Alert Type

PSN - Product Support Notification
MediumImpact systems with BGP "authentication-algorithm" configuration. Does not impact systems without the BGP "authentication-algorithm".
HighUpgrade a router with incomplete BGP "authentication-algorithm" clauses will result in unusable router.

Product Affected

All products running Junos 21.2R2 or later with BGP "authentication-algorithm" configuration

Alert Description

Before 21.2R2, platforms running Junos OS and Junos OS Evolved allow to have the BGP “authentication-algorithm” config clause without the “authentication-key-chain” config clause. Without the “authentication-key-chain” config clause, the TCP session authentication configuration is incomplete and not functioning.

Starting with Junos and Junos Evolved software version 21.2R2, a commit-check is added via PR1571705 to enforce BGP authentication to have the required “authentication-algorithm” and the “authentication-key-chain” configuration clauses. Missing one of them will cause failure when commit.
 

Solution

While doing software upgrades/ISSU with the "no-validate" option, from any version before 21.2R2 to any version starting 21.2R2 and later, make sure you have a complete TCP session authentication configuration. Either it should be complete with both “authentication-algorithm” and “authentication-key-chain” clauses or neither should be present.

Modification History

First publication 2022-08-11