BGP configuring authentication on an established BGP session

When configuring or changing the BGP Authentication configuration on an already established peering, you must note the following:

If you configure or change the password used for MD5 authentication between two BGP peers, the local router will not tear down the existing session after you configure the password. The local router will attempt to maintain the peering session using the new password until the BGP hold-down timer expires. The default time period is 180 seconds. If the password is not entered or changed on the remote router before the hold-down timer expires, the session will time out.

If you want to test this, configure BGP with two routers like this:

R1#
router bgp 1
neighbor 192.168.12.2 remote-as 2

R2#
router bgp 2
neighbor 192.168.12.1 remote-as 1

You can see that the neighbor adjacency is working:

R1#show ip bgp summary
BGP router identifier 192.168.12.1, local AS number 1
BGP table version is 1, main routing table version 1

Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
192.168.12.2    4            2       9      10        1    0    0 00:06:20        0

Once the BGP neighbor adjacency is established, change the configuration on one of the two routers:

R1#
router bgp 1
neighbor 192.168.12.2 password CISCO123

You can use show ip bgp summary to see that the neighbor adjacency is still there. You can also use debug ip bgp to see in action when it will be dropped.