RFC 2385 TCP MD5 support on FreeBSD8.3

Mike Tancsa mike at sentex.net
Thu Sep 6 15:31:19 UTC 2012

On 9/6/2012 11:16 AM, SivaReddy Obili wrote:
> But we were not able to configure BGP MD5 on that machine.

Perhaps you could post some details as to what you tried. Did you
recompile the kernel with MD5 support ?

In the kernel, you need

options    TCP_SIGNATURE
options    IPSEC
device     crypto

If you have not built a customer kernel,
cd /usr/src/sys/i386/conf
cp GENERIC router

in the file router,

options    TCP_SIGNATURE
options    IPSEC
device     crypto

in /etc/make.conf add

cd /usr/src
make -j4 buildkernel && make installkernel

Then, in /etc/ipsec.conf add something like

#.18 is the local machine, .29 the remote machine
add tcp 0x1000 -A tcp-md5 "HelloMD5" ;

add to /etc/rc.conf

ipsec_enable="YES"              # Set to YES to run setkey on ipsec_file
ipsec_file="/etc/ipsec.conf"    # Name of config file for setkey

cd to /usr/ports/net/quagga and make install

in your bgp config, the peer needs a line like

 neighbor password HelloMD5


Mike Tancsa, tel +1 519 651 3400
Sentex Communications, mike at sentex.net
Providing Internet services since 1994 www.sentex.net
Cambridge, Ontario Canada   http://www.tancsa.com/

More information about the freebsd-questions mailing list