Configuring Md5 Authentication - Huawei S6700 Series Configuration Manual

S6700 Series Ethernet Switches
Configuration Guide - IP Routing
l
l
Pre-configuration Tasks
Before configuring BGP security, complete the following task:
l
Data Preparation
To configure BGP security, you need the following data.
No.
1
2
3

7.18.2 Configuring MD5 Authentication

In BGP, MD5 authentication sets an MD5 authentication password for a TCP connection, and
is performed by TCP. If authentication fails, no TCP connection will be established.
Procedure
Step 1 Run:
system-view
The system view is displayed.
Issue 01 (2012-03-15)
Keychain authentication
A keychain consists of multiple authentication keys, each of which contains an ID and a
password. Each key has a lifecycle. Based on the life cycle of a key, you can dynamically
select different authentication keys from the keychain. After keychains with the same rules
are configured on the two ends of a BGP connection, the keychains can dynamically select
authentication keys to enhance BGP attack defense.
GTSM
GTSM checks TTL values to defend against attacks. For example, an attacker forges BGP
packets and keeps sending them to one switch. After receiving these packets, the switch
identifies the destination of the packets. The forwarding plane of the switch then directly
sends the packets to the control plane for processing without checking the validity of the
packets. As a result, the switch is busy processing these "valid" packets, resulting in high
CPU usage.
GTSM checks whether or not the TTL value in the IP header is within a specified range,
protecting the switch against attacks and improving system security.
NOTE
l The S6700 supports GTSM.
l GTSM supports only unicast addresses; therefore, the GTSM function must be configured on all
the switchs configured with BGP.
Configuring Basic BGP Functions
Data
Each switch's peer address or peer group name
MD5 authentication password
Keychain authentication name
Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
7 BGP Configuration
439