Skip to content
Log in Sign up My account

Sim 01: EIGRP Named Mode Adjacency, Authentication and Stub

Blueprint 1.9.a, 1.9.b, 1.9.d

Difficulty Time target Devices Faults
Medium 20 minutes 3 x IOSv 3

Scenario

A small company runs EIGRP named mode, AS 100, between two head-office routers and one branch. R1 serves the head-office users, R2 sits in the data centre in front of the server network, and R3 is the branch router. The branch is dual-homed to both head-office routers over WAN links that use MD5 authentication. R3 is an EIGRP stub that advertises only its connected and summary routes.

Download the lab

CML lab file · EVE-NG lab file

3 nodes. The lab boots already broken (the faults are in the start-up configs, so skip Break it). CML: Import a lab, then start it. EVE-NG: import the .unl from the lab list; if your image folder names differ, edit each node's image.

Topology

graph LR
  R1["R1 HQ<br/>Lo10 10.1.10.1/24"] -- "Gi0/0 .1  10.1.2.0/30  .2 Gi0/0" --- R2["R2 DC<br/>Lo20 10.2.20.1/24"]
  R1 -- "Gi0/1 .1  10.1.3.0/30  .2 Gi0/0" --- R3["R3 Branch stub<br/>Lo30 10.3.30.1/24"]
  R2 -- "Gi0/1 .1  10.2.3.0/30  .2 Gi0/1" --- R3
Device Interface Address Notes
R1 Gi0/0 10.1.2.1/30 To R2, no authentication
R1 Gi0/1 10.1.3.1/30 WAN to R3, MD5
R1 Lo0 / Lo10 10.255.255.1/32 / 10.1.10.1/24 Lo10 is the HQ user LAN
R2 Gi0/0 10.1.2.2/30 To R1
R2 Gi0/1 10.2.3.1/30 WAN to R3, MD5
R2 Lo0 / Lo20 10.255.255.2/32 / 10.2.20.1/24 Lo20 is the server LAN
R3 Gi0/0 10.1.3.2/30 WAN to R1, MD5
R3 Gi0/1 10.2.3.2/30 WAN to R2, MD5
R3 Lo0 / Lo30 10.255.255.3/32 / 10.3.30.1/24 Lo30 is the branch LAN

Build it in CML

Three IOSv nodes. Link R1 Gi0/0 to R2 Gi0/0, R1 Gi0/1 to R3 Gi0/0, and R2 Gi0/1 to R3 Gi0/1. Paste the baseline, then save it on every router with copy running-config flash:baseline.cfg.

Baseline configuration

R1 baseline 
hostname R1
!
key chain EIGRP-WAN
 key 1
  key-string Br4nchWAN
!
interface Loopback0
 ip address 10.255.255.1 255.255.255.255
interface Loopback10
 ip address 10.1.10.1 255.255.255.0
interface GigabitEthernet0/0
 description To R2
 ip address 10.1.2.1 255.255.255.252
 no shutdown
interface GigabitEthernet0/1
 description WAN to R3
 ip address 10.1.3.1 255.255.255.252
 no shutdown
!
router eigrp CORP
 address-family ipv4 unicast autonomous-system 100
  af-interface GigabitEthernet0/1
   authentication mode md5
   authentication key-chain EIGRP-WAN
  exit-af-interface
  topology base
  exit-af-topology
  network 10.0.0.0
  eigrp router-id 10.255.255.1
 exit-address-family
R2 baseline 
hostname R2
!
key chain EIGRP-WAN
 key 1
  key-string Br4nchWAN
!
interface Loopback0
 ip address 10.255.255.2 255.255.255.255
interface Loopback20
 ip address 10.2.20.1 255.255.255.0
interface GigabitEthernet0/0
 description To R1
 ip address 10.1.2.2 255.255.255.252
 no shutdown
interface GigabitEthernet0/1
 description WAN to R3
 ip address 10.2.3.1 255.255.255.252
 no shutdown
!
router eigrp CORP
 address-family ipv4 unicast autonomous-system 100
  af-interface GigabitEthernet0/1
   authentication mode md5
   authentication key-chain EIGRP-WAN
  exit-af-interface
  topology base
  exit-af-topology
  network 10.0.0.0
  eigrp router-id 10.255.255.2
 exit-address-family
R3 baseline 
hostname R3
!
key chain EIGRP-WAN
 key 1
  key-string Br4nchWAN
!
interface Loopback0
 ip address 10.255.255.3 255.255.255.255
interface Loopback30
 ip address 10.3.30.1 255.255.255.0
interface GigabitEthernet0/0
 description WAN to R1
 ip address 10.1.3.2 255.255.255.252
 no shutdown
interface GigabitEthernet0/1
 description WAN to R2
 ip address 10.2.3.2 255.255.255.252
 no shutdown
!
router eigrp CORP
 address-family ipv4 unicast autonomous-system 100
  af-interface GigabitEthernet0/0
   authentication mode md5
   authentication key-chain EIGRP-WAN
  exit-af-interface
  af-interface GigabitEthernet0/1
   authentication mode md5
   authentication key-chain EIGRP-WAN
  exit-af-interface
  topology base
  exit-af-topology
  network 10.0.0.0
  eigrp router-id 10.255.255.3
  eigrp stub connected summary
 exit-address-family

