errors in the wfTcpConnEntry record.

Initializing TCP with the MD5 Option

If an MD5 authentication key is configured for a BGP peer that has BGP

authentication enabled, then BGP reads the authentication key from the MIB,

decrypts it if necessary, and passes the unencrypted authentication key to TCP. If

there is no NPK available to decrypt an encrypted authentication key, BGP logs an

event: “BGP TCP MD5 NPK No NPK configured.” If TCP receives an MD5

authentication key, it reduces its Maximum Segment Size (MSS) by 18 octets, the

length of the TCP MD5 option. It also adds an MD5 signature to each transmitted

packet.

Generating MD5 Signatures on Transmitted BGP TCP Packets

A BGP peer calculates the MD5 signature for a BGP message on the following

elements:

• TCP pseudo-header

• TCP header, excluding options

• TCP segment data

• TCP MD5 authentication key

The peer inserts the resulting 16-byte MD5 signature into the following TCP

options: kind=19, length=18.

1 2 ... 76 77 78 79 80 81 82 83 84 85 86 ... 307 308

Pas de commentaire

Avaya Configuring IP Exterior Gateway Protocols (BGP and EGP) Manuel d'utilisateur Page 81