LogoفارسیFA

Hands-On Lab: Passive Interfaces for EIGRP Updates

This hands-on lab configures a passive interface in EIGRP to stop routing updates from being sent out a LAN-facing interface while the network remains advertised, mirroring the same security and efficiency rationale covered earlier for OSPF passive interfaces.

EIGRP Passive InterfaceSuppress EIGRP HellosLAN Interface Security

~3 min read · Updated Sep 22, 2026

Lab Objective

Configure a router's LAN-facing interface as passive within EIGRP, verify its network is still advertised into the routing domain, and confirm no EIGRP hello packets are sent or accepted on that interface afterward.

Lab Purpose

Just as with the OSPF passive interface lab covered earlier in this series, an interface facing an end-user LAN has no legitimate EIGRP neighbor to form an adjacency with. Leaving EIGRP hellos active there wastes bandwidth and exposes the router to unauthorized neighbor formation from anyone who plugs a rogue router into that segment.

Lab Topology

R1
  GigabitEthernet0/0: 192.168.9.1/24 (LAN, end
                       users only, no other routers)
  Serial0/0/0: 10.9.9.1/30 (WAN link to R2,
               legitimate EIGRP neighbor)

EIGRP AS 100 already advertising both networks

Task 1: Verify Both Interfaces Currently Send EIGRP Hellos

Confirm EIGRP is active on both the LAN and WAN interfaces.

Task 2: Configure the LAN Interface as Passive

Set GigabitEthernet0/0 as a passive interface within the EIGRP process.

Task 3: Verify the LAN Network Is Still Advertised

Confirm 192.168.9.0/24 still appears in R2's routing table despite the interface being passive.

Task 4: Verify Hellos Are Suppressed on the LAN Interface

Confirm no EIGRP hello packets are sent on the now-passive interface, while the WAN interface continues normally.

Solution and Verification

R1# show ip eigrp interfaces

Interface       Peers    Xmit Queue
Gi0/0            0        0/0
Se0/0/0          1        0/0
-- Both interfaces are EIGRP-active, including
-- the LAN interface with no legitimate
-- neighbor to talk to

R1(config)# router eigrp 100
R1(config-router)# passive-interface gigabitethernet0/0

R2# show ip route eigrp

D    192.168.9.0/24 [90/2681856] via 10.9.9.1, Serial0/0/0
-- R2 still learns this network correctly --
-- passive interface only suppresses hello
-- packets, it does NOT stop the network from
-- being advertised via the network command

R1# show ip eigrp interfaces

Interface       Peers    Xmit Queue
Se0/0/0          1        0/0
-- Gi0/0 no longer appears in this list at
-- all, since a passive interface is entirely
-- excluded from active EIGRP participation --
-- distinct from OSPF's approach, where the
-- passive interface still shows in the list
-- but with "No Hellos" noted

Key Takeaway

While OSPF's passive interface, covered earlier in this series, still appears in show ip ospf interface output with hellos explicitly suppressed, EIGRP's passive interface is removed from show ip eigrp interfaces entirely — the underlying concept (advertise the route, but accept no neighbors here) is identical between the two protocols, but the verification output differs, which is worth remembering when confirming passive interface configuration on either protocol.

Written & researched by Dr. Shahin Siami

Related Articles

Hands-On Lab: Configuring Standard Numbered ACLs

This hands-on lab configures a standard numbered ACL to permit traffic from a specific subnet while denying everything else, applies it to the correct interface and direction, and verifies both permitted and denied traffic behave as expected.

Continue

Hands-On Lab: Configuring VRRP

This hands-on lab configures VRRP between two routers as the open-standard alternative to HSRP, using a real interface address as the virtual IP, and verifies Master/Backup roles and automatic failover behavior.

Continue

Hands-On Lab: Configure GLBP Redundancy

This hands-on lab configures GLBP between two routers to achieve load balancing across both routers simultaneously, verifying that different hosts receive different virtual MAC addresses and therefore route through different physical gateways.

Continue

Hands-On Lab: Implementing HSRP

This hands-on lab configures HSRP between two routers sharing a virtual gateway address, sets priority and preempt to control which router is active, and verifies automatic failover when the active router fails.

Continue

Hands-On Lab: Verifying the EIGRP Database

This hands-on lab examines the EIGRP topology table directly, identifying the successor and feasible successor for a destination network, and demonstrates how this underlying data explains what appears in the IP routing table.

Continue

Hands-On Lab: Summarizing Routes with EIGRP

This hands-on lab manually configures interface-level route summarization in EIGRP, advertising a single aggregated route instead of several specific subnets, and verifies the automatically created Null0 discard route that prevents summarization-related loops.

Continue
Previous ArticleNext Article