Routing Protocol Authentication (OSPF)

 Routing Protocol Authentication (OSPF)

A router authenticates the source of each routing update packet that it receives. Many routing protocols support authentication like OSPF, EIGRP, ISIS, BGP, and RIPv2.

Cisco routers support of different approaches to authentication route advertisements received from a neighboring router:

•  Simple text authentication
• Hashing authentication (using MD5)

 Simple password authentication:

Router sends packets and key (if a routing protocol doesn’t support multiple keys, the key number associated with a routing update is 0). Neighboring router check whether key matches its key. The outing update is rejected if the keys do not match. The only routing protocols the plan text authentication are RIPv2, OSPF, and ISIS.

MD5 authentication

Configure a key (password) and key ID, router generate a message digest or hash of the key, key ID and message. Message digest is send with packet key is not sent. The neighboring router receives the update and run a hashing algorithm on the routing update with local key, the results in a hash digest. If hash digit matches, the router accept the packet, if it not the update is rejected. This process is more secure than a plain text authentication. IS-IS, OSPF, RIPv2 and EIGRP use MD5.

OSPF Authentication

Types of authentication in OSPF

Type 0 – NULL

Type 1- simple password authentication

Type 2 – cryptographic (SHA/MD5) authentication

OSPF Authentication can be enabled  on OSPF process level (area) or Link level.

All OSPF packet will be authenticated when you enable any formation of authentication in OSPF.

Before we start  BGP configuration check out some important  of BGP CCIE exam topics.

Here are the lists of all OSPF labs and theories CCNA to CCIE.

1.Open Shortest Path First (OSPF) 

2.OSPF Neighbor states

3.OSPF Link State Advertisement (LSA)

4.OSPF STUB, Totally stubby, NSSA, Totally NSSA and(configuration)

5.OSPF Virtual Link

6.Route Redistribution configuration

7.Routing Protocol Authentdication (RIP, and OSPF)

8.Configuring GRE Tunnel instead of virtual link

9. OSPF Autonomous system network map configuration

Let’s see the configuration:

Topology:-

GOAL:

• Configure the topology as per our diagram
• configure OSPF in area 0 and advertise all the interfaces
• configure router 1 and router 2 to exchange routes after establishing successful authentication by using clear text  

R1#show ip interface brief
Interface              IP-Address      OK? Method Status                Protocol
FastEthernet0/0        10.1.1.1        YES manual up                    up
Serial3/0                   1.1.1.1         YES manual up                    down
Loopback0              11.0.0.1        YES manual up                    up
Loopback1              11.0.1.1        YES manual up                    up
Loopback2              11.0.2.1        YES manual up                    up
Loopback3              11.0.3.1        YES manual up                    up

R2#show ip interface brief
Interface              IP-Address      OK? Method Status                Protocol
FastEthernet0/0        20.1.1.1        YES manual up                    up
Serial3/0                   1.1.1.2         YES manual up                    up
Loopback0              12.0.0.1        YES manual up                    up
Loopback1              12.0.1.1        YES manual up                    up
Loopback2              12.0.2.1        YES manual up                    up
Loopback3              12.0.3.1        YES manual up                    up

R1(config)#router ospf 10
R1(config-router)#router-id 11.11.11.11
R1(config-router)#network 1.0.0.0 0.255.255.255 area 0
R1(config-router)#network 10.0.0.0 0.255.255.255 area 0
R1(config-router)#network 11.0.0.0 0.0.0.255 area 0

R2(config)#router ospf 10
R2(config-router)#router-id 12.12.12.12
R2(config-router)#network 12.0.0.0 0.0.0.255 area 0
R2(config-router)#network 20.0.0.0 0.255.255.255 area 0

R2(config-router)#network 1.0.0.0 0.255.255.255 area 0

R1(config)#interface serial 3/0

R1(config-if)#ip ospf authentication

R1(config-if)#ip ospf authentication-key internet

*Dec  5 12:09:31.047: %OSPF-5-ADJCHG: Process 10, Nbr 12.12.12.12 on Serial3/0 from FULL to DOWN, Neighbor Down: Dead timer expired

R2(config)#interface serial 3/0

R2(config-if)#ip ospf authentication

R2(config-if)#ip ospf authentication-key internet

(ip ospf authentication command you can enable plaintext authentication on the

interface level.)

*Dec  5 12:16:37.095: %OSPF-5-ADJCHG: Process 10, Nbr 11.11.11.11 on Serial3/0 from LOADING to FULL, Loading Done

R1#show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface

12.12.12.12       0   FULL/  -        00:00:39    1.1.1.2         Serial3/0

R2#show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface

11.11.11.11       0   FULL/  -        00:00:39    1.1.1.1         Serial3/0

(when we have  lots of interfaces do not want to enable OSPF authentication for

each  and every interfaces. we can also enable area-wide authentication by using  area

authentication command). 

lets see:-

R1(config)#router ospf 10

R1(config-router)#area 0 authentication

R1(config-router)#end

*Dec  5 12:27:32.931: OSPF-10 EVENT: Area config: 'area 0 authentication '

R2(config)#router ospf 10

R2(config-router)#area 0 authentication

R1#show ip ospf interface serial 3/0

Serial3/0 is up, line protocol is up

  Internet Address 1.1.1.1/8, Area 0, Attached via Network Statement

  Process ID 10, Router ID 11.11.11.11, Network Type POINT_TO_POINT, Cost: 64

  Topology-MTID    Cost    Disabled    Shutdown      Topology Name

        0           64        no          no            Base

  Transmit Delay is 1 sec, State POINT_TO_POINT

  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5

    oob-resync timeout 40

    Hello due in 00:00:00

  Supports Link-local Signaling (LLS)

  Cisco NSF helper support enabled

  IETF NSF helper support enabled

  Index 1/1, flood queue length 0

  Next 0x0(0)/0x0(0)

  Last flood scan length is 1, maximum is 1

  Last flood scan time is 0 msec, maximum is 0 msec

  Neighbor Count is 1, Adjacent neighbor count is 1

    Adjacent with neighbor 12.12.12.12

  Suppress hello for 0 neighbor(s)

  Simple password authentication enabled

R2#show ip ospf interface serial 3/0

Serial3/0 is up, line protocol is up

  Internet Address 1.1.1.2/8, Area 0, Attached via Network Statement

  Process ID 10, Router ID 12.12.12.12, Network Type POINT_TO_POINT, Cost: 64

  Topology-MTID    Cost    Disabled    Shutdown      Topology Name

        0           64        no          no            Base

  Transmit Delay is 1 sec, State POINT_TO_POINT

  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5

    oob-resync timeout 40

    Hello due in 00:00:04

  Supports Link-local Signaling (LLS)

  Cisco NSF helper support enabled

  IETF NSF helper support enabled

  Index 2/2, flood queue length 0

  Next 0x0(0)/0x0(0)

  Last flood scan length is 1, maximum is 1

  Last flood scan time is 0 msec, maximum is 0 msec

  Neighbor Count is 1, Adjacent neighbor count is 1

    Adjacent with neighbor 11.11.11.11

  Suppress hello for 0 neighbor(s)

  Simple password authentication enabled

MD5 in OSPF:-

MD5 authentication we need different commands. First of all we use ip ospf message-digest key

name md5 to specify the key num and the password. name and key number is not matter we can choose whatever name but it must be the same on both sites. To enable OSPF authentication we need

to type  ip ospf authentication message-digest.

 Topology:

 

GOAL:

• we are continuing our previous topology
• erase the simple authentication configuration
• and configure MD5 

