EIGRP SECURITY

[jonk34567]

following oprtions can be used for security purposes.if there any more options other than those 3 

1.stub routing

2.passive interface

3.eigrp authentication

4.route filtering ( ip prefix list , route map , access list )

[Julio E. Moisa]

I think we can talk about security in EIGRP for protect the EIGRP protocol itself or protect your network, EIGRP authentication is used to protect the protocol it itself, passive interface is to avoid any routing information leaking to interface where this information is not required because they aren't part of the routing process like the LANs, with passive we can avoid attacks like Man in the middle.

The other options can be seen how methods to protect the network to receive or send the required information.

Also you can include maximun-hops, EIGRP will just receive routes with maximun hops value configured. For example if a route is normally received from 3 hops and you have configured 2 hops as max, the route will be discarded. The maximun hop can be seen using: show ip route <subnet or prefix>

sh ip route 6.6.6.6
Routing entry for 6.6.6.6/32
Known via "eigrp 100", distance 90, metric 409600, type internal
Redistributing via eigrp 100
Last update from 20.5.6.6 on FastEthernet0/1, 00:00:06 ago
Routing Descriptor Blocks:
* 20.5.6.6, from 20.5.6.6, 00:00:06 ago, via FastEthernet0/1
Route metric is 409600, traffic share count is 1
Total delay is 6000 microseconds, minimum bandwidth is 10000 Kbit
Reliability 255/255, minimum MTU 1500 bytes
Loading 1/255, Hops 1

metric maximum-hops

To have the IP routing software advertise as unreachable routes with a hop count higher than is specified by the command (Enhanced Interior Gateway Routing Protocol [EIGRP] only), use the metric maximum-hops command in router configuration mode or address family topology configuration mode. Toreset the value to the default, use the no form of this command.

metric maximum-hops hops-number

no metric maximum-hops

Syntax Description

hops-number

Maximum hop count (in decimal). The default value is 100; the maximum number of hops that can be specified is 255.

Command Default

The maximum number of hops is 100.

Command Modes

Router configuration (config-router)
Address family topology configuration (config-router-af-topology)

Command History

Release	Modification
10.0	This command was introduced.
12.2(33)SRA	This command was integrated into Cisco IOS Release 12.2(33)SRA.
12.2SX	This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware.
Cisco IOS XE Release 2.1	This command was integrated into Cisco IOS XE Release 2.1.
15.0(1)M	This command was modified. The address-family topology configuration mode was added.
12.2(33)SRE	This command was modified. The address-family topology configuration mode was added.
Cisco IOS XE Release 2.5	This command was modified. The address-family topology configuration mode was added.
12.2(33)XNE	This command was integrated into Cisco IOS Release 12.2(33)XNE.

Usage Guidelines

This command provides a safety mechanism that breaks any potential count-to-infinity problems. It causes the IP routing software to advertise as unreachable routes with a hop count greater than the value assigned to the hops-number argument.

Examples

In the following example, a router in autonomous system 71 attached to network 10.0.0.0 wants a maximum hop count of 200, doubling the default. The network administrators configured the router hop count to 200 because they have a complex WAN that can generate a large hop count under normal (nonlooping) operations.

Router(config)# router eigrp 71

Router(config-router)# network 172.16.0.0

Router(config-router)# metric maximum-hops 200

The following example shows how to configure EIGRP autonomous-system 4453 to have a maximum hop count of 200:

Router(config)# router eigrp virtual-name

Router(config-router)# address-family ipv4 autonomous-system 4453

Router(config-router-af)# topology base

Router(config-router-af-topology)# metric maximum-hops 200

Related Commands

Other method is use distance command if you match a prefix with AD 255, prefix/subnet will be discarded. 

Example:

access-list 1 permit host 2.2.2.2

router eigrp 100
distance 255 0.0.0.0 0.0.0.0 1

EIGRP will add an Administrative distance of 255 to the prefixes/subnets included into the ACL 1 known by any source. In few words an AD of 255 will discard the subnets/prefixes and not will be included on the routing table.

Hope it is useful

:-)