neighbor [ip] password [key]
Enables MD5 authentication on a BGP peer session to prevent spoofed TCP resets.
Definition: neighbor [ip] password [key] is a Cisco IOS router config command. Enables MD5 authentication on a BGP TCP session. Both peers must configure the same password; sessions without a matching password are rejected. Protects BGP sessions from spoofed TCP RST attacks.
neighbor <ip-address> password <password-string>When to Use This Command
- Securing eBGP sessions with ISPs that require MD5 authentication.
- Protecting BGP sessions from BGP session hijacking attacks.
- Meeting security compliance requirements for internet-facing routers.
- Standard practice on all public eBGP sessions.
Command Examples
Configure MD5 auth between eBGP peers
R1(config)# router bgp 65001
R1(config-router)# neighbor 203.0.113.1 password Cisco123!R1(config-router)# %TCP-6-BADAUTH: No MD5 digest from 203.0.113.1:179 to 10.0.0.1:32145
The warning means the peer sent a packet without MD5 authentication. Once the ISP also configures the same password, the session establishes normally. Mismatched passwords generate this log continuously.
Verify authentication in neighbor detail
R1# show ip bgp neighbors 203.0.113.1 | include authOption flags: nagle, md5
The 'md5' flag confirms authentication is active on this session.
Understanding the Output
No immediate output, but TCP authentication failures generate syslog messages (%TCP-6-BADAUTH). Verify with 'show ip bgp neighbors [ip]' and look for 'md5' in the option flags. The password is stored in plaintext in the running config (or with type 7 encoding with 'service password-encryption').
Never use weak passwords for BGP MD5.
CCNA Exam Tips
CCNA exam tip: Both sides must have the SAME password — a mismatch keeps the session in Active state with MD5 error syslog messages.
CCNA exam tip: MD5 is the only BGP authentication method in classic IOS (BGPsec is a newer standard not tested in CCNA).
CCNA exam tip: The password is case-sensitive.
CCNA exam tip: Changing or removing the password on a live session resets the BGP session.
Common Mistakes
Mistake 1: Case mismatch in passwords — 'Cisco123' and 'cisco123' are different; the session will never establish.
Mistake 2: Configuring password on only one side — generates continual %TCP-6-BADAUTH syslog messages.
Mistake 3: Forgetting that changing the password resets the BGP session, causing a traffic outage.
neighbor [ip] password [key] vs neighbor [ip] remote-as [asn]
Both the 'neighbor password' and 'neighbor remote-as' commands are configured under the same BGP neighbor statement, which often leads to confusion. While they are both essential for building a BGP session, they serve distinct purposes: one authenticates the TCP connection, the other defines the remote peer's AS number.
| Aspect | neighbor [ip] password [key] | neighbor [ip] remote-as [asn] |
|---|---|---|
| Primary Function | Enables MD5 authentication for the BGP TCP session | Defines the BGP neighbor's IP and AS number |
| Configuration Mode | Router config (BGP) | Router config (BGP) |
| Persistence in Running Config | Persists until removed | Persists until removed |
| Effect on BGP Session | Session rejected if password mismatch; no effect on AS verification | Determines iBGP/eBGP session type; must match remote AS for session to establish |
| Typical Use | Secure BGP sessions against spoofed TCP resets | Establish peering with a specific autonomous system |
Use neighbor [ip] password [key] when you need to authenticate BGP TCP segments to prevent unauthorized BGP sessions or spoofed TCP attacks.
Use neighbor [ip] remote-as [asn] when you need to specify the BGP peer's autonomous system number to initiate peering (iBGP if same AS, eBGP if different).
Related Commands
neighbor [ip] remote-as [asn]
Defines a BGP neighbor (peer) by specifying its IP address and AS number. If the remote AS matches the local AS, this creates an iBGP session; if different, it creates an eBGP session.
router bgp [asn]
Enters BGP router configuration mode and creates a BGP process with the specified autonomous system (AS) number. This is the first command required to configure BGP on a Cisco router.
show ip bgp summary
Displays a summary of the BGP neighbor status and prefix counts, used to quickly verify BGP peering and routing table health.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions