EIGRP MD5

Answered Question
Aug 4th, 2009

When our EIGRP routing was first setup the installers didn't secure it. We now have 25 routers, and it is way past time to secure it. I have read and understand how to enable and have done so on there networks with OSPF, but not once the network is using it.


How can I set this up without taking the network down?


Any thoughts.


Thank You

Correct Answer by Jon Marshall about 7 years 6 months ago

Jeff


Once MD5 auth is enabled on all interfaces then changing the key can be done without any downtime.


But as Jerry notes this won't work when you actually configure it for the first time.


If no downtime is acceptable then one way around this is to configure a second EIGRP AS on each router. Because authentication uses the AS number a second AS would allow you to break the original AS while adding MD5 auth and the router will still have all the routes in the second temporary AS.


Once MD5 is enabled and working in the original AS then you can delete the second temporary AS.


Jon

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (3 ratings)
Loading.
Jerry Ye Tue, 08/04/2009 - 12:13

Hi Jeff,


EIGRP authentication is a per interface configuration. It will affect the directly connected interfaces. When you enable authentication on two (2) adjacent interfaces (remote first then local), since EIGRP converge really fast, the neighbor adjacency will flop (depend on how fast you enter the commands on that interface).


HTH,

jerry

jeff.cook@wecu.com Tue, 08/04/2009 - 12:20

That might not work very well on a network with 5 routers on it. Not sure I can tyoe that fast.


It may work for the point to point links however.



Correct Answer
Jon Marshall Tue, 08/04/2009 - 12:23

Jeff


Once MD5 auth is enabled on all interfaces then changing the key can be done without any downtime.


But as Jerry notes this won't work when you actually configure it for the first time.


If no downtime is acceptable then one way around this is to configure a second EIGRP AS on each router. Because authentication uses the AS number a second AS would allow you to break the original AS while adding MD5 auth and the router will still have all the routes in the second temporary AS.


Once MD5 is enabled and working in the original AS then you can delete the second temporary AS.


Jon

Jerry Ye Tue, 08/04/2009 - 12:30

Not EIGRP, you can have multiple process.


Single process for BGP.


HTH,

jerry

jeff.cook@wecu.com Tue, 08/04/2009 - 12:33

Cool. That sounds like a great plan. I will give it a shot. I'm assuming I need to redistribute EIGRP 1 into EIGRP 2 and vis versa to make this work.


Thank you very much.

Jon Marshall Tue, 08/04/2009 - 12:34

Jeff


No you don't need to redistribute between the 2. You just configure a second AS on each router with the same configuration as the first.


Jon

Actions

This Discussion