BGP MD5 W/ NAT ENABLED ON PIX

[bcommerford]

Does anyone know if NATing a BGP peer's address on the PIX with MD5 enabled is achievable?

I know the 'norandomseq' tag on a static will work for a regular BGP implementation, however this did not work for a NAT implementation.

Cisco doc for BGP peer via firewall states that hash is calculated on TCP sequence number, although it appears to include the SA/DA from the IP header.

[scoclayton]

Unfortunately, not possible at this time. BGP authentication authenticates the ip header (including the TCP checksum). When you change the source IP address via NAT, the TCP checksum is changed and the packet is no longer valid. The only choices for this type of design is to either "no-nat" the hosts (translate them back to their same address) or to not include the ip header in the TCP checksum, but I am not aware of any "knobs" planned for this in IOS.

Sorry but hope this helps confirm your thoughts.

Scott