Invalid MD5 digest – BGP Traffic Through Check Point

Issue

When allowing eBGP traffic through a Check Point Firewall you may receive the following error message on your BGP peered routers. (This error may occur at the point of pushing a policy to your Check Point Firewall),

TCP-6-BADAUTH: Invalid MD5 digest from [Source IP]:[Source Port] to [Dest IP]:179

Solution

This is down to the Check Point State Table and the TCP sequence number of the BGP Traffic changing at the point of policy push.

To prevent this occurring you will need to change the following settings,

  • Check Point Gateway Object > Advanced > Connection Persistence > (Tick) Keep all connections
    • Services > TCP > BGP Service > (Tick) Keep connections open after Policy has been installed

 

Rick Donato
Latest posts by Rick Donato (see all)

Want to become an IT Security expert?

Here is our hand-picked selection of the best courses you can find online:
Internet Security Deep Dive course
Complete Cyber Security Course – Hackers Exposed
CompTIA Security+ (SY0-601) Certification Complete course
and our recommended certification practice exams:
AlphaPrep Practice Tests - Free Trial