EIGRP key-id range on cisco ASA's

[vikran_anumukonda]

EIGRP key-id on cisco ASA's can only be between 0-255 , whereas it's much much higher on the Router's.  We are planning to implement EIGRP on cisco asa's to move away from static routing but realized that key-id on the router's is greater than 255 which is not supported on asa's. 

We can't change the key-id on the routers. is there any workaround on the ASA's to be able to configure EIGRP authentication and bring up the neighbor relationship with the router using key-id greater than 255 ?

There doesn't seem to be a solution from the documentation i read so far, but i wanted to try my luck here.

[johnlloyd_13]

hi,

i tried on both 5510 and 5525-X it supports EIGRP process ID of up to 65535.

5525-X# sh route eigrp ?

  <1-65535>  Process ID
  |          Output modifiers
  <cr>

5510# sh eigrp ?

  <1-65535>   Autonomous System
  events      EIGRP-IPv4 Events
  interfaces  EIGRP-IPv4 interfaces
  neighbors   EIGRP-IPv4 neighbors
  topology    EIGRP Topology Table or Topology Name
  traffic     EIGRP-IPv4 Traffic Statistics

could you post your ASA show version and show route eigrp ? (if 5500-X) or show eigrp ? (5500/non-X ASA)

[vikran_anumukonda]

Hello John,

I meant the authentication key-id for eigrp on an ASA.

authentication key eigrp 12345 magik key-id ?

 interface mode commands/options:

  <0-255>  The shared key id that matches the key

Thanks,
Vikram

[johnlloyd_13]

hi,

you don't need the key-id to be the same.

it's just an arbitrary sequence number local on the router/ASA.

only the key-string needs to be the same.

http://www.ciscopress.com/articles/article.asp?p=687478&seqNum=4

For EIGRP MD5 authentication, you must configure an authenticating key and a key ID on both the sending router and the receiving router. Each key has its own key ID, which is stored locally. The combination of the key ID and the interface associated with the message uniquely identifies the authentication algorithm and MD5 authentication key in use.

[vikran_anumukonda]

Hello John - seems that is incorrect and they have corrected the statement at a later time.

Key-id's have to match on the neighbors.

[johnlloyd_13]

hi,

yes, you're right. i saw there was an errata on the said book/doc for the EIGRP key-id number.

looks like you're out of luck with ASA EIGRP key-id limitation.