R1(config)#router ospf 11

R1(config-router)#router-id 11.11.11.11

R1(config-router)#network 10.0.0.0 0.255.255.255 area 0

R1(config-router)#network 1.0.0.0 0.255.255.255 area 0

R1(config-router)#network 11.0.0.0 0.0.0.255 area 0

R2(config)#router ospf 12

R2(config-router)#router-id 12.12.12.12

R2(config-router)#network 1.0.0.0 0.255.255.255 area 0

R2(config-router)#network 20.0.0.0 0.255.255.255 area 0

R2(config-router)#network 12.0.0.0 0.0.0.255 area 0

R1(config)# router ospf 11

R1(config-router)#  area 0 authentication message-digest

R1(config-router)#  exit

R1(config)#  interface serial 3/0

R1(config-if)#  ip ospf message-digest-key 1 md5 internet

R2(config)# router ospf 11

R2(config-router)#  area 0 authentication message-digest

R2(config-router)#  exit

R2(config)#  interface serial 3/0

R2(config-if)#  ip ospf message-digest-key 1 md5 internet

R1#show ip ospf interface serial 3/0

Serial3/0 is up, line protocol is up

  Internet Address 1.1.1.1/8, Area 0, Attached via Network Statement

  Process ID 11, Router ID 11.11.11.11, Network Type POINT_TO_POINT, Cost: 64

  Topology-MTID    Cost    Disabled    Shutdown      Topology Name

        0           64        no          no            Base

  Transmit Delay is 1 sec, State POINT_TO_POINT

  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5

    oob-resync timeout 40

    Hello due in 00:00:01

  Supports Link-local Signaling (LLS)

  Cisco NSF helper support enabled

  IETF NSF helper support enabled

  Index 2/2, flood queue length 0

  Next 0x0(0)/0x0(0)

  Last flood scan length is 1, maximum is 1

  Last flood scan time is 0 msec, maximum is 0 msec

  Neighbor Count is 1, Adjacent neighbor count is 1

    Adjacent with neighbor 12.12.12.12

  Suppress hello for 0 neighbor(s)

  Message digest authentication enabled

    Youngest key id is 1

R2#show ip ospf interface serial 3/0

Serial3/0 is up, line protocol is up

  Internet Address 1.1.1.2/8, Area 0, Attached via Network Statement

  Process ID 11, Router ID 12.12.12.12, Network Type POINT_TO_POINT, Cost: 64

  Topology-MTID    Cost    Disabled    Shutdown      Topology Name

        0           64        no          no            Base

  Transmit Delay is 1 sec, State POINT_TO_POINT

  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5

    oob-resync timeout 40

    Hello due in 00:00:04

  Supports Link-local Signaling (LLS)

  Cisco NSF helper support enabled

  IETF NSF helper support enabled

  Index 2/2, flood queue length 0

  Next 0x0(0)/0x0(0)

  Last flood scan length is 1, maximum is 1

  Last flood scan time is 0 msec, maximum is 4 msec

  Neighbor Count is 1, Adjacent neighbor count is 1

    Adjacent with neighbor 11.11.11.11

  Suppress hello for 0 neighbor(s)

  Message digest authentication enabled

    Youngest key id is 1

Routing Protocol Authentication (EIGRP ) and configuration

Routing Protocol Authentication (EIGRP )

A router authenticates the source of each routing update packet that it receives. Many routing protocols support authentication like OSPF, EIGRP, ISIS, BGP, and RIPv2.

Cisco routers support of different approaches to authentication route advertisements received from a neighboring router:

1. Plan text authentication
2. Hashing authentication (using MD5)

Simple password authentication:

Router sends packets and key (if a routing protocol doesn’t support multiple keys, the key number associated with a routing update is 0). Neighboring router check whether key matches its key. The outing update is rejected if the keys do not match. The only routing protocols the plan text authentication are RIPv2, OSPF, and ISIS.

(for simple password authentication of OSPF and RIPv2 click here)

MD5 authentication

Configure a key (password) and key ID, router generate a message digest or hash of the key, key ID and message. Message digest is send with packet key is not sent. The neighboring router receives the update and run a hashing algorithm on the routing update with local key, the results in a hash digest. If hash digit matches, the router accept the packet, if it not the update is rejected. This process is more secure than a plain text authentication. IS-IS, OSPF, RIPv2 and EIGRP use MD5.

Before we start  EIGRP configuration check out some important  of EIGRP CCIE exam topics.

Here is the lists of all EIGRP labs and theories CCNA to CCIE

1.Enhanced Interior Gateway Routing Protocol (EIGRP)

2.Stuck In Active (EIGRP)

3.EIGRP Equal-Cost and Unequal-Cost load balancing

4.Route filtering passive interface

5.Route summarization

6.EIGRP STUB and Configuration

7.Routing Protocol Authentication (EIGRP ) and configuration

let see the configuration:-

Topology:

Goal:

• configure the topology as per the diagram 
• configure EIGRP 65001 and advertise connected interfaces
• configure router 1 and router 2 to form a neighbours and exchange routing information only after the successful authentication process . 

