Avaya Configuring IP Exterior Gateway Protocols (BGP and EGP) Manual de usuario descargar pdf (Pagina 80)

Configuring IP Exterior Gateway Protocols (BGP and EGP)

5-22

308628-14.00 Rev 00

When BGP-4 TCP MD5 authentication is enabled, a router computes an MD5

signature for each TCP packet, based on the TCP packet and a per-peer secret key.

The router adds this MD5 signature to the TCP packet containing a BGP message

and sends it with the packet, but it does not send the secret key. The receiver of the

TCP packet also knows the secret key and can verify the MD5 signature. A third

party trying to masquerade as the sender, however, cannot generate an authentic

signature because it does not know the secret key. Configurations can

concurrently have BGP peers with authentication enabled and authentication

disabled.

The per-peer secret keys provide the security. Peers configured with common

secret keys can authenticate each other and exchange routing information. If the

keys are compromised (for example, by transfer of the configuration file), then the

authentication itself is compromised. To prevent this, the secret keys can be stored

in encrypted form in the configuration file and MIB, using the Technician

Interface secure shell to encrypt the per-peer secret keys. The secure shell uses

DES to encrypt the secret keys, and the DES key (the NPK/MEK) is stored in the

router’s nonvolatile RAM (NVRAM). The Node Protection Key/Message

Encryption Key (NPK/MEK) is configured using the Technician Interface secure

shell or the Site Manager WEP Key Manager. The TCP MD5 secret keys can

optionally be similarly encrypted.

Entering and Storing MD5 Authentication Keys

To configure BGP TCP MD5 authentication, set the wfBgpPeerTcpAuthentication

MIB object to MD5. You can then enter an optional, variable-length ASCII

authentication key for each BGP-4 peer. This key is stored in the

wfBgpPeerTcpMd5Key MIB object. Entering the authentication key also enables

authentication for the peer connection. Both peers must be configured with the

same authentication key. When an authentication key is stored in the MIB or the

configuration file, it can optionally be encrypted using DES with the NPK/MEK

key, as selected by the wfBgpPeerTcpMd5KeyStorage MIB object.

You can enter the authentication keys through Site Manager or the BCC. Use the

Technician Interface secure shell to enter the NPK/MEK.

1 2 ... 75 76 77 78 79 80 81 82 83 84 85 ... 307 308

Sin comentarios

Avaya Configuring IP Exterior Gateway Protocols (BGP and EGP) Manual de usuario Pagina 80