Back to EIGRP GuideENARSI neighbor security

EIGRP Neighbors and Authentication

Learn how two EIGRP routers become neighbors, which settings must agree, how authentication protects packets, and where to look when the adjacency fails.

AS NumberK-valuesHellosKey ChainVerification

Neighbor Formation at a Glance

EIGRP sends Hello packets on enabled interfaces. A receiver checks important parameters before adding the sender to its neighbor table.

IPv4 multicast224.0.0.10

IPv6 multicastFF02::A

TransportIP protocol 88

Primary proofNeighbor table

1. Know What Must Match

Setting	Must match?	Meaning
Autonomous system	Yes	Both interfaces join the same EIGRP domain.
K-values	Yes	Both sides calculate metrics the same way.
Authentication	Yes, when enabled	Method, key ID/time, and secret must agree.
Primary subnet	Compatible	The peers must communicate directly.
Hello and hold timers	No	Each router advertises its own hold time.

2. Build the Neighbor Before Securing It

R1 baseline

router eigrp 100
 network 10.0.12.1 0.0.0.0

R2 baseline

router eigrp 100
 network 10.0.12.2 0.0.0.0

Confirm the neighbor first. This separates an addressing or EIGRP activation problem from an authentication problem.

show ip eigrp neighbors
show ip eigrp interfaces detail
show ip protocols

3. Configure Classic-Mode Authentication

Create the same key chain

key chain EIGRP-KEYS
 key 10
  key-string LAB-SECRET

Apply it to both link interfaces

interface GigabitEthernet0/0
 ip authentication mode eigrp 100 md5
 ip authentication key-chain eigrp 100 EIGRP-KEYS

Security note: Authentication validates EIGRP packets; it does not encrypt the routing information. Use a lab-only secret in documentation.

4. Place Authentication in Named Mode

router eigrp ENTERPRISE
 address-family ipv4 unicast autonomous-system 100
  af-interface GigabitEthernet0/0
   authentication mode md5
   authentication key-chain EIGRP-KEYS
  exit-af-interface
 exit-address-family

Named mode keeps interface policy under af-interface. Confirm exact algorithm support on the target IOS release.

5. Understand Hello and Hold Timers

Hello packets maintain discovery. The hold timer tells a neighbor how long it may wait without hearing another Hello. The values do not need to match, but overly aggressive timers can create unstable adjacencies on busy or lossy links.

show ip eigrp interfaces detail
show ip eigrp neighbors

6. Verify in the Right Order

Interface

Confirm up/up, address, and EIGRP activation.

Parameters

Compare AS, K-values, passive state, and authentication.

Neighbor

Check hold time, uptime, SRTT, RTO, and queue count.

7. Troubleshoot a Missing or Flapping Neighbor

Symptom	Likely cause	First check
No neighbor entry	AS, activation, subnet, ACL, or passive interface	`show ip eigrp interfaces`
Neighbor drops after security change	Key chain, key ID/time, secret, or mode mismatch	Compare both interface configurations
Uptime repeatedly resets	Loss, duplicate address, authentication, or unstable link	Logs, counters, and queue count
High SRTT/RTO	Slow acknowledgments or congestion	Interface errors and WAN health

8. Guided Practice

Healthy baseline

Build the neighbor without authentication.
Record neighbor detail.
Confirm two-way route learning.

Secure both sides

Create matching key chains.
Apply authentication to both interfaces.
Confirm the adjacency returns.

Find a safe fault

Change one lab key.
Observe the neighbor drop.
Restore and verify recovery.

9. Frequently Asked Questions

Must EIGRP timers match?

No. Each router tells its neighbor which hold time to use.

Does authentication encrypt EIGRP routes?

No. It validates packet origin and integrity but does not provide confidentiality.

What should I check first after authentication breaks a neighbor?

Compare the applied interface, AS, method, key chain name, active key ID, and secret on both routers.