R1#show ip interface brief

Interface              IP-Address      OK? Method   Status                Protocol

FastEthernet0/0        10.1.1.1        YES manual   up                    up

Serial3/0                      1.1.1.1         YES manual    up                    up

R2#show ip interface brief

Interface                IP-Address      OK? Method   Status                Protocol

FastEthernet0/0        20.1.1.1        YES manual    up                    up

Serial3/0                      1.1.1.2         YES manual     up                    up

R1(config)#router eigrp 65001

R1(config-router)#network 10.0.0.0

R1(config-router)#network 1.0.0.0

R1(config-router)#end

R2(config)#router eigrp 65001

R2(config-router)#network 20.0.0.0

R2(config-router)#network 1.0.0.0

R2(config-router)#end

R1(config)#key chain internetworks

R1(config-keychain)#key 1

R1(config-keychain-key)#key-string ccie

R1(config-keychain-key)#exit

R1(config-keychain)#exit

R1(config)#interface serial 3/0

R1(config-if)#ip authentication mode eigrp 65001 md5

*Mar 18 14:26:40.951: %DUAL-5-NBRCHANGE: EIGRP-IPv4 65001: Neighbor 1.1.1.2 (Serial3/0) is down: authentication mode changed

R1(config-if)#ip authentication key-chain eigrp 65001 internetworks

R1(config-if)#end

R2#

*Mar 18 14:26:40.903: %DUAL-5-NBRCHANGE: EIGRP-IPv4 65001: Neighbor 1.1.1.1 (Serial3/0) is down: Interface PEER-TERMINATION received

R2#

*Mar 18 14:26:45.239: %DUAL-5-NBRCHANGE: EIGRP-IPv4 65001: Neighbor 1.1.1.1 (Serial3/0) is up: new adjacency

R2#

*Mar 18 14:27:26.999: %DUAL-5-NBRCHANGE: EIGRP-IPv4 65001: Neighbor 1.1.1.1 (Serial3/0) is down: Auth failure

R2(config)#key chain internetworks

R2(config-keychain)#key 1

R2(config-keychain-key)#key-string ccie

R2(config-keychain-key)#exit

R2(config-keychain)#exit

R2(config)#interface serial 3/0

R2(config-if)#ip authentication mode eigrp 65001 md5

R2(config-if)#ip authentication key-chain eigrp 65001 internetworks

*Mar 18 14:30:54.267: %DUAL-5-NBRCHANGE: EIGRP-IPv4 65001: Neighbor 1.1.1.1 (Serial3/0) is up: new adjacency

R2(config-if)#end

R1#show ip eigrp neighbors

EIGRP-IPv4 Neighbors for AS(65001)

H   Address                 Interface              Hold Uptime   SRTT   RTO  Q  Seq

                                                                             (sec)         (ms)       Cnt Num

0   1.1.1.2                        Se3/0                    14 00:01:59   70   420  0  7

R2#show ip eigrp neighbors

EIGRP-IPv4 Neighbors for AS(65001)

H   Address                 Interface              Hold Uptime   SRTT   RTO  Q  Seq

                                                                                (sec)         (ms)       Cnt Num

0   1.1.1.1                     Se3/0                    10 00:02:27 1296  5000  0  6

EIGRP Passive interface and configuration

Route filtering passive interface

Cisco IOS provides several ways to control updates traffic. Passive interface, distribute list, prefix list route maps. In this section we take look at passive interface in RIPv2, EIGRP, and OSPF.

Passive interface command is used in al routing protocol to disable sending updates out from a specific interface. However the command behavior varies from one protocol to another.

EIGRP Passive interface

EIGRP do not send any hello messages on passive interface. EIGRP router ignores any EIGRP messages received on the interface its means no neighbors relation but EIGRP still advertises about the connected subnet only if matched with an EIGRP network command.

  

lets see the configuration:-

Before we start  EIGRP configuration check out some important  of EIGRP CCIE exam topics.

