check this guide
In order for a BGP session with MD5 authentication to be successfully established, these three issues must be resolved:
-
Disable TCP sequence number randomization
-
Disable TCP MD5 option rewriting
-
Disable NAT between peers
ASA/PIX: BGP through ASA Configuration Example - Cisco
ciscoasa# sh run
: Saved
:
ASA Version 8.2(1)
!
hostname ciscoasa
domain-name example.com
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
!--- Configure the outside interface.
interface Ethernet0/0
nameif outside
security-level 0
ip address 172.16.12.10 255.255.255.0
!
!--- Configure the inside interface.
interface Ethernet0/1
nameif inside
security-level 100
ip address 172.16.11.10 255.255.255.0
!
!-- Output suppressed.
!--- Access list to allow incoming BGP sessions !--- from the outside peer to the inside peer
access-list OUTSIDE-ACL-IN extended permit tcp host 172.16.12.2 host 172.16.11.1 eq bgp
!--- Access list to match BGP traffic.
!--- The next line matches traffic from the inside peer to the outside peer
access-list BGP-MD5-ACL extended permit tcp host 172.16.11.1 host 172.16.12.2 eq bgp
!--- The next line matches traffic from the outside peer to the inside peer
access-list BGP-MD5-ACL extended permit tcp host 172.16.12.2 host 172.16.11.1 eq bgp
!
!--- TCP-MAP to allow MD5 Authentication.
tcp-map BGP-MD5-OPTION-ALLOW
tcp-options range 19 19 allow
!
!--- Apply the ACL that allows traffic !--- from the outside peer to the inside peer
access-group OUTSIDE-ACL-IN in interface outside
!
asdm image disk0:/asdm-621.bin
no asdm history enable
arp timeout 14400
route outside 0.0.0.0 0.0.0.0 172.16.12.2 1
route inside 192.168.10.0 255.255.255.0 172.16.11.1 1
http server enable
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet timeout 5
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
!
class-map inspection_default
match default-inspection-traffic
class-map BGP-MD5-CLASSMAP
match access-list BGP-MD5-ACL
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
class BGP-MD5-CLASSMAP
set connection random-sequence-number disable
set connection advanced-options BGP-MD5-OPTION-ALLOW
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:64ea55d7271e19eea87c8603ab3768a2
: end
