A city clerk's office wants to stop a rogue device from successfully establishing BGP and injecting routes into the city ASN. Which control directly protects the TCP session between legitimate peers?
Select an answer to reveal the explanation.
Short Explanation
You protect the BGP TCP session with neighbor authentication: legitimate peers must share the key, or the session will not establish. OSPF MD5 protects OSPF adjacencies, while synchronization and classful summaries do not authenticate BGP peers.
Full Explanation
To stop a rogue device from establishing BGP and injecting routes, configure BGP neighbor authentication, such as MD5. Legitimate peers must have matching keys; a peer with a mismatched key cannot establish the BGP session, directly protecting the TCP connection. OSPF MD5 authentication on area 0 protects OSPF adjacencies, but it does not authenticate BGP TCP sessions, so it cannot provide this protection. Disabling BGP synchronization does not drop unauthorized peers: synchronization is a legacy rule about consistency between BGP and an IGP, not a peer access-control mechanism. Advertising only classful summaries also does not prevent rogue ASNs or peering; route summarization affects what prefixes are advertised, not which devices may establish BGP sessions. Exam caveat: neighbor authentication protects session establishment but is not a complete routing-security strategy; consider GTSM/TTL security, control-plane policing, prefix filters, and maximum-prefix limits where appropriate. MD5 is the classic exam example of BGP session authentication. Practical check: configure matching passwords on legitimate peers, verify their sessions remain established, and confirm a test peer with an incorrect key stays down; monitor BGP summaries and authentication-related logs or debugs during the change.