Here is the lists of all EIGRP labs and theories CCNA to CCIE

1.Enhanced Interior Gateway Routing Protocol (EIGRP)

2.Stuck In Active (EIGRP)

3.EIGRP Equal-Cost and Unequal-Cost load balancing

4.Route filtering passive interface

5.Route summarization

6.EIGRP STUB and Configuration


7.Routing Protocol Authentication (EIGRP ) and configuration

Topology:

Goal:

• configure the topology as per the diagram
•  configure EIGRP 65001 and advertise interface
• configure router 3 interface serial 3/1 passive interface 

• make sure router 3 drop neighbourship and prevent routes

R1#show ip interface brief
Interface              IP-Address      OK? Method Status                Protocol
FastEthernet0/0        10.1.1.1        YES manual up                    up
Serial3/0                    1.1.1.1         YES manual up                    up

 R2#show ip interface brief
Interface              IP-Address      OK? Method Status                Protocol
FastEthernet0/0        20.1.1.1        YES manual up                    up
Serial3/0                     1.1.1.2         YES manual up                    up
Serial3/1                      2.1.1.1         YES manual up                    up

R3#show ip interface brief

Interface              IP-Address      OK? Method Status                Protocol

FastEthernet0/0        30.1.1.1        YES manual up                    up

Serial3/1                     2.1.1.2         YES manual up                    up

R1(config)#router eigrp 65001
R1(config-router)#network 1.0.0.0
R1(config-router)#network 10.0.0.0
R1(config-router)#exit

R2(config)#router eigrp 65001

R2(config-router)#network 20.0.0.0

R2(config-router)#network 2.0.0.0

R2(config-router)#network 1.0.0.0

*Mar 18 13:43:20.971: %DUAL-5-NBRCHANGE: EIGRP-IPv4 65001: Neighbor 1.1.1.1 (Serial3/0) is up: new adjacency

R2(config-router)#end

R3(config)#router eigrp 65001

R3(config-router)#network 2.0.0.0

*Mar 18 13:44:10.655: %DUAL-5-NBRCHANGE: EIGRP-IPv4 65001: Neighbor 2.1.1.1 (Serial3/1) is up: new adjacency

R3(config-router)#network 30.0.0.0

R3(config-router)#end

R1#show ip route eigrp
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       + - replicated route, % - next hop override

Gateway of last resort is not set

D     2.0.0.0/8 [90/2681856] via 1.1.1.2, 00:03:36, Serial3/0
D     20.0.0.0/8 [90/2172416] via 1.1.1.2, 00:03:36, Serial3/0
D     30.0.0.0/8 [90/2684416] via 1.1.1.2, 00:00:16, Serial3/0

R2#show ip route eigrp

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP

       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

       E1 - OSPF external type 1, E2 - OSPF external type 2

       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

       ia - IS-IS inter area, * - candidate default, U - per-user static route

       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP

       + - replicated route, % - next hop override

Gateway of last resort is not set

D     10.0.0.0/8 [90/2172416] via 1.1.1.1, 00:04:00, Serial3/0

D     30.0.0.0/8 [90/2172416] via 2.1.1.2, 00:00:40, Serial3/1

R3#show ip route eigrp

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP

       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

       E1 - OSPF external type 1, E2 - OSPF external type 2

       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

       ia - IS-IS inter area, * - candidate default, U - per-user static route

       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP

       + - replicated route, % - next hop override

Gateway of last resort is not set

D     1.0.0.0/8 [90/2681856] via 2.1.1.1, 00:00:58, Serial3/1

D     10.0.0.0/8 [90/2684416] via 2.1.1.1, 00:00:58, Serial3/1

D     20.0.0.0/8 [90/2172416] via 2.1.1.1, 00:00:58, Serial3/1

R2#show ip eigrp neighbors
EIGRP-IPv4 Neighbors for AS(65001)
H   Address                 Interface              Hold Uptime   SRTT   RTO  Q  Seq
                                                                      (sec)            (ms)   Cnt Num
1   2.1.1.2                 Se3/1                    14 00:01:19            21   126  0  7
0   1.1.1.1                 Se3/0                    10 00:04:39            27   162  0  6

