EIGRP MD5

[jeff.cook]

When our EIGRP routing was first setup the installers didn't secure it. We now have 25 routers, and it is way past time to secure it. I have read and understand how to enable and have done so on there networks with OSPF, but not once the network is using it.

How can I set this up without taking the network down?

Any thoughts.

Thank You

[Jerry Ye]

Hi Jeff,

EIGRP authentication is a per interface configuration. It will affect the directly connected interfaces. When you enable authentication on two (2) adjacent interfaces (remote first then local), since EIGRP converge really fast, the neighbor adjacency will flop (depend on how fast you enter the commands on that interface).

HTH,

jerry

[jeff.cook]

That might not work very well on a network with 5 routers on it. Not sure I can tyoe that fast.

It may work for the point to point links however.

[jeff.cook]

Oh but I could add a second vlan and setup the MD5 key on that one.

[Jon Marshall · Accepted solution]

Jeff

Once MD5 auth is enabled on all interfaces then changing the key can be done without any downtime.

But as Jerry notes this won't work when you actually configure it for the first time.

If no downtime is acceptable then one way around this is to configure a second EIGRP AS on each router. Because authentication uses the AS number a second AS would allow you to break the original AS while adding MD5 auth and the router will still have all the routes in the second temporary AS.

Once MD5 is enabled and working in the original AS then you can delete the second temporary AS.

Jon

[Jerry Ye]

Great idea Jon.

[Jon Marshall]

Thanks Jerry.

[jeff.cook]

I thought I read somewhere Cisco only supports one EIGRP AS per device.

[Jerry Ye]

Not EIGRP, you can have multiple process.

Single process for BGP.

HTH,

jerry

[jeff.cook]

Cool. That sounds like a great plan. I will give it a shot. I'm assuming I need to redistribute EIGRP 1 into EIGRP 2 and vis versa to make this work.

Thank you very much.

[Jon Marshall]

Jeff

No you don't need to redistribute between the 2. You just configure a second AS on each router with the same configuration as the first.

Jon