Cisco IOS Cookbook, 2nd Edition

Enabling EIGRP Authentication

Problem

You want to authenticate your EIGRP traffic to ensure that no unauthorized equipment can affect your routing tables.

Solution

To enable MD5-based EIGRP packet authentication, you must first define a key chain for the encryption, and then apply the authentication commands to the interface as follows:

Router1#configure terminal 
Enter configuration commands, one per line.  End with CNTL/Z.
Router1(config)#key chain ORA
Router1(config-keychain)#key 1
Router1(config-keychain-key)#key-string oreilly
Router1(config-keychain-key)#exit
Router1(config-keychain)#exit
Router1(config)#interface Serial0/1
Router1(config-if)#ip authentication mode eigrp 55 md5
Router1(config-if)#ip authentication key-chain eigrp 55 ORA
Router1(config-if)#exit
Router1(config)#end
Router1#

Discussion

As soon as we configure EIGRP authentication on this router, the neighbor relationship dropped because it failed to authenticate:

IP-EIGRP 55: Neighbor 172.25.2.2 (Serial0/0.2) is down: Auth failure

To bring this neighbor back up, you have to ensure that both routers use the same authentication keys.

It’s important to remember that this is just an authentication system. The routers do not encrypt the routing update packets as they send them through the network. They just authenticate these packets using MD5. This prevents people from either accidentally or maliciously injecting routes into your network. This is often useful in environments where you don’t control all of the routers.

You can ...