Lesson 8 -- Dynamic Routing with EIGRP

Later in the week, your boss calls you to ask about another dynamic routing protocol known as EIGRP. She explains that she read that EIGRP is a Cisco proprietary routing protocol, and since we are using Cisco equipment, wouldn't it be best to use the routing protocol that Cisco designed for their routers? Also, she continues, the article said that EIGRP allows the network admin to configure authentication between routers, which can help keep malicious hackers from injecting bogus routes into your routing tables. You try to tell her that while that's true, you are only sending and receiving route updates across a point-to-point link on a private, leased line -- there's no way for a miscreant to inject a route into your routing tables unless they have physical access to your T1 line, but she tells you that she thinks you should remove OSPF and move to EIGRP, anyway. You roll your eyes (you're on the phone, after all), and agree to give it a try, silently fantasizing about shutting off her Internet access so you can stop reconfiguring your routers every time she reads a new article on-line.

Once again, you log into the main office and branch office routers, remove OSPF and configure EIGRP:

lab2651rtr# conf t
lab2651rtr(config)# no router ospf 2112
lab2651rtr(config)# router eigrp 42
lab2651rtr(config-router)# network 192.168.3.4 0.0.0.3
lab2651rtr(config-router)# redistribute connected
lab2651rtr(config-router)# redistribute static
lab2651rtr(config-router)# no auto-summary
lab2651rtr(config-router)# key chain EIGRP
lab2651rtr(config-keychain)# key 1
lab2651r(config-keychain-key)# key-string +h@nks_4_+he_f!sh
lab2651r(config-keychain-key)# int serial 0/1
lab2651rtr(config-if)# ip authentication mode eigrp 1 md5
lab2651rtr(config-if)# ip authentication key-chain eigrp 1 EIGRP
lab2651rtr(config-if)# exit
lab2651rtr(config)# exit
lab2651rtr#


...and on the branch office router:

lab3640rtr# conf t
lab3640rtr(config)# no router ospf 2112
lab3640rtr(config)# router eigrp 42
lab3640rtr(config-router)# network 192.168.3.4 0.0.0.3
lab3640rtr(config-router)# redistribute connected
lab3640rtr(config-router)# no auto-summary
lab3640rtr(config-router)# key chain EIGRP
lab3640rtr(config-keychain)# key 1
lab3640r(config-keychain-key)# key-string +h@nks_4_+he_f!sh
lab3640r(config-keychain-key)# int serial 0/1
lab3640rtr(config-if)# ip authentication mode eigrp 1 md5
lab3640rtr(config-if)# ip authentication key-chain eigrp 1 EIGRP
lab3640rtr(config-if)# exit
lab3640rtr(config)# exit
lab3640rtr#


Hmmm...EIGRP looks a little more complex, but a lot of the commands look similar to the other routing protocols we've used. Let's discuss the commands in detail:
* First, we tell the router that we want to use EIGRP, just like we did with RIP and OSPF. However, the "42" is not an EIGRP process number, like we saw with OSPF. EIGRP uses "Autonomous Systems" and and they must match between routers that are sharing routes through EIGRP!
* Again, we tell the router what networks to advertise with the "network" statement, very similar to the "network" statements found in RIP and OSPF, but what looks sort of like a subnet mask following the network address is actually a "wildcard mask." Logically, if you convert the subnet mask to binary (in this case, 11111111.11111111.11111111.11111100), then invert the ones and zeros (00000000.00000000.00000000.00000011), then convert back to decimal, that's a "wildcard mask." Or, you can just subtract each octet of the subnet mask from 255, like a normal (i.e., lazy) person ;)
* The "redistribute connected" command is identical to the same command in OSPF.
* The "no auto-summary" command tells EIGRP not to collapse classless subnets into a single classful network address.
* From here on, configuring EIGRP becomes very different from what we've done previously. On the plus side, the authentication configuration is entirely optional -- you don't have to configure authentication if you don't want to, but if you do, here's how you do it. First, we will store the password in a "key chain" (a database of passwords). Since there can be multiple key chains, we have to tell the router which one to use. In this case, we called it, logically enough, "EIGRP." The number we use in the "key" command must match between routers sharing routes through EIGRP. Next, we configure the password to be used by the two routers to authenticate with each other, using the "key-string" command. After that, we have to apply the authentication mechanism to a specific interface, in this case, serial 0/1 on both routers. Inside the interface configuration, we set the authentication mode (authentication is for the EIGRP routing protocol, using key 1, and it will be encrypted with the MD5 algorithm. Finally, we state that we are using key 1 (again) from the EIGRP key chain.

Whew...glad we've got that configured. Make sure the settings match on both routers, or else the routers won't be able to share routes. If anything doesn't match, fix it now, then check your work:

lab2651rtr# sho ip route
<...snip...there are a lot of extra lines of output that aren't needed now...>
Gateway of last resort is 100.64.1.1 to network 0.0.0.0

     100.0.0.0/24 is subnetted, 1 subnets
C     100.64.1.0 is directly connected, FastEthernet0/1
C     192.168.1.0/24 is directly connected, FastEthernet0/0
      192.168.3.0/30 is subnetted, 1 subnets
C     192.168.3.4 is directly connected, Serial0/1
S*     0.0.0.0/0 [1/0] via 100.64.1.1


Wait...what? Where's the 192.168.2.0/24 subnet?

lab2651rtr# sho ip eigrp topology
IP-EIGRP Topology Table for AS(42)/ID(192.168.3.5)

Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,
     r - reply Status, s - sia Status
P 0.0.0.0/0, 1 successors, FD is 281600
     via Rstatic (281600/0)
P 100.64.1.0/24, 1 successors, FD is 281600
     via Rconnected (281600/0)
P 192.168.1.0/24, 1 successors, FD is 28160
     via Rconnected (28160/0)
P 192.168.3.4/30, 1 successors, FD is 2169856
     via Connected, Serial0/1
lab2651rtr#


The configuration looks good, and on the branch office router, I can see routes shared by the main office router:

lab3640rtr# sho ip route
<...snip...>
Gateway of last resort is 192.168.3.5 to network 0.0.0.0

     100.0.0.0/24 is subnetted, 1 subnets
D EX     100.64.1.0 [170/2195456] via 192.168.3.5, 00:50:24, Serial0/1
D EX 192.168.1.0/24 [170/2172416] via 192.168.3.5, 00:50:24, Serial0/1
     192.168.3.0/30 is subnetted, 1 subnets
C     192.168.3.4 is directly connected, Serial0/1
D*EX 0.0.0.0/0 [170/2195456] via 192.168.3.5, 00:50:21, Serial0/1
lab3640rtr#


That tells me that whatever is wrong, it isn't an EIGRP problem -- routes from the main office router are showing up on the branch office router. You glance at your watch, and suddenly realize what the problem is. It's two hours after quitting time. Everyone at the branch office had gone home for the night, and all their PCs were shut off. With nothing connected to FA0/0 on the branch office router, the interface had gone down, and therefore EIGRP wasn't propagating any routes to the 192.168.2.0/24 subnet. You go home for the night, and check again the next morning. Sure enough, you can see the 192.168.2.0/24 subnet on the main office router's routing tables.