cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
320
Views
10
Helpful
10
Replies
Highlighted
Beginner

EIGRP MD5

When our EIGRP routing was first setup the installers didn't secure it. We now have 25 routers, and it is way past time to secure it. I have read and understand how to enable and have done so on there networks with OSPF, but not once the network is using it.

How can I set this up without taking the network down?

Any thoughts.

Thank You

1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
Hall of Fame Guru

Jeff

Once MD5 auth is enabled on all interfaces then changing the key can be done without any downtime.

But as Jerry notes this won't work when you actually configure it for the first time.

If no downtime is acceptable then one way around this is to configure a second EIGRP AS on each router. Because authentication uses the AS number a second AS would allow you to break the original AS while adding MD5 auth and the router will still have all the routes in the second temporary AS.

Once MD5 is enabled and working in the original AS then you can delete the second temporary AS.

Jon

View solution in original post

10 REPLIES 10
Highlighted
Cisco Employee

Hi Jeff,

EIGRP authentication is a per interface configuration. It will affect the directly connected interfaces. When you enable authentication on two (2) adjacent interfaces (remote first then local), since EIGRP converge really fast, the neighbor adjacency will flop (depend on how fast you enter the commands on that interface).

HTH,

jerry

Highlighted

That might not work very well on a network with 5 routers on it. Not sure I can tyoe that fast.

It may work for the point to point links however.

Highlighted

Oh but I could add a second vlan and setup the MD5 key on that one.

Highlighted
Hall of Fame Guru

Jeff

Once MD5 auth is enabled on all interfaces then changing the key can be done without any downtime.

But as Jerry notes this won't work when you actually configure it for the first time.

If no downtime is acceptable then one way around this is to configure a second EIGRP AS on each router. Because authentication uses the AS number a second AS would allow you to break the original AS while adding MD5 auth and the router will still have all the routes in the second temporary AS.

Once MD5 is enabled and working in the original AS then you can delete the second temporary AS.

Jon

View solution in original post

Highlighted

Great idea Jon.

Highlighted

Thanks Jerry.

Highlighted

I thought I read somewhere Cisco only supports one EIGRP AS per device.

Highlighted

Not EIGRP, you can have multiple process.

Single process for BGP.

HTH,

jerry

Highlighted

Cool. That sounds like a great plan. I will give it a shot. I'm assuming I need to redistribute EIGRP 1 into EIGRP 2 and vis versa to make this work.

Thank you very much.

Highlighted

Jeff

No you don't need to redistribute between the 2. You just configure a second AS on each router with the same configuration as the first.

Jon

Content for Community-Ad