EIGRP Summary Considerations

     When a Router adds the EIGRP summary address interface command, it will inject a route for the summary address to interface Null0 into its global routing table with a default administrative distance (AD) of 5. This is known as the discard route, and it's not exclusive to EIGRP. However, this occurs because if the Router were to lose reachability to a more specific route that fell within the summary, the Router would wind up using the shorter summary route to Null0 for forwarding the traffic, thereby preventing packets from being sent to any neighbors that may no longer have the route. 


     If the Router did not have such a mechanism and instead forwarded the traffic anyway, then there could be a risk of a next hop neighbor having connectivity to some path that actually leads back to the Router - creating a loop!


     In this scenario, the Provider sends a default route to R1 via eBGP with an AD of 20.  R1's fa0/1 interface is then configured to send an EIGRP summary route. With no AD configured, a route to the EIGRP summary via interface Null0 with an AD of 5 is injected into the global routing table, thereby removing the previously accepted default route to 10.1.1.100 via eBGP with the AD of 20.
R2 learns the advertised route via EIGRP, and installs the route in its global routing table with the AD of 90. At this point, any destinations that R1 receives packets for that are not specifically in the global routing table will take the default route to Null0.

In this scenario, the Provider sends a default route to R1 via eBGP with an AD of 20. 

Provider Sends Default route to R1:

router bgp 100

 neighbor 10.1.1.1 remote-as 200

 neighbor 10.1.1.1 default-originate

Resulting routing table for R1:

R1#show ip route | in 0.0.0.0

Gateway of last resort is 10.1.1.100 to network 0.0.0.0

B*   0.0.0.0/0 [20/0] via 10.1.1.100, 00:00:10

R1's fa0/1 interface is then configured to send an EIGRP summary route. 

R1 Sends EIGRP Summary to R2:

interface fa0/1

 ip summary-address eigrp 100 0.0.0.0 0.0.0.0




R1#show ip route 0.0.0.0 | include distance

  Known via "eigrp 100", distance 5, metric 2169856, candidate default path, type internal

With no AD configured, a route to the EIGRP summary via interface Null0 with an AD of 5 is injected into the global routing table, thereby removing the previously accepted default route to 10.1.1.100 via eBGP with the AD of 20.

Resulting routing table for R1:

R1# show ip route | include 0.0.0.0

Gateway of last resort is 0.0.0.0 to network 0.0.0.0

D*   0.0.0.0/0 is a summary, 00:21:30, Null0

R2 learns the advertised route via EIGRP, and installs the route in its global routing table with the AD of 90.

Resulting routing table for R2:

R