How do you secure a BGP session and the router running it?
Show the answer
Say this first
In layers. Authenticate the TCP session (MD5, or TCP-AO where supported). Use GTSM (ttl-security hops 1) so
only a directly connected device can reach port 179. Allow 179 only from configured peers with an
infrastructure ACL and control plane policing. Filter prefixes both ways: only my space out, bogons and
too-specific routes in. Cap each session with maximum-prefix, and validate origins with RPKI. Most real
incidents are leaks and hijacks, so route filtering matters more than the password.
Go deeper
router bgp 64500
neighbor 192.0.2.1 remote-as 64496
neighbor 192.0.2.1 password Example-Key-2026
neighbor 192.0.2.1 ttl-security hops 1
neighbor 192.0.2.1 prefix-list FROM-ISP in
neighbor 192.0.2.1 prefix-list OUR-PREFIXES out
neighbor 192.0.2.1 maximum-prefix 2000 80| Threat | Control |
|---|---|
| Spoofed TCP resets or session hijack | MD5 or TCP-AO, GTSM |
| CPU exhaustion through port 179 | Infrastructure ACL, CoPP |
| Peer sends junk or a leak | Inbound prefix filters, maximum-prefix, RPKI |
| You leak by mistake | Outbound prefix and AS path filters |
| Someone announces your space | ROAs for your prefixes, monitoring |
MANRS
The industry baseline for network operators, MANRS, asks for four actions: filtering, anti-spoofing (BCP 38 source address validation), coordination (up-to-date contacts) and global validation (publishing IRR and RPKI data).
They will ask next
What is wrong with MD5?
MD5 is a weak hash and the option has no clean key rollover. TCP-AO (RFC 5925) fixes both, but support is uneven, so MD5 is still what most ISPs offer.
Traps
- Treating the MD5 password as the main protection. It stops spoofed resets, not bad routes.