BGP TTL Security, Pt. 3 (IOS-XR)
TTL Security works slightly differently on IOS-XR, so it’s worth looking at it separately.
In IOS-XR, you cannot set a maximum number of hops when you use ttl-security. The eBGP neighbor can only be one hop away.
RP/0/0/CPU0:XR5(config-bgp)#neighbor 4.4.4.4 ttl-security ?
inheritance-disable Prevent ttl-security from being inherited from the parent
<cr>Let’s add a new router, XR5, to our topology and setup an eBGP session between R4 and XR5
Lab
The TTL used by each router is 255 as we would expect
iBGP with ttl-security
ttl-security is only an eBGP feaure. You cannot use it on iBGP sessions.
If you try to use ttl-security on an iBGP peer in IOS-XR, it will not let you commit:
On IOS-XE, it will reject the command:
Summary
To re-iterate, there is no way to use ttl-security on IOS-XR with an eBGP neighbor that is multiple hops away. ttl-security on IOS-XR is always a maximum hop of 1.
I suppose Cisco believes that the more hops away you are, the less secure it is. As any attacker can theoretically compromise the session as long as they are within the TTL limits of the session. The most secure setup therefore, is when you run ttl-security on directly connected eBGP neighbors.
If you want to secure a multihop eBGP session on IOS-XR, your next best option is to use TCP MD5 Authentication, which we will look at next.
Last updated