Verify the baseline

R1# show eigrp address-family ipv4 neighbors
EIGRP-IPv4 VR(CORP) Address-Family Neighbors for AS(100)
H   Address        Interface   Hold Uptime   SRTT   RTO  Q  Seq
                               (sec)         (ms)       Cnt Num
1   10.1.3.2       Gi0/1         12 00:03:10    5   100  0  6
0   10.1.2.2       Gi0/0         13 00:03:40    3   100  0  9

R1# show ip route eigrp | include 10.2.20|10.3.30
D        10.2.20.0/24 [90/...] via 10.1.2.2, 00:03:35, GigabitEthernet0/0
D        10.3.30.0/24 [90/...] via 10.1.3.2, 00:03:05, GigabitEthernet0/1

R1# show eigrp address-family ipv4 neighbors detail | include Stub|Suppress
   Stub Peer Advertising (CONNECTED SUMMARY ) Routes
   Suppressing queries

R2 must have two neighbors (R1 and R3) and R3 must have two neighbors (R1 and R2). ping 10.2.20.1 source 10.3.30.1 from R3 must succeed.

Break it

Fault injection (for the lab partner or script only) 

! ---- R2 ----
router eigrp CORP
 address-family ipv4 unicast autonomous-system 100
  af-interface GigabitEthernet0/0
   passive-interface
  exit-af-interface
!
! ---- R3 ----
router eigrp CORP
 address-family ipv4 unicast autonomous-system 100
  af-interface GigabitEthernet0/1
   authentication key-chain EIGRP-WAM
  exit-af-interface
  eigrp stub receive-only
Wait two minutes for hold timers to expire, then clear the console and hand over the ticket.

Trouble ticket

Ticket 1001: branch and data centre unreachable

"Since last night's change window, branch users on 10.3.30.0/24 cannot open anything on the server network 10.2.20.0/24. Head-office users on 10.1.10.0/24 cannot reach the branch either. The change was supposed to 'tidy up' EIGRP. Please restore full reachability."

Requirements: EIGRP AS 100 named mode must stay in use. The R1 to R2 link must carry EIGRP. Both WAN links must stay authenticated with key chain EIGRP-WAN. R3 must remain a stub router that advertises its connected and summary routes.

Restrictions: Do not add static routes. Do not remove authentication from any WAN link.

Symptoms

  • R1 has one EIGRP neighbor (R3). R2 has no EIGRP neighbors at all.
  • R1 has no route to 10.2.20.0/24 or 10.3.30.0/24.
  • ping 10.2.20.1 source 10.3.30.1 on R3 fails.

Root cause and fix

Root cause and fix: fault 1

R2 Gi0/0 is passive in EIGRP. In named mode, passive-interface sits under af-interface. A passive interface sends no hellos and accepts none, so R1 and R2 never become neighbors, but the connected subnet is still advertised.

