Which approach to securing BGP sessions is recommended for new deployments?

• A. Use MD5 with weak keys
• B. Prefer TCP-AO if supported; otherwise use MD5 with proper key management; ensure compatibility across peers
• C. Disable BGP authentication for performance
• D. Use TLS to encrypt the BGP session

Answer: (B)

Securing BGP sessions hinges on authenticating the TCP connection between peers and preventing spoofing. For new deployments, the recommended approach is to prefer TCP-AO if both ends support it. TCP-AO provides stronger, per-session authentication and supports better key management and algorithm agility than traditional MD5, making it harder for an attacker to impersonate a neighbor and easier to rotate keys over time. If TCP-AO isn’t available on one side, fallback to MD5 but with proper key management: use strong, unique keys, rotate them regularly, and ensure both peers use compatible keys and algorithms so the session can establish reliably. Compatibility across peers is essential to avoid dropped sessions.

Disabling authentication is insecure and leaves the session open to spoofing, and using TLS to encrypt the BGP session is not a standard, widely-supported practice for BGP today, so it isn’t a practical baseline for new deployments.