--- title: TCP Autentication Option (TCP-AO) « BGP Labs | daily.dev description: A hands-on lab guide for protecting EBGP sessions using TCP Authentication Option (TCP-AO) as defined in RFC 5925, replacing the older MD5 checksum approach.... canonical: https://daily.dev/posts/tcp-autentication-option-tcp-ao-bgp-labs-xitbdrn8b twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: TCP Autentication Option (TCP-AO) « BGP Labs | daily.dev og:description: A hands-on lab guide for protecting EBGP sessions using TCP Authentication Option (TCP-AO) as defined in RFC 5925, replacing the older MD5 checksum approach.... og:url: https://daily.dev/posts/tcp-autentication-option-tcp-ao-bgp-labs-xitbdrn8b og:image: https://api.daily.dev/og/posts/XitBdrn8B.png og:image:alt: TCP Autentication Option (TCP-AO) « BGP Labs og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # TCP Autentication Option (TCP-AO) « BGP Labs **[ipSpace.net Blog](https://daily.dev/sources/ipspace)** · 4 min read · 0 upvotes · 0 comments ## Summary A hands-on lab guide for protecting EBGP sessions using TCP Authentication Option (TCP-AO) as defined in RFC 5925, replacing the older MD5 checksum approach. Covers infrastructure requirements (Linux kernel lacks TCP-AO support, so VMs are required), supported devices (Arista EOS, Cisco CSR 1000v, Nokia SR-OS), topology adjustments, and step-by-step configuration tasks including neighbor-specific secrets and HMAC-SHA1-96 algorithm. Includes verification commands showing BGP session establishment and TCP-AO detail inspection on Arista EOS. Requires netlab release 1.6.3 or later. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Does Linux kernel support TCP-AO for BGP session protection? Linux kernel does not support TCP-AO (as of September 2023), which means FRRouting containers and Arista cEOS containers cannot be used for TCP-AO BGP session protection. Arista cEOS relies on the underlying Linux TCP/IP stack and is therefore also excluded. External BGP routers must run as full virtual machines using Virtualbox or KVM/libvirt. _Network engineers building BGP labs with TCP-AO constraints track platform support gaps like this on daily.dev._ ### Which devices support TCP-AO in netlab for EBGP session protection? netlab supports TCP-AO on Arista EOS virtual machines, Cisco CSR 1000v, and Nokia SR-OS (running as a virtual machine inside a container). TCP-AO support was added in netlab release 1.6.3, which is the minimum version required to run TCP-AO labs. Nokia SR-OS can be used with containerlab but still requires nested virtualization. _Engineers choosing between BGP lab platforms for TCP-AO testing find platform comparisons like this on daily.dev._ ### What algorithm and parameters are used when configuring TCP-AO on EBGP neighbors? TCP-AO EBGP sessions use HMAC-SHA1-96 as the MAC algorithm, with per-neighbor secrets configured individually. Each neighbor gets its own key ID (starting at 0) and secret string. On Arista EOS, the configuration is verified with 'show ip bgp neighbors' which displays the profile name, MAC algorithm, current key ID, next receive key ID, and active receive key IDs. _Practitioners configuring BGP authentication in production networks follow protocol-level details like these on daily.dev._ ## Similar posts on daily.dev - [BGP Role model: tracking the adoption of RFC 9234](https://daily.dev/posts/bgp-role-model-tracking-the-adoption-of-rfc-9234-u4c23dt5r) · Cloudflare · 6 upvotes · 0 comments - [A most elegant TCP hole punching algorithm — Aul Ma's research facility](https://daily.dev/posts/a-most-elegant-tcp-hole-punching-algorithm-aul-ma-s-research-facility-3sxh5jd5x) · Hacker News · 0 upvotes · 0 comments - [Modernizing TACACS\+: Why Full-Session Encryption Matters More Than Ever](https://daily.dev/posts/modernizing-tacacs-why-full-session-encryption-matters-more-than-ever-ilk0hyfpi) · Cisco · 0 upvotes · 0 comments - [Arista cEOS Does Not Apply ACLs to Control-Plane Traffic « ipSpace.net blog](https://daily.dev/posts/arista-ceos-does-not-apply-acls-to-control-plane-traffic-ipspace-net-blog-ieh2uzhm7) · ipSpace.net Blog · 0 upvotes · 0 comments --- Tags: [#bgp](https://daily.dev/tags/bgp), [#networking](https://daily.dev/tags/networking), [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/tcp-autentication-option-tcp-ao-bgp-labs-xitbdrn8b) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"TCP Autentication Option (TCP-AO) « BGP Labs","url":"https://daily.dev/posts/tcp-autentication-option-tcp-ao-bgp-labs-xitbdrn8b","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/tcp-autentication-option-tcp-ao-bgp-labs-xitbdrn8b"},"datePublished":"2026-08-11T08:54:46.697Z","dateModified":"2026-10-14T02:28:46.033Z","description":"A hands-on lab guide for protecting EBGP sessions using TCP Authentication Option (TCP-AO) as defined in RFC 5925, replacing the older MD5 checksum approach....","image":"https://media.daily.dev/image/upload/s--2-1xRawN--/f_auto/v1722860399/public/Placeholder%2011","thumbnailUrl":"https://media.daily.dev/image/upload/s--2-1xRawN--/f_auto/v1722860399/public/Placeholder%2011","isAccessibleForFree":true,"articleSection":"ipSpace.net Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ipSpace.net Blog","logo":"https://media.daily.dev/image/upload/s--xS7E82MT--/f_auto,q_auto/v1786438303/logos/ipspace?_a=BAMAMicg0","url":"https://daily.dev/sources/ipspace"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/tcp-autentication-option-tcp-ao-bgp-labs-xitbdrn8b","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"bgp,networking,security","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ipSpace.net Blog","item":"https://daily.dev/sources/ipspace"},{"@type":"ListItem","position":3,"name":"TCP Autentication Option (TCP-AO) « BGP Labs"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/tcp-autentication-option-tcp-ao-bgp-labs-xitbdrn8b#faq","mainEntity":[{"@type":"Question","name":"Does Linux kernel support TCP-AO for BGP session protection?","acceptedAnswer":{"@type":"Answer","text":"Linux kernel does not support TCP-AO (as of September 2023), which means FRRouting containers and Arista cEOS containers cannot be used for TCP-AO BGP session protection. Arista cEOS relies on the underlying Linux TCP/IP stack and is therefore also excluded. External BGP routers must run as full virtual machines using Virtualbox or KVM/libvirt. Network engineers building BGP labs with TCP-AO constraints track platform support gaps like this on daily.dev."}},{"@type":"Question","name":"Which devices support TCP-AO in netlab for EBGP session protection?","acceptedAnswer":{"@type":"Answer","text":"netlab supports TCP-AO on Arista EOS virtual machines, Cisco CSR 1000v, and Nokia SR-OS (running as a virtual machine inside a container). TCP-AO support was added in netlab release 1.6.3, which is the minimum version required to run TCP-AO labs. Nokia SR-OS can be used with containerlab but still requires nested virtualization. Engineers choosing between BGP lab platforms for TCP-AO testing find platform comparisons like this on daily.dev."}},{"@type":"Question","name":"What algorithm and parameters are used when configuring TCP-AO on EBGP neighbors?","acceptedAnswer":{"@type":"Answer","text":"TCP-AO EBGP sessions use HMAC-SHA1-96 as the MAC algorithm, with per-neighbor secrets configured individually. Each neighbor gets its own key ID (starting at 0) and secret string. On Arista EOS, the configuration is verified with 'show ip bgp neighbors' which displays the profile name, MAC algorithm, current key ID, next receive key ID, and active receive key IDs. Practitioners configuring BGP authentication in production networks follow protocol-level details like these on daily.dev."}}]} ```