When user configures BGP Router Md5 auth info in contrail config,   device manager constructs MX config stanzas and push to MX Routers:

Generated MX config will be in this format:
    <configuration junos:changed-seconds="1430780427" junos:changed-localtime="2015-05-04 23:00:27 UTC">
            <protocols>
                <bgp>
                    <group>
                        <name>bgp1</name>
                        <authentication-key>$9$7w-dsg4Zji.8X</authentication-key>
                        <neighbor>
                            <name>20.0.0.0</name>
                            <authentication-key>$9$7O-dsaZj.fzs2qm5FAt1RhSlM-dsYgJ-V</authentication-key>
                        </neighbor>
                    </group>
                </bgp>
            </protocols>
    </configuration>


Generated MX Config for BGP Protocol will be something like this depending on the config parameters:

<?xml version="1.0"?>
<config xmlns:xc="urn:ietf:params:xml:ns:netconf:base:1.0">
    <configuration>
        <groups operation="replace">
            <name>__contrail__</name>
            <protocols>
                <bgp>
                    <group operation="replace">
                        <name>__contrail__</name>
                        <type>internal</type>
                        <multihop/>
                        <local-address>10.1.1.1</local-address>
                        <family>
                            <route-target/>
                            <inet-vpn>
                                <unicast/>
                            </inet-vpn>
                            <evpn>
                                <signaling/>
                            </evpn>
                            <inet6-vpn>
                                <unicast/>
                            </inet6-vpn>
                        </family>
                        <authentication-key>bgppswd</authentication-key>
                        <keep>all</keep>
                        <neighbor>
                            <name>20.2.2.2</name>
                            <family>
                                <route-target/>
                                <inet-vpn>
                                    <unicast/>
                                </inet-vpn>
                                <evpn>
                                    <signaling/>
                                </evpn>
                            </family>
                            <authentication-key>bgppswd-neigh</authentication-key>
                        </neighbor>
                    </group>
                    <group operation="replace">
                        <name>__contrail_external__</name>
                        <type>external</type>
                        <multihop/>
                        <local-address>10.1.1.1</local-address>
                        <family>
                            <route-target/>
                            <inet-vpn>
                                <unicast/>
                            </inet-vpn>
                            <evpn>
                                <signaling/>
                            </evpn>
                            <inet6-vpn>
                                <unicast/>
                            </inet6-vpn>
                        </family>
                        <authentication-key>bgppswd</authentication-key>
                        <keep>all</keep>
                    </group>
                </bgp>
            </protocols>
            <routing-options>
                <route-distinguisher-id/>
                <autonomous-system>64512</autonomous-system>
            </routing-options>
        </groups>
        <apply-groups operation="replace">__contrail__</apply-groups>
    </configuration>
</config>