Detections
Analytics

3.2.2 BGP TCP Authentication Option (TCP-AO)

Information

BGP TCP Authentication Option (TCP-AO) (RFC 5925) support adds a new option for BGP message and TCP segments authentication using superior hashing algorithms such as HMACs and CMACs as an improvement over TCP MD5, with stronger hashing algorithms providing higher security and protection against replays attacks. It also provides better key management by coordinating between the endpoints to rotate to a new secret key or the master key tuple (MKT) without resetting the TCP connection.

EOS supports BGP message authentication via the TCP MD5 Signature (TCP MD5) option (RFC 2385) to protect the BGP sessions from spoofed TCP segments. However, research has shown many concerns that the TCP MD5 algorithm is cryptographically ineffective with a just simple keyed hash for authentication.

Solution

Enable TCP-AO using the secret keys in Shared Secret Profile NAME with a specified algorithm:

router bgp {ASN}
 neighbor NEIGHBOR_ID password shared-secret profile NAME algorithm ALGORITHM

See Also

https://workbench.cisecurity.org/benchmarks/25683

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-3(1)

Plugin: Arista

Control ID: 43f73be96ad333615b91913bc53344673ba6476661563481b6f491ea13939d19