RIPE Border Gateway Protocol (BGP) Security Practice Test

TCP-MD5 secures the BGP session by authenticating the underlying TCP connection with a shared secret. It adds an MD5-based hash to TCP segments so both peers can verify that the other side knows the secret, preventing unauthorized peers from establishing or hijacking the BGP session. It does not encrypt BGP messages or sign them at the application layer, so confidentiality and per-message integrity beyond the TCP connection aren’t provided by TCP-MD5 itself. Enable TCP-MD5 when the route between peers traverses untrusted networks or there is a higher risk of spoofing, such as across the public Internet or between operators with potential misconfigurations. Configuration requires sharing the same secret on both ends; if the secret mismatches or one side doesn’t support it, the session will fail to establish. In short, TCP-MD5 protects the integrity of the TCP session used by BGP, not the content of BGP messages themselves, and is most useful where the risk of spoofed TCP connections is nontrivial.