IPv6 MP-BGP security implementation: what is typical and challenging?

• A. Use TLS for IPv6 BGP
• B. Use no authentication for simplicity
• C. Only IPv4 needs security; IPv6 is optional
• D. Use MP-BGP with MD5/TCP-AO, ensure IPv6 ROA validation when available, ensure hardware support; challenges include limited deploy base

Answer: (D)

Securing IPv6 MP-BGP focuses on authenticating the BGP session and validating the origin of routes, then ensuring the hardware can support these features. In practice, the typical approach is to run MP-BGP with TCP-based authentication such as MD5 or TCP-AO to protect the BGP session from tampering or session hijacking. Pairing this with IPv6 ROA (RPKI) validation, where available, helps ensure that announced prefixes actually originate from the owning AS listed in the ROA, adding a crucial layer of origin verification. Hardware support is also essential to enable these features efficiently on high-speed routers and to maintain reliability.

The challenges come from the real-world deployment landscape: IPv6 BGP security features have not seen universal adoption, so even when the standards exist, many networks struggle with enabling and maintaining MD5 or TCP-AO across devices from different vendors. ROA validation for IPv6 may not be uniformly available or fully populated yet, so visibility and trust in origin data can be uneven. This combination of limited IPv6 deployment, varying vendor support, and the complexity of configuring secure sessions and consistent ROA checks makes IPv6 MP-BGP security both typical in approach and challenging in practice.