We expect to see the log message "tcp_auth_ok: Packet from <peer> wrong MD5 digest" when there is an MD5 key mismatch between BGP peers.

In some cases, this behavior may be related to issues described in KB78699 [juniper.net].

This document explains another possible reason for similar behavior.

Test Case 1:

DUT   : MD5 Key set to juniper1

Non DUT  : MD5 Key set to Juniper1

Initiator : 2607:XXX:XX:XXXX::2 <<DUT

Client   : 2607:XXXX:XX:XXXX::3

#TCP netstat Output on DUT : No session formed 

labroot@labrouter_RE0> show system connections | match 2607:XXXX:XX:XXXX::   

Dec 11 22:32:27

#TCP netstat Output on NonDUT : SYN_SENT state 

labroot@jtac-mx204-r2058> show system connections | match 2607:XXXX:XX:XXXX::   

tcp6    0   0 2607:XXXX:XX:XXXX::3.57687          2607:XXXX:XX:XXXX::2.179           SYN_SENT

Message Logs on DUT :

Dec 11 22:31:36.821 labrouter_RE0 kernel: tcp_auth_ok: Packet from 2607:XXXX:XX:XXXX::3:57687 wrong MD5 digest

...

Test Case 2: 

DUT   : MD5 Key set to juniper1

Non DUT  : MD5 Key set to Juniper1

Initiator : 2607:XXXX:XX:XXXX::3

Client   : 2607:XXXX:XX:XXXX::2 <<DUT

#TCP netstat Output on DUT : SYN_SENT state 

labroot@labrouter_RE0> show system connections | match 2607:XXXX:XX:XXXX::   

Dec 11 22:55:28

tcp6    0   0 2607:XXXX:XX:XXXX::2.56599          2607:XXXX:XX:XXXX::3.179           SYN_SENT

#TCP netstat Output on NonDUT : No session formed 

labroot@jtac-mx204-r2058> show system connections | match 2607:XXXX:XX:XXXX::   

#Message Logs on DUT

No Error Logs reporting wrong MD5 digest

The DUT reports "wrong MD5 digest" in the system logs when it acts as the connection initiator.