What are the best ways to authenticate BGP?

BGP or Border Gateway Protocol is a crucial protocol for routing information between autonomous systems (AS) on the internet. However, BGP is also vulnerable to attacks such as hijacking, spoofing, or denial of service. To prevent these threats, you need to authenticate your BGP sessions and ensure that only trusted peers can exchange valid routes. In this article, you will learn about the best ways to authenticate BGP and how to implement them in your network.

Find expert answers in this collaborative article

Selected by the community from 3 contributions. Learn more

1 MD5 Authentication

MD5 or Message Digest 5 is a widely used method for BGP authentication. It works by appending a secret key to each BGP message and generating a hash value using the MD5 algorithm. The receiver then verifies the hash value using the same key. If the hash values match, the message is authentic. If not, the message is discarded. MD5 authentication is simple to configure and supported by most BGP implementations. However, it has some limitations, such as being vulnerable to brute force attacks or key compromise.

Add your perspective

Tebogo Mashiane

GCP PCSE | 22 x Azure | Microsoft certified | 9 x OCI Certified | Cybersecurity enthusiast| QRadar certified| Scrum Foundation Professional Certificate (SFPC)
Report contribution
BGP authentication prevents routers from receiving unauthorised routing information. Best practices for BGP authentication Secure BGP peer TCP connections using MD5 authentication. BGP sessions are limited to verified peers. Limit BGP session IPs via IP prefix-based ACLs. Restricting peers by IP address improves security. Promote only permitted routes using route filtering. This prevents network-wide unapproved or malicious routes. BGP TTL security limits packet hops to avoid attacks. Unauthorised BGP packet injection into the network is prevented. Periodically change authentication keys to prevent unwanted access. Industry BGP security best practices include unique AS numbers, route validation, and router security upgrades.

Like

2 TCP-AO Authentication

TCP-AO or TCP Authentication Option is a newer and more secure method for BGP authentication. It works by using a master key to generate session keys that are periodically changed. The session keys are then used to encrypt and authenticate each BGP message using the AES algorithm. The receiver then decrypts and verifies the message using the same session key. TCP-AO authentication is more resistant to brute force attacks, replay attacks, or key compromise. However, it is more complex to configure and requires newer BGP implementations that support it.

Add your perspective

Tebogo Mashiane

GCP PCSE | 22 x Azure | Microsoft certified | 9 x OCI Certified | Cybersecurity enthusiast| QRadar certified| Scrum Foundation Professional Certificate (SFPC)
Report contribution
TCP-AO (Authentication Option) authenticates and protects TCP segments. It prevents unauthorised parties from introducing harmful data or impersonating genuine endpoints to secure TCP connections. TCP-AO protects BGP peer TCP connections in many applications. The TCP-AO authentication process consists of crucial establishment, authentication option, MAC calculation, verification, and invalid segment rejection. However, TCP-AO involves more setup and effort than standard TCP connections but offers greater security. Its increased security is frequently worth the additional work, particularly in BGP, where control plane security is crucial.

Like

3 IPsec Authentication

IPsec or Internet Protocol Security is another method for BGP authentication. It works by creating a secure tunnel between the BGP peers and encrypting and authenticating all the traffic that passes through it using the IKE protocol. The IKE protocol uses a pre-shared key or a certificate to establish a shared secret key that is used to generate session keys. The session keys are then used to encrypt and authenticate each BGP packet using the ESP or AH protocol. IPsec authentication is very secure and flexible, as it can protect any IP traffic. However, it is also very resource-intensive and may affect the performance of the BGP sessions.

Add your perspective

Tebogo Mashiane

GCP PCSE | 22 x Azure | Microsoft certified | 9 x OCI Certified | Cybersecurity enthusiast| QRadar certified| Scrum Foundation Professional Certificate (SFPC)
Report contribution
IPsec authenticates and encrypts IP transmissions. The entire security solution secures BGP sessions and network traffic. AH offers IPsec authentication with connectionless integrity, data origin authentication, and optional anti-replay. AH guards the IP packet header elements and content except TTL. AH authenticates BGP packets to avoid transit alteration. IPsec authenticates IP packets via HMAC-SHA-1, SHA-256, and MD5. IPsec needs a key management system to produce and store cryptographic keys for authentication and encryption. Key management protocols include IKE. Set up key exchange, authentication, and algorithms. IPsec-based BGP authentication avoids eavesdropping, manipulation, and other dangers. IPsec secures BGP and IP.

Like

4 RPKI Authentication

RPKI or Resource Public Key Infrastructure is not a method for BGP authentication per se, but rather a framework for validating the origin and path of the BGP routes. It works by using cryptographic certificates to link the AS number and the IP address prefixes that belong to each AS. The certificates are issued and verified by a hierarchy of trusted authorities. The BGP peers then use the certificates to check if the routes they receive are legitimate and authorized by the owners of the prefixes. RPKI authentication can prevent hijacking or spoofing of the BGP routes. However, it does not protect the integrity or confidentiality of the BGP messages.

Add your perspective

5 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?

Add your perspective

What are the best ways to authenticate BGP?

1

2

3

4

5

1 MD5 Authentication

2 TCP-AO Authentication

3 IPsec Authentication

4 RPKI Authentication

5 Here’s what else to consider

Network Engineering

Rate this article

Thanks for your feedback

More articles on Network Engineering

More relevant reading

What are the best ways to authenticate BGP?

1

2

3

4

5

1 MD5 Authentication

2 TCP-AO Authentication

3 IPsec Authentication

4 RPKI Authentication

5 Here’s what else to consider

Network Engineering

Rate this article

Thanks for your feedback

Explore Other Skills