EIGRP authentication
EIGRP authentication is used to prevent an attacker from developiing the EIGRP neighbor relationship with your router and advertising incorrect routing information. By using the same preshared key (PSK) on all routers you can force EIGRP to authenticate each EIGRP message. That way you can secure that your router accepts routing updates only from the trusted sources. To authenticate every message, the MD5 (Message Digest 5) algorithm is used.
Three steps are required to con EIGRP authentication:
1. creating a keychain
2. specifying a key string for a key
3. configuring EIGRP to use authentication
EIGRP uses the idea of key chains. Each key chain can have many keys, just like in real life. You can define a different lifetime break of each key. That way the second key in a key chain can be used after the first one is expired, the third one after the second and so on. After you have designed a key chain with the corresponding keys, you need to enable EIGRP authentication for a particular interface.
To con a router to use EIGRP configuration the following commands are used:
1. (global-config) key chain NAME– creates a keychain
2. (config-keychain) key NUMBER– identifies the key number
3. (config-keychain-key) key-string STRING – specifies the key string for the key
Next, we need to enable EIGRP authentication on an interface. From the interface mode, the following commands are used:
4,(config-if) ip authentication mode eigrp ASN md5 – enables EIGRP authentication on the interface
5. (config-if) ip authentication key-chain eigrp ASN KEY_CHAIN_NAME – specifies the name of the key chain that will be used for authentication
The following example shows how EIGRP authentication is cond:
To set up a time frame for the validity of a key, you need to construct the accept-lifetime and the send-lifetime parameters. The syntax of the commands is:
(config-keychain-key) accept-lifetime start_time {infinite | end_time | duration seconds}
(config-keychain-key) send-lifetime start_time {infinite | end_time | duration seconds}
The first command specifies the time period during which the key will be accepted. The second command specifies the time period during which the key will be sent.
For example, if we want to use a key only from January 1st, 2013 to December 1st, 2013, the following commands are used:
EIGRP load balancing
By default, EIGRP supports equal-cost load balancing over four links. Equal-cost means that various routes must have the same metric to reach a destination, so that router can choose to load balance across equal cost links.
To better understand the equal-cost load balancing concept, consider the following example.
All three routers are operating EIGRP. Routers R2 and R3 are connected to the subnet 10.0.1.0/24. Both routers broadcast the route to reach that subnet to R1. Router R1 receives the two routing updates for the subnet 10.0.1.0/24 with the same metric (the metric is the same because both routers connect to the subnet 10.0.1.0/24 and R1 across the links with the same bandwidth and delay values). Router R1 places both routes in the routing table and load balances across three links.
You can verify that R1 is indeed using both paths by typing the show ip route command:
One of the advantages of EIGRP is that, unlike OSPF and many other routing protocols, EIGRP also supports unequal-cost load balancing. You can program your router to load balance over links with different metric to reach the final destination. To achieve unequal-cost load balancing, the variance command is used. The command takes one parameter, the multiplier, which tells the router to load balance across each link with the metric for the destination less than the beneficial distance multiplied by the multiplier value.
Consider the following example.
All three routers are running EIGRP. Routers R2 and R3 are connected to the subnet 10.0.1.0/24. Both routers boradcast the route to reach that subnet to R1. Router R1 chooses the route from R2 as the best route. Let’s say that R1 determined the metric of 40 for the path through R2. That route is placed in the R1’s routing table. But what if we want to load balance traffic across the other link? The route through R3 has a beneficial distance of 30, which is less than the metric of the successor route, so the feasibility condition has been met and that route has been placed in the R1’s topology table. Let’s say that R1 calculated the metric of 60 for the route through R3. To enable load balancing across that link, you need to use the variance command:
(router-eigrp) variance MULTIPLIER
Study Material
Quiz