Professional Documents
Culture Documents
Routing protocols can be configured to prevent receiving false routing updates and EIGRP is no
exception. If you don’t use authentication and you are running EIGRP someone could try to form an
EIGRP neighbor adjacency with one of your routers and try to mess with your network…we don’t want
that to happen right?
Your router will authenticate the source of each routing update packet that it will receive.
Prevents false routing updates from sources that are not approved.
Ignore malicious routing updates.
A potential hacker could be sitting on your network with a laptop running a router emulator, boot up a
Cisco router and try the following things:
Try to establish a neighbor adjacency with one of your routers and advertise junk routes.
Send malicious packets and see if you can drop the neighbor adjacency of one of your authorized
routers.
In order to configure EIGRP authentication we need to do the following:
Configure a key-chain
o Configure a key ID under the key-chain.
o Specify a password for the key ID.
o Optional: specify accept and expire lifetime for the key.
Let’s use two routers and see if we can configure EIGRP MD5 authentication:
Jack(config)#router eigrp 12
Jack(config-router)#network 192.168.12.0
John(config)#interface fastEthernet 0/0
John(config-if)#ip address 192.168.12.2 255.255.255.0
John(config)#router eigrp 12
John(config-router)#network 192.168.12.0
I called mine “KingKong” but it can be different on both routers, it doesn’t matter. The Key ID is a value
that has to match on both routers and the key-string is the password which has to match of course.
First you have to create the keychain and then you need to activate it on the interface. The “12” is the AS
number of EIGRP. The configuration on router John is exactly the same.
You can check if your configuration is correct by using debug eigrp packets. You can see that we received
a packet with MD5 authentication but I didn’t enable MD5 authentication yet on router John.
Let’s fix it:
John(config-keychain)#key 1
John(config-keychain-key)#key-string Banana
You will see the message above in the debug output on router John. At least it tells us that key 1 is the one
with the error.
You will see the message above in the debug output on router John. At least it tells us that key 1 is the one
with the error.
If you want to spice it up a bit you can set an accept and expire lifetime on keys. The idea behind this is
that you can have keys that are only valid for a day, a week, a month or something else. Do you want to use
this in real life? It might enhance security but it also makes maintenance a bit more complex…
Before you configure keys with a limited lifetime make sure you set the correct time and date. You can do
this manually on each router but it’s better to use a NTP (Network Time Protocol) server so all the routers
have the same time/date.