While upgrading device from Junos 19 to Junos 21, you may notice configuration validation failed when authentication-algorithm knob is applied on a BGP peer.
Example : MX-104 being upgrade from 19.4R3-S7.3 to 21.2R3-S7.7.
You may notice below validation failed error when RE is loading initial configuration.
RE boot logs :
Create /var/db/scriptCreating initial configuration...<output>
[edit protocols bgp group <Group-name> authentication-algorithm]
'authentication-algorithm aes-128-cmac-96'
May not be configured without authentication-key-chain
</output>
mgd: error: commit failed: (statements constraint check failed)
Validation failed
ERROR: Current configuration not compatible with /var/tmp/jinstall-ppc-21.2R3-S7.7-signed.tgz
ERROR: Configuration validation failed with /var/tmp/jinstall-ppc-21.2R3-S7.7-signed.tgz
This is expected behaviour as Authentication configuration under neighbour is incomplete as there is no authentication-key-chain configured.
As per Junos 21 version, there is an added sanity check for config to not allow such config. Whenever a customer configures TCP authentication algorithm under protocol bgp or protocol bgp group or protocol bgp neighbour, they need to configure both authentication-algorithm and authentication-key-chain. Configuring only one of them will be rejected. To proceed with the upgrade: You can either delete the authentication-algorithm knob or add both authentication-algorithm and authentication-key-chain as per customer convenience and then proceed for upgrade.
Example:
set protocols bgp group xxx authentication-algorithm aes-128-cmac-96 <<<set protocols bgp group xxx neighbor x.x.x.x authentication-key "key"
Restoration 1: Delete authentication-algorithm
> edit Entering configuration mode[edit]# delete protocols bgp group xxx authentication-algorithm aes-128-cmac-96 # commit commit complete
or
Restoration 2: Configure authentication-algorithm-key-chain
[edit]#set protocols bgp group xxx neighbor x.x.x.x authentication-key-chain test#commitcommit complete