R2(config)#router eigrp 65001
R2(config-router)#passive-interface serial 3/1

*Mar 18 13:50:02.303: %DUAL-5-NBRCHANGE: EIGRP-IPv4 65001: Neighbor 2.1.1.2 (Serial3/1) is down: interface passive
R2(config-router)#end

R1#show ip route eigrp
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       + - replicated route, % - next hop override

Gateway of last resort is not set

D     2.0.0.0/8 [90/2681856] via 1.1.1.2, 00:07:22, Serial3/0
D     20.0.0.0/8 [90/2172416] via 1.1.1.2, 00:07:22, Serial3/0

R2#show ip route eigrp

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP

       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

       E1 - OSPF external type 1, E2 - OSPF external type 2

       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

       ia - IS-IS inter area, * - candidate default, U - per-user static route

       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP

       + - replicated route, % - next hop override

Gateway of last resort is not set

D     10.0.0.0/8 [90/2172416] via 1.1.1.1, 00:07:56, Serial3/0

R2#show ip eigrp neighbors

EIGRP-IPv4 Neighbors for AS(65001)

H   Address                 Interface              Hold Uptime   SRTT   RTO  Q  Seq

                                                   (sec)         (ms)       Cnt Num

0   1.1.1.1                 Se3/0                    13 00:08:29   32   192  0  7

EIGRP STUB and Configuration

EIGRP STUB

Stub routing is one way to limit queries. A stub router is one that is connected to on more than two neighbors and should be a transit router. 

The EIGRP stub routing feature improve network stability, reduces resource utilization, and simplifies remote router (spoke) configuration. Stub routing is commonly used in a Hub-and-Spoke topology.

Here is the command:

R1(config-router)#EIGRP STUB ?

  connected       Do advertise connected routes

  leak-map        Allow dynamic prefixes based on the leak-map

  receive-only    Set receive only neighbor

  redistributed   Do advertise redistributed routes

  static                 Do advertise static routes

  summary         Do advertise summary routes

• Connected means the router advertise connected routes only for those interfaces which matched with a network command.
•  Leak-map means the router advertise only which is specified by a leak-map
•  Receive-only means the router do not advertise any routes. And this option can be used with any other option.
• Redistribution means the router advertise only the redistributed routes.
• Static means the router advertise only the static routes with redistributed static command configured.
• Summary means the router advertise only auto summarized or statically configured summary routes

NOTE: By default is connected and summary.

Before we start  EIGRP configuration check out some important  of EIGRP CCIE exam topics.

Here is the lists of all EIGRP labs and theories CCNA to CCIE

1.Enhanced Interior Gateway Routing Protocol (EIGRP)

2.Stuck In Active (EIGRP)

3.EIGRP Equal-Cost and Unequal-Cost load balancing

4.Route filtering passive interface

5.Route summarization

6.EIGRP STUB and Configuration

7. Routing Protocol Authentication (EIGRP ) and configuration

let's see the configuration for a better understanding: -

Topology:

 Goal:

• configure the topology as per the diagram.
• configure EIGRP 650001 advertise interfaces and disable auto-summary.
• make sure only one route advertises to router 1 and router 2 from router 3
• after verifying the summary now configure EIGRP STUB on router 1 preventing sending any routes to router 2 make sure router 2 receives routes only from router 2.

R1#show ip interface brief

Interface              IP-Address      OK? Method Status                Protocol

FastEthernet0/0        10.1.1.1        YES manual up                    up

Serial3/0                     1.1.1.1         YES manual up                    up

