Get Full Access to our 739 Cisco Lessons Now Start $1 Trial
You are here: Home » Cisco » CCIE Routing & Switching

How to configure EIGRP Authentication

Routing protocols can be configured to prevent receiving false routing updates and EIGRP is no exception. If you don’t use authentication and you are running EIGRP someone could try to form an EIGRP neighbor adjacency with one of your routers and try to mess with your network…we don’t want that to happen right?

EIGRP supports MD5 authentication and (since IOS 15.x) SHA authentication, there is no plaintext authentication.

What does authentication offer us?

  • Your router will authenticate the source of each routing update packet that it will receive.
  • Prevents false routing updates from sources that are not approved.
  • Ignore malicious routing updates.

A potential hacker could be sitting on your network with a laptop running GNS3 / Dynamips, boot up a Cisco router and try the following things:

  • Try to establish a neighbor adjacency with one of your routers and advertise junk routes.
  • Send malicious packets and see if you can drop the neighbor adjacency of one of your authorized routers.

In order to configure EIGRP authentication we need to do the following:

  • Configure a key-chain
    • Configure a key ID under the key-chain.
      • Specify a password for the key ID.
      • Optional: specify accept and expire lifetime for the key.

Let’s use two routers and see if we can configure EIGRP MD5 authentication:

eigrp with keys
The configuration for both routers is very basic:

R1(config)#interface fastEthernet 0/0
R1(config-if)#ip address 192.168.12.1 255.255.255.0

R1(config)#router eigrp 12
R1(config-router)#network 192.168.12.0
R2(config)#interface fastEthernet 0/0
R2(config-if)#ip address 192.168.12.2 255.255.255.0

R2(config)#router eigrp 12
R2(config-router)#network 192.168.12.0

The first thing we need to configure is a key-chain:

eigrp keychain

I called mine “MY_KEY_CHAIN” but it can be different on both routers, it doesn’t matter. The Key ID is a value that has to match on both routers and the key-string is the password which has to match of course.

R1(config)#key chain MY_KEY_CHAIN
R1(config-keychain)#key 1
R1(config-keychain-key)#key-string MY_KEY_STRING
R1(config)#interface fastEthernet 0/0
R1(config-if)#ip authentication mode eigrp 12 md5 
R1(config-if)#ip authentication key-chain eigrp 12 MY_KEY_CHAIN

First you have to create the keychain and then you need to activate it on the interface. The “12” is the AS number of EIGRP. The configuration on R2 is exactly the same.

R2#debug eigrp packets 
EIGRP Packets debugging is on
    (UPDATE, REQUEST, QUERY, REPLY, HELLO, IPXSAP, PROBE, ACK, STUB, SIAQUERY, SIAREPLY)

R2# EIGRP: FastEthernet0/0: ignored packet from 192.168.12.1, opcode = 5 (authentication off or key-chain missing)

You can check if your configuration is correct by using debug eigrp packets. You can see that we received a packet with MD5 authentication but I didn’t enable MD5 authentication yet on R2.

Let’s fix it:

R2(config)#key chain MY_KEY_CHAIN
R2(config-keychain)#key 1
R2(config-keychain-key)#key-string MY_KEY_STRING

R2(config)#interface fastEthernet 0/0
R2(config-if)#ip authentication mode eigrp 12 md5
R2(config-if)#ip authentication key-chain eigrp 12 MY_KEY_CHAIN

Right away I can see that the EIGRP neighbor adjacency is working:

We're Sorry, Full Content Access is for Members Only...

If you like to keep on reading, Become a Member Now! Here is why:

  • Learn any CCNA, CCNP and CCIE R&S Topic. Explained As Simple As Possible.
  • Try for Just $1. The Best Dollar You’ve Ever Spent on Your Cisco Career!
  • Full Access to our 739 Lessons. More Lessons Added Every Week!
  • Content created by Rene Molenaar (CCIE #41726)
Give Membership a try - it's just $1 ►

536 Sign Ups in the last 30 days

satisfaction-guaranteed
100% Satisfaction Guaranteed!
You may cancel your monthly membership at any time.
No Questions Asked!

Tags:

Forum Replies

  1. AS stands for Autonomous System.

    An AS is basically a network that falls under one administrative entity. On the Internet we use AS numbers and BGP for routing between autonomous systems. Within an AS, we typically use an IGP like OSPF or EIGRP.

    Here’s a list with AS numbers that are used on the Internet:

    http://bgp.potaroo.net/cidr/autnums.html

    Rene

  2. Dear Makara,

    It would be very useful but unfortunately EIGRP doesn’t support this. Authentication is always enabled on the interface level.

    Rene

  3. Hello Hussein

    Cisco commands are implemented using a specific hierarchy. When you type the command ip eigrp ?, the resulting commands all have to do with EIGRP and its functionality. They are limited to routing EIGRP and nothing else. However, authentication is a different entity and must be placed within a different category. This is why the commands fall under the ip authentication keywords even though the authentication is being configured for EIGRP. Anything under the ip authentication ? will belong to the authentication functionality of the router.

    So

    ... Continue reading in our forum

  4. Hi @shaunasromamad,

    I’m a bit late but I want to add this for the future.
    If you use show running-config you won’t see if you inadvertently typed a space in the password.
    show key chain on the other hand will show the configured key-string in quotation marks ("MY_Key_String ") so on a misconfiguration you will see "MY_Key_String " for example.

    Best regards,
    Marcel

  5. Hello Matthew

    Thanks so much for sharing that, it’s much appreciated by us and by all forum users.

    Laz

28 more replies! Ask a question or join the discussion by visiting our Community Forum