Password 7

[Patrick McHenry]

Hi,

       When you configure a password under BGP and use the "neighbor 1.1.1.1 password password command. How is this hashed? Or is it? When I do a show run it looks to be hashed but, that could only be because I use the service password encryption command. Is the password sent as a hash or clear text?

When I do a show run it looks like so:

neighbor 63.151.46.201 password 7 01520D0B5E0332597608422A5003421BB891N0

Thank you.

[Harold Ritter]

Hi Patrick,

BGP uses an MD5 hash for authentication.

Regards

[Patrick McHenry]

Thank you, Harold.

So, it uses MD5 hash by default? And I suppose the othe other side is using MD5 by default so it can decrypt?

[Peter Paluch]

Patrick, Henry,

If I may join your discussion - there are really two issues here.

The first issue is concerned with the way the BGP password is stored in the configuration. The neighbor password command stores the password as the Type-7 password, i.e. encrypted using the weak cipher that is also used to protect most other passwords in the configuration file after the service password-encryption is configured.

The second issue is concerned with the way the BGP uses this password to protect its session. Now, BGP does the authentication in a very original way - it actually protects all TCP segments using the MD5 hash computed over the TCP segment content and this password. The password is never transmitted in cleartext - rather, it is used to produce the overall MD5 hash added to the TCP header. The receiving BGP speaker receives such a protected segment, computes its own MD5 hash using its own configured password and compares it to the hash in the received segment. If the hash matches, the password must be identical and the segment contents are original. Read more about this protection in RFCs 2385 and 5925.

Best regards,

Peter