Cisco APIC Security Configuration Guide, Release 6.2(x)

PDF

Cisco APIC Security Configuration Guide, Release 6.2(x)

EIGRP

Updated: April 17, 2026

Want to summarize with AI?

Log in

Enhanced Interior Gateway Routing Protocol (EIGRP) provides rapid route convergence and supports authenticated communication between routing peers.

EIGRP is an advanced distance-vector routing protocol that discovers neighboring routers and exchanges routing information with them.

Enhanced Interior Gateway Routing Protocol

EIGRP is an advanced distance-vector routing protocol that discovers neighboring routers and exchanges routing information with them.

  • EIGRP sends periodic hello messages to discover and maintain neighbor adjacencies.

  • EIGRP sends a complete routing update when a neighbor adjacency is established and incremental updates when routing information changes.

  • EIGRP supports MD5 authentication between peers through Cisco APIC keychain policies.

EIGRP authentication parameters

Configure the following parameters to authenticate communication between EIGRP peers:

  • Authentication mode

  • Keychain

EIGRP authentication guidelines and limitations

Use these guidelines when configuring or troubleshooting EIGRP peer authentication.

Authentication guidelines

  • Only MD5 authentication is supported.

  • The keychain parameter specifies the name of a keychain configured through Route Policy Manager (RPM).

  • An authentication mismatch between EIGRP peers causes the neighbor adjacency to flap. To identify the cause, enter the show eigrp internal event-history syslog command.

Configure EIGRP authentication by using the Cisco APIC GUI

The location of the keychain policy depends on the Cisco APIC release. Complete the applicable keychain procedure, and then associate the keychain policy with an EIGRP interface policy.

Procedure

  1. On the menu bar, choose Tenants > tenant-name .

  2. For releases earlier than Cisco APIC release 6.1(2), create an EIGRP keychain policy.

    1. In the Navigation pane, expand Policies > Protocol > EIGRP .
    2. Right-click EIGRP KeyChains and choose Create Keychain Policy .
    3. In the Name field, enter a name for the policy.
    4. In the KeyID field, enter a key identifier.
    5. In the Preshared key field, enter the preshared key.
    6. Optional: In the Start Time and End Time fields, configure the period during which the key is valid.
    7. Click Submit .

  3. For Cisco APIC release 6.1(2) and later, create a keychain policy.

    1. In the Navigation pane, expand Policies > Protocol .
    2. Right-click KeyChains and choose Create Keychain Policy .
    3. In the Name field, enter a name for the policy.
    4. Click the + icon next to Key Policy .
    5. In the KeyID field, enter a key identifier.
    6. In the Preshared key field, enter the preshared key.
    7. Optional: In the Start Time and End Time fields, configure the period during which the key is valid.
    8. Click Submit .

  4. Create or edit an EIGRP interface policy and enable authentication.

    1. In the Navigation pane, expand Policies > Protocol > EIGRP .
    2. Right-click EIGRP Interface and create a new interface policy or select an existing policy.
    3. In the Authentication field, enable authentication.
    4. From the Key Chain Policy list, choose the keychain policy that you created.
    5. Click Submit .

    EIGRP authentication is enabled on the interface policy.

Configure EIGRP authentication by using the Cisco NX-OS-style CLI

EIGRP authentication supports IPv4 and IPv6 address families. Only MD5 authentication is supported.

Procedure

  1. Enter tenant configuration mode and create a keychain policy and key policy.

    Example:

    apic1# configure
            apic1(config)# tenant tenant-name
            apic1(config-tenant)# keychain-policy keychain-policy-name
            apic1(config-tenant-keychain)# key-policy key-id

  2. Configure the time at which the key becomes valid.

    Example:

    apic1(config-tenant-keychain-key)# startime start-time

    Specify the start time in a timestamp format such as 2018-11-01T08:39:27.000+00:00 .

  3. Return to global configuration mode.

    Example:

    apic1(config-tenant-keychain-key)# exit
            apic1(config-tenant-keychain)# exit
            apic1(config-tenant)# exit
            apic1(config)#

  4. Enter leaf interface configuration mode and associate the interface with the L3Out.

    Example:

    apic1(config)# leaf leaf-id
            apic1(config-leaf)# interface ethernet interface-id
            apic1(config-leaf-if)# vrf member tenant tenant-name vrf vrf-name l3out l3out-name

  5. Enable IPv4 EIGRP authentication and associate the keychain policy.

    Example:

    apic1(config-leaf-if)# ip router eigrp authentication keychain-policy keychain-policy-name
            apic1(config-leaf-if)# ip router eigrp authentication enable

  6. Enable IPv6 EIGRP authentication, and then exit configuration mode.

    Example:

    apic1(config-leaf-if)# ipv6 router eigrp authentication keychain-policy keychain-policy-name
            apic1(config-leaf-if)# ipv6 router eigrp authentication enable
            apic1(config-leaf-if)# exit
            apic1(config-leaf)# exit
            apic1(config)# exit
            apic1#

  7. On the leaf switch, verify IPv4 EIGRP authentication on the interface.

    Example:

    leaf1# show ip eigrp interfaces interface-id
            EIGRP interfaces for process 1 VRF T1:V1
            ...
            Hello interval is 5 sec
            Holdtime interval is 15 sec
            Authentication mode is md5, key-chain is T1:KeyChainPol

    Verify that the output identifies MD5 as the authentication mode and displays the expected keychain.

  8. Display IPv4 EIGRP interface information for all VRF instances.

    Example:

    leaf1# show ip eigrp interface vrf all

  9. Display IPv6 EIGRP interface information for a specific VRF instance.

    Example:

    leaf1# show ipv6 eigrp interface vrf vrf-name

    The output identifies the authentication mode and keychain configured for each EIGRP interface.