Loopback0              11.0.0.1        YES manual up                    up

Loopback1              11.0.1.1        YES manual up                    up

Loopback2              11.0.2.1        YES manual up                    up

Loopback3              11.0.3.1        YES manual up                    up

R2#show ip interface brief

Interface              IP-Address      OK? Method Status                Protocol

FastEthernet0/0        20.1.1.1        YES manual up                    up

Serial3/0                    1.1.1.2         YES manual up                    up

Serial3/1                    2.1.1.1         YES manual up                    up

Serial3/2                    3.1.1.1         YES manual up                    up

Loopback0              12.0.0.1        YES manual up                    up

Loopback1              12.0.1.1        YES manual up                    up

Loopback2              12.0.2.1        YES manual up                    up

Loopback3              12.0.3.1        YES manual up                    up

R3#show ip interface brief

Interface              IP-Address      OK? Method Status                Protocol

FastEthernet0/0        30.1.1.1        YES manual up                    up

Serial3/1                    2.1.1.2         YES manual up                    up

Loopback0              13.0.0.1        YES manual up                    up

Loopback1              13.0.1.1        YES manual up                    up

Loopback2              13.0.2.1        YES manual up                    up

Loopback3              13.0.3.1        YES manual up                    up

R1(config)#router eigrp 65001

R1(config-router)#network 1.0.0.0

R1(config-router)#network 10.0.0.0

R1(config-router)#no auto-summary

R1(config-router)#exit

R2(config)#router eigrp 65001

R2(config-router)#network 1.0.0.0

R2(config-router)#network 1.0.0.0

*Mar 18 12:25:38.567: %DUAL-5-NBRCHANGE: EIGRP-IPv4 65001: Neighbor 1.1.1.1 (Serial3/0) is up: new adjacency

R2(config-router)#network 2.0.0.0

R2(config-router)#network 20.0.0.0

R2(config-router)#no auto-summary

R2(config-router)#exit

R3(config)#router eigrp 65001

R3(config-router)#network 2.0.0.0

*Mar 18 12:26:16.707: %DUAL-5-NBRCHANGE: EIGRP-IPv4 65001: Neighbor 2.1.1.1 (Serial3/1) is up: new adjacency

R3(config-router)#network 13.0.0.0

R3(config-router)#network 30.0.0.0

R3(config-router)#no auto-summary

R3(config-router)#exit

R2#show ip eigrp neighbors

EIGRP-IPv4 Neighbors for AS(65001)

H   Address                 Interface              Hold Uptime   SRTT   RTO  Q  Seq

                                                                  (sec)             (ms)       Cnt Num

1   2.1.1.2                 Se3/1                    12 00:08:12   73   438  0  6

0   1.1.1.1                 Se3/0                    14 00:08:50   67   402  0  6

R1#show ip route eigrp

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP

       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

       E1 - OSPF external type 1, E2 - OSPF external type 2

       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

       ia - IS-IS inter area, * - candidate default, U - per-user static route

       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP

       + - replicated route, % - next hop override

Gateway of last resort is not set

D     2.0.0.0/8 [90/2681856] via 1.1.1.2, 00:10:28, Serial3/0

      13.0.0.0/24 is subnetted, 4 subnets

D        13.0.0.0 [90/2809856] via 1.1.1.2, 00:02:34, Serial3/0

D        13.0.1.0 [90/2809856] via 1.1.1.2, 00:02:34, Serial3/0

D        13.0.2.0 [90/2809856] via 1.1.1.2, 00:02:34, Serial3/0

D        13.0.3.0 [90/2809856] via 1.1.1.2, 00:02:34, Serial3/0

D     20.0.0.0/8 [90/2172416] via 1.1.1.2, 00:06:46, Serial3/0

D     30.0.0.0/8 [90/2684416] via 1.1.1.2, 00:05:52, Serial3/0

R2#show ip route eigrp

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP

       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

       E1 - OSPF external type 1, E2 - OSPF external type 2

       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

       ia - IS-IS inter area, * - candidate default, U - per-user static route

       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP

       + - replicated route, % - next hop override

Gateway of last resort is not set

D     10.0.0.0/8 [90/2172416] via 1.1.1.1, 00:09:56, Serial3/0

      13.0.0.0/24 is subnetted, 4 subnets

D        13.0.0.0 [90/2297856] via 2.1.1.2, 00:01:57, Serial3/1

D        13.0.1.0 [90/2297856] via 2.1.1.2, 00:01:57, Serial3/1

D        13.0.2.0 [90/2297856] via 2.1.1.2, 00:01:57, Serial3/1

D        13.0.3.0 [90/2297856] via 2.1.1.2, 00:01:57, Serial3/1

D     30.0.0.0/8 [90/2172416] via 2.1.1.2, 00:05:15, Serial3/1

(now we are going to configure summary route)

