Hands-On Lab: Configuring EIGRP Authentication

Lab Objective

Configure a key chain and MD5 authentication on an EIGRP-enabled interface between two routers, verify the neighbor relationship forms successfully when keys match, then introduce a key mismatch and observe the resulting failure.

Lab Purpose

Just as with OSPF authentication covered in the previous lab, EIGRP without authentication allows any device sending properly formatted EIGRP hellos on a shared segment to potentially form an unauthorized neighbor relationship. EIGRP authentication uses a distinct configuration mechanism — the key chain — worth understanding on its own terms.

Lab Topology

R1 ---- Gi0/0 ------------------ Gi0/0 ---- R2
     192.168.120.1/24         192.168.120.2/24

EIGRP AS 100, already forming a healthy
adjacency between R1 and R2

Task 1: Verify the Current Healthy Adjacency

Confirm R1 and R2 show an active EIGRP neighbor relationship before adding authentication.

Task 2: Create a Key Chain on R1

Define a key chain with a key ID and key string.

Task 3: Apply the Key Chain and Enable Authentication on R1's Interface

Configure MD5 authentication mode and reference the key chain on the interface.

Task 4: Configure the Matching Key Chain and Authentication on R2

Repeat the same configuration on R2 with an identical key.

Task 5: Verify the Adjacency Remains Active

Confirm the neighbor relationship is unaffected, since both keys match.

Task 6: Introduce a Key Mismatch and Verify Failure

Change R2's key string to a different value and observe the resulting neighbor loss.

Solution and Verification

R1# show ip eigrp neighbors

H   Address           Interface   Hold Uptime
0   192.168.120.2      Gi0/0        13   00:05:22

R1(config)# key chain EIGRP-KEYS
R1(config-keychain)# key 1
R1(config-keychain-key)# key-string EigrpKey2026

R1(config)# interface gigabitethernet0/0
R1(config-if)# ip authentication mode eigrp 100 md5
R1(config-if)# ip authentication key-chain eigrp 100 EIGRP-KEYS

R2(config)# key chain EIGRP-KEYS
R2(config-keychain)# key 1
R2(config-keychain-key)# key-string EigrpKey2026
R2(config-keychain-key)# exit
R2(config-keychain)# exit
R2(config)# interface gigabitethernet0/0
R2(config-if)# ip authentication mode eigrp 100 md5
R2(config-if)# ip authentication key-chain eigrp 100 EIGRP-KEYS

R1# show ip eigrp neighbors

H   Address           Interface   Hold Uptime
0   192.168.120.2      Gi0/0        14   00:00:08
-- Neighbor relationship reformed cleanly
-- once both sides had matching keys applied

R2(config)# key chain EIGRP-KEYS
R2(config-keychain)# key 1
R2(config-keychain-key)# key-string DifferentKey999

R1# debug eigrp packets

EIGRP: Auth failure for packet from 192.168.120.2,
key-chain "EIGRP-KEYS" key-id 1

R1# show ip eigrp neighbors

-- (empty -- neighbor lost once the hold
--  timer expires, since authentication
--  now fails on every subsequent hello)

Key Takeaway

EIGRP authentication requires a key chain as an intermediate configuration object rather than applying a key value directly to the interface as OSPF authentication does — this key chain structure exists specifically to support key rotation over time (multiple keys with different valid time windows), a capability worth knowing about even in a simple single-key lab like this one.