Diagnose:

R2# show eigrp address-family ipv4 interfaces
EIGRP-IPv4 VR(CORP) Address-Family Interfaces for AS(100)
                    Xmit Queue   PeerQ        Mean   Pacing Time   Multicast    Pending
Interface    Peers  Un/Reliable  Un/Reliable  SRTT   Un/Reliable   Flow Timer   Routes
Gi0/1          0        0/0       0/0           0       0/0            0           0
Lo0            0        0/0       0/0           0       0/0            0           0
Lo20           0        0/0       0/0           0       0/0            0           0

R2# show ip protocols | section Passive
  Passive Interface(s):
    GigabitEthernet0/0

Gi0/0 is missing from the EIGRP interface list and is listed as passive. Passive interfaces never appear in show eigrp address-family ipv4 interfaces.

Fix:

R2(config)# router eigrp CORP
R2(config-router)# address-family ipv4 unicast autonomous-system 100
R2(config-router-af)# af-interface GigabitEthernet0/0
R2(config-router-af-interface)# no passive-interface

R1 and R2 form an adjacency and R1 learns 10.2.20.0/24 from R2.

Root cause and fix: fault 2

R3 Gi0/1 references a key chain that does not exist. The af-interface points to EIGRP-WAM, a typo for EIGRP-WAN. R3 cannot sign its packets with a valid digest, and it cannot validate R2's packets, so R2 drops R3's hellos and R3 drops R2's. The R2 to R3 adjacency never forms.

Diagnose:

R3# show eigrp address-family ipv4 interfaces detail GigabitEthernet0/1 | include Authentication
  Authentication mode is md5,  key-chain is "EIGRP-WAM"

R3# show key chain
Key-chain EIGRP-WAN:
    key 1 -- text "Br4nchWAN"
        accept lifetime (always valid) - (always valid) [valid now]
        send lifetime (always valid) - (always valid) [valid now]

The interface references EIGRP-WAM, but only EIGRP-WAN exists. debug eigrp packets on R2 shows R3's packets being ignored because of an authentication problem; turn it off with undebug all once you have seen it.

Fix:

R3(config)# router eigrp CORP
R3(config-router)# address-family ipv4 unicast autonomous-system 100
R3(config-router-af)# af-interface GigabitEthernet0/1
R3(config-router-af-interface)# authentication key-chain EIGRP-WAN
Root cause and fix: fault 3

R3 is a receive-only stub. A receive-only stub advertises no routes at all, not even connected ones. R1 and R2 therefore never learn 10.3.30.0/24, even with every adjacency up. The requirement is a stub that advertises connected and summary routes.

Diagnose on a hub, which shows how the stub advertised itself:

R1# show eigrp address-family ipv4 neighbors detail
...
0   10.1.3.2   Gi0/1   13 00:06:12   4   100  0  11
   ...
   Receive-Only Peer Advertised
   Suppressing queries

R1# show eigrp address-family ipv4 topology | include 10.3.30
R1#

Fix:

R3(config)# router eigrp CORP
R3(config-router)# address-family ipv4 unicast autonomous-system 100
R3(config-router-af)# eigrp stub connected summary

Changing the stub setting resets the adjacencies. After they come back, R1 shows Stub Peer Advertising (CONNECTED SUMMARY ) Routes for R3 and learns 10.3.30.0/24.

Final verification

R2# show eigrp address-family ipv4 neighbors
H   Address        Interface   Hold Uptime   SRTT   RTO  Q  Seq
1   10.2.3.2       Gi0/1         11 00:01:02   6   100  0  14
0   10.1.2.1       Gi0/0         14 00:02:40   2   100  0  20

R3# ping 10.2.20.1 source 10.3.30.1
!!!!!
R1# ping 10.3.30.1 source 10.1.10.1
!!!!!

Exam trap

A stub router never re-advertises routes it learned from one neighbor to another, whatever stub option is set. That is why R1 could not reach the server LAN through R3 while the R1 to R2 adjacency was down: R3 knew the route but, as a stub, would not offer itself as transit. If a ticket says "traffic should fail over through the branch", a stub branch can never provide that path.

Exam trap

In named mode, authentication, passive-interface, hello and hold timers, and split horizon are all configured under af-interface, not on the physical interface. af-interface default applies a setting to every interface, so check it as well when an interface behaves differently from what its own block suggests.