How do you authenticate EIGRP neighbors, and what changes between classic and named mode?
Show the answer
Say this first
Classic mode supports MD5 with a key chain applied per interface. Named mode adds HMAC-SHA-256 with a password under the af-interface, and still supports MD5 key chains. Authentication protects the adjacency: a router without the right key never becomes a neighbor, so nobody can plug in a router and inject routes. Key chains with lifetimes let you rotate keys without an outage.
Go deeper
Classic mode, MD5
key chain EIGRP-KEYS
key 1
key-string Kj7mPq2xR4
!
interface GigabitEthernet0/0/0
ip authentication mode eigrp 100 md5
ip authentication key-chain eigrp 100 EIGRP-KEYSNamed mode, SHA-256
router eigrp CAMPUS
address-family ipv4 unicast autonomous-system 100
af-interface GigabitEthernet0/0/0
authentication mode hmac-sha-256 0 Kj7mPq2xR4
exit-af-interfaceTo protect every interface, put it under af-interface default.
Checking
show ip eigrp neighbors: the neighbor is missing or flaps after a change.show key chain: which keys are valid now.debug eigrp packetsbriefly on a quiet router: you can see packets ignored because of authentication.
They will ask next
How do you rotate an MD5 key without dropping the neighbor?
Add key 2 on both routers with overlapping
accept-lifetimevalues and asend-lifetimeon key 2 that starts after both have it. EIGRP carries the key ID in the packet, so both sides need the same key number with the same string. Remove key 1 when it has expired everywhere.Does authentication encrypt the routing updates?
No. It adds a hash that proves the sender knows the key and the packet was not changed. Anyone on the link can still read the routes.
Traps
- Applying the key chain but forgetting
ip authentication mode eigrp 100 md5. Without the mode line nothing is authenticated.