R3(config)#interface serial 3/1

R3(config-if)#ip summary-address eigrp 65001 13.0.0.0 255.255.252.0

*Mar 18 12:39:48.235: %DUAL-5-NBRCHANGE: EIGRP-IPv4 65001: Neighbor 2.1.1.1 (Serial3/1) is resync: summary configured

R3(config)#router eigrp 65001

R3(config-router)#eigrp stub ?

  connected      Do advertise connected routes

  leak-map       Allow dynamic prefixes based on the leak-map

  receive-only   Set receive only neighbor

  redistributed  Do advertise redistributed routes

  static         Do advertise static routes

  summary        Do advertise summary routes

  <cr>

R3(config-router)#eigrp stub summary

*Mar 18 12:42:36.931: %DUAL-5-NBRCHANGE: EIGRP-IPv4 65001: Neighbor 2.1.1.1 (Serial3/1) is down: peer info changed

*Mar 18 12:42:37.375: %DUAL-5-NBRCHANGE: EIGRP-IPv4 65001: Neighbor 2.1.1.1 (Serial3/1) is up: new adjacency

R3(config-router)#end

R2#show ip route eigrp

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP

       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

       E1 - OSPF external type 1, E2 - OSPF external type 2

       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

       ia - IS-IS inter area, * - candidate default, U - per-user static route

       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP

       + - replicated route, % - next hop override

Gateway of last resort is not set

D     10.0.0.0/8 [90/2172416] via 1.1.1.1, 00:17:21, Serial3/0

      13.0.0.0/22 is subnetted, 1 subnets

D        13.0.0.0 [90/2297856] via 2.1.1.2, 00:00:22, Serial3/1

R1#show ip route eigrp

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP

       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

       E1 - OSPF external type 1, E2 - OSPF external type 2

       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

       ia - IS-IS inter area, * - candidate default, U - per-user static route

       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP

       + - replicated route, % - next hop override

Gateway of last resort is not set

D     2.0.0.0/8 [90/2681856] via 1.1.1.2, 00:19:02, Serial3/0

      13.0.0.0/22 is subnetted, 1 subnets

D        13.0.0.0 [90/2809856] via 1.1.1.2, 00:02:07, Serial3/0

D     20.0.0.0/8 [90/2172416] via 1.1.1.2, 00:15:20, Serial3/0

R1(config)#router eigrp 65001

R1(config-router)#eigrp stub ?

  connected      Do advertise connected routes

  leak-map       Allow dynamic prefixes based on the leak-map

  receive-only   Set receive only neighbor

  redistributed  Do advertise redistributed routes

  static         Do advertise static routes

  summary        Do advertise summary routes

  <cr>

R1(config-router)#eigrp stub receive-only

*Mar 18 12:52:06.603: %DUAL-5-NBRCHANGE: EIGRP-IPv4 65001: Neighbor 1.1.1.2 (Serial3/0) is down: peer info changed

*Mar 18 12:52:06.959: %DUAL-5-NBRCHANGE: EIGRP-IPv4 65001: Neighbor 1.1.1.2 (Serial3/0) is up: new adjacency

R1(config-router)#end

R2#show ip route eigrp

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP

       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

       E1 - OSPF external type 1, E2 - OSPF external type 2

       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

       ia - IS-IS inter area, * - candidate default, U - per-user static route

       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP

       + - replicated route, % - next hop override

Gateway of last resort is not set

      13.0.0.0/22 is subnetted, 1 subnets

D        13.0.0.0 [90/2297856] via 2.1.1.2, 00:11:12, Serial3/1

R3#show ip route eigrp

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP

       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

       E1 - OSPF external type 1, E2 - OSPF external type 2

       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

       ia - IS-IS inter area, * - candidate default, U - per-user static route

       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP

       + - replicated route, % - next hop override

Gateway of last resort is not set

D     1.0.0.0/8 [90/2681856] via 2.1.1.1, 00:11:55, Serial3/1

      13.0.0.0/8 is variably subnetted, 9 subnets, 3 masks

D        13.0.0.0/22 is a summary, 00:14:44, Null0

D     20.0.0.0/8 [90/2172416] via 2.1.1.1, 00:11:55, Serial3/1

(after configure EIGRP STUB receive only on route 1. router 1 preventing all the routes

but router 3 learn all the routes from route 2)