Issue

When allowing eBGP traffic through a Check Point Firewall you may receive the following error message on your BGP peered routers. (This error may occur at the point of pushing a policy to your Check Point Firewall),

TCP-6-BADAUTH: Invalid MD5 digest from [Source IP]:[Source Port] to [Dest IP]:179

Solution

This is down to the Check Point State Table and the TCP sequence number of the BGP Traffic changing at the point of policy push.

To prevent this occurring you will need to change the following settings,

• Check Point Gateway Object > Advanced > Connection Persistence > (Tick) Keep all connections
  • Services > TCP > BGP Service > (Tick) Keep connections open after Policy has been installed