Build EIGRP named mode with SHA-256 authentication and passive interfaces

Tasks

1. Configure the interfaces on both routers.
2. Create EIGRP named mode instance CAMPUS with an IPv4 address family in AS 100 and fixed router IDs.
3. Make every interface passive by default and allow a neighbor only on Gi0/0/0.
4. Authenticate the R1 to R2 adjacency with HMAC-SHA-256.
5. Verify the neighbor, the interfaces running EIGRP, and the wide metric of the remote LAN.

Solution

1. 1Interfaces on R1R1

   interface GigabitEthernet0/0/0
    description to R2
    ip address 10.0.12.1 255.255.255.0
    no shutdown
   interface GigabitEthernet0/0/1
    description USERS
    ip address 10.1.0.1 255.255.255.0
    no shutdown

2. 2EIGRP named mode on R1R1

   router eigrp CAMPUS
    address-family ipv4 unicast autonomous-system 100
     af-interface default
      passive-interface
     exit-af-interface
     !
     af-interface GigabitEthernet0/0/0
      no passive-interface
      authentication mode hmac-sha-256 0 Lab-Key-2026
     exit-af-interface
     !
     topology base
     exit-af-topology
     network 10.0.12.0 0.0.0.255
     network 10.1.0.0 0.0.0.255
     eigrp router-id 10.255.0.1
    exit-address-family

   af-interface default applies to every interface, so a new LAN port comes up passive. The 0 before the key means it is typed in clear text. Loopbacks are left out of this lab to keep the outputs short.

3. 3Interfaces on R2R2

   interface GigabitEthernet0/0/0
    description to R1
    ip address 10.0.12.2 255.255.255.0
    no shutdown
   interface GigabitEthernet0/0/1
    description USERS
    ip address 10.2.0.1 255.255.255.0
    no shutdown

4. 4EIGRP named mode on R2R2

   router eigrp CAMPUS
    address-family ipv4 unicast autonomous-system 100
     af-interface default
      passive-interface
     exit-af-interface
     !
     af-interface GigabitEthernet0/0/0
      no passive-interface
      authentication mode hmac-sha-256 0 Lab-Key-2026
     exit-af-interface
     !
     topology base
     exit-af-topology
     network 10.0.12.0 0.0.0.255
     network 10.2.0.0 0.0.0.255
     eigrp router-id 10.255.0.2
    exit-address-family

   The instance name does not have to match R1. The AS number and the key do.

Verify

R1# show eigrp address-family ipv4 neighbors
EIGRP-IPv4 VR(CAMPUS) Address-Family Neighbors for AS(100)
H   Address                 Interface              Hold Uptime   SRTT   RTO  Q  Seq
                                                   (sec)         (ms)       Cnt Num
0   10.0.12.2               Gi0/0/0                  13 00:04:51    2   100  0  9

R1# show eigrp address-family ipv4 interfaces
EIGRP-IPv4 VR(CAMPUS) Address-Family Interfaces for AS(100)
                              Xmit Queue   PeerQ        Mean   Pacing Time   Multicast    Pending
Interface              Peers  Un/Reliable  Un/Reliable  SRTT   Un/Reliable   Flow Timer   Routes
Gi0/0/0                  1        0/0       0/0           2       0/0           50           0

R1# show eigrp address-family ipv4 topology
EIGRP-IPv4 VR(CAMPUS) Topology Table for AS(100)/ID(10.255.0.1)
Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,
       r - reply Status, s - sia Status

P 10.0.12.0/24, 1 successors, FD is 1310720
        via Connected, GigabitEthernet0/0/0
P 10.1.0.0/24, 1 successors, FD is 1310720
        via Connected, GigabitEthernet0/0/1
P 10.2.0.0/24, 1 successors, FD is 1966080
        via 10.0.12.2 (1966080/1310720), GigabitEthernet0/0/0

R1# show ip route eigrp | begin Gateway
Gateway of last resort is not set

      10.0.0.0/8 is variably subnetted, 5 subnets, 2 masks
D        10.2.0.0/24 [90/15360] via 10.0.12.2, 00:04:40, GigabitEthernet0/0/0

PC1# ping 10.2.0.10
Reply from 10.2.0.10: bytes=32 time=1ms TTL=126

Mistakes people make

• Configuring the key under only one router. The other side drops the hellos and the neighbor never forms, with nothing obvious in the log.
• Forgetting no passive-interface on the uplink after af-interface default made everything passive.
• Comparing the topology table FD with the routing table metric. In named mode they differ by the RIB scale.
• Putting variance or redistribute directly under the address family. In named mode they belong under topology base.

On other platforms

key chain EIGRP-KEYS
 key 1
  key-string Lab-Key-2026
!
interface GigabitEthernet0/0/0
 ip authentication mode eigrp 100 md5
 ip authentication key-chain eigrp 100 EIGRP-KEYS
!
router eigrp 100
 network 10.0.12.0 0.0.0.255
 network 10.1.0.0 0.0.0.255
 passive-interface default
 no passive-interface GigabitEthernet0/0/0
 eigrp router-id 10.255.0.1