How should you secure BGP sessions with both IPv4 and IPv6 peers?

• A. Use identical authentication across both, such as MD5 or TCP-AO with proper keys
• B. Use MD5 for IPv4 and none for IPv6
• C. Use TLS for IPv6 only
• D. Do not authenticate BGP at all

Answer: (A)

Securing BGP sessions means protecting the TCP stream that carries the BGP messages, so both IPv4 and IPv6 neighbor relationships should be authenticated in the same way with the same credentials. Using the same method and the same keys across both address families ensures every BGP session has equivalent protection, avoids configuration gaps, and minimizes management complexity. MD5 or TCP-AO are common choices because they provide authentication and integrity for the BGP session without changing how BGP itself operates over TCP.

If you authenticate one session but not the other, or use a different method for IPv6, you create a weak link where a forged or spoofed connection could appear for the unprotected session. TLS is not the standard approach for BGP in most deployments, since BGP normally runs over TCP with its own per-session authentication; relying on TLS for IPv6 only would require broader changes and isn’t aligned with typical BGP practice. Not authenticating at all leaves you highly exposed to session hijacking and spoofed peers.

So, applying the same authentication method with proper keys to both IPv4 and IPv6 BGP sessions is the best practice.