BGP sits quietly in the background until something goes wrong. Then everyone notices. The Border Gateway Protocol decides how traffic moves between autonomous systems, so a bad route announcement can send traffic somewhere it shouldn’t go. Securing BGP means making those route decisions harder to abuse and easier to spot when something looks wrong.

Start With BGP Session Security

A good first step is controlling who can even establish a BGP session with your router. Don’t leave that door open wider than it needs to be.

Use authentication between BGP peers, especially with external peers. TCP MD5 has been widely used for this purpose, while TCP Authentication Option, or TCP-AO, provides a newer approach where supported. The exact option depends on your network equipment and software.

Access control matters too. Your edge router should only accept BGP connections from known peer addresses. If a random system can reach the BGP service, you’re already making life easier for an attacker.

Protect the Routing Process

• An explicit prefix filter is boring, which is exactly why I like it. Boring security controls tend to stay useful.

• RPKI validation adds another check by verifying whether a network is authorised to originate a prefix, although it doesn’t solve every BGP security problem.

• Maximum-prefix limits put a ceiling on what a peer can announce, so one bad session doesn’t suddenly fill your routing table.

Stop Route Leaks Before They Spread

A route leak happens when routing information travels somewhere it shouldn’t. The result can be traffic taking an unexpected path, sometimes across networks that were never meant to carry it.

Strong import and export policies reduce this risk. Don’t treat a provider, customer, and peer as if they all have the same routing relationship. They don’t.

AS path filters are useful here because they let you check the autonomous systems appearing in a route’s path. Community-based policies can add another layer of control, provided they’re designed carefully.

RPKI Deserves a Place Here

RPKI is one of the better tools available for dealing with route origin problems. A network operator creates a Route Origin Authorisation that says which autonomous system is permitted to originate a prefix. Routers that perform RPKI validation can then classify received routes based on that information.

It isn’t magic. A valid RPKI result doesn’t prove that the entire path is trustworthy. Still, ignoring it when your equipment supports it feels like leaving a useful lock sitting on the table.

Monitor BGP Like Something Important

Security doesn’t end after the filters are configured. Watch the routing table and look for changes that don’t fit normal behaviour.

• Unexpected origin changes should get a second look, especially for important prefixes.

• Route count suddenly jumps? That’s worth investigating before users start reporting strange connectivity.

Keep BGP Configuration Tight

Finally, protect the routers themselves. Limit management access and keep network operating systems updated. Remove old peer configurations instead of letting them sit around forever.

Also review filters after network changes. A policy that made perfect sense two years ago can become a hole after one provider changes its setup.