3.3.3.1 Set 'neighbor password'

Information

Enable message digest5 (MD5) authentication on a TCP connection between two BGP peers

Enforcing routing authentication reduces the likelihood of routing poisoning and unauthorized routers from joining BGP routing.

Solution

Configure BGP neighbor authentication where feasible.

hostname(config)#router bgp <<em>bgp_as-number</em>>
hostname(config-router)#neighbor <<em>bgp_neighbor-ip</em> | <em>peer-group-name</em>> password <<em>password</em>>

Impact:

Organizations should plan and implement enterprise security policies that require rigorous authentication methods for routing protocols. Using the 'neighbor password' for BGP enforces these policies by restricting the type of authentication between network devices.

See Also

https://workbench.cisecurity.org/benchmarks/17130

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-3

Plugin: Cisco

Control ID: a1a7d196b0253237bd83aba63018e5d68ecb66495e4a6bbf8b41e894c0c9492d