Avaya Configuring IP Exterior Gateway Protocols (BGP and EGP) Manual de usuario descargar pdf (Pagina 106)

Configuring IP Exterior Gateway Protocols (BGP and EGP)

4-24

308628-15.0 Rev 00

You can enter the authentication keys using the BCC or Site Manager. Use the

Technician Interface secure shell to enter the NPK/MEK. The BCC, Site Manager,

and secure shell interfaces accept and display the authentication keys as

unencrypted character strings, regardless of whether the underlying storage is

clear or encrypted. That is, these interfaces can encrypt a key before saving it and

decrypt it before displaying it. They also handle the necessary conversion from

character string to octet string. The Technician Interface, however, displays a key

just as it is stored in the MIB. TCP monitors the authentication using the attribute

wfTcpConnMd5Errors in the wfTcpConnEntry record.

Initializing TCP with the MD5 Option

If an MD5 authentication key is configured for a BGP peer that has BGP

authentication enabled, then BGP reads the authentication key from the MIB,

decrypts it if necessary, and passes the unencrypted authentication key to TCP. If

there is no NPK available to decrypt an encrypted authentication key, BGP logs an

event: “BGP TCP MD5 NPK No NPK configured.”

Generating MD5 Signatures on Transmitted BGP TCP Packets

A BGP peer calculates the MD5 signature for a BGP message on the following

elements:

• TCP pseudo-header

• TCP header, excluding options

• TCP segment data

• TCP MD5 authentication key

If TCP receives an MD5 authentication key, it reduces its maximum segment size

(MSS) by 18 octets, the length of the TCP MD5 option. It also adds an MD5

signature to each transmitted packet. The peer inserts the resulting 16-byte MD5

signature into the following TCP options: kind=19, length=18.

1 2 ... 101 102 103 104 105 106 107 108 109 110 111 ... 275 276

Sin comentarios

Avaya Configuring IP Exterior Gateway Protocols (BGP and EGP) Manual de usuario Pagina 106