This article explains an issue where BGP peering goes down after adding authentication key on both sides for the secure connection.

• If there is an existing BGP peering on the SRX device and you add an authentication key for a secure connection, you’ll notice that the BGP peering will go down.
• It will not come back up until the authentication key is removed from the SRX configuration.

• When you configure a routing instance on the SRX without specifying its type as virtual-router, SRX will use the no-forwarding type by default, which has very limited routing functionalities.
• BGP authentication feature will not work when the routing instance is of type no-forwarding. This is an expected behaviour. You need to change the routing-instance type to virtual-router to make it work.

Example:

routing-instances {
            FW-VR-1 {
                instance-type virtual-router; >>>>>>>>>
                protocols {
                    bgp {
                        group BGP_GROUP {
                            type external;
                            hold-time 90;
                            import DENY_ALL_IMPORT_EXPORT;
                            export DENY_ALL_IMPORT_EXPORT;
                            peer-as 65100;
                            local-as 64800;
                            multipath;
                            bfd-liveness-detection {
                                version automatic;
                                minimum-interval 900;
                                multiplier 3;
                            }
                            neighbor 10.16.16.17;
                            neighbor 10.16.16.14;
                        }

2026-05-29 : Article Created

2026-06-02: Added Related information and PR link

Define the type of routing instance: https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/instance-type-edit-routing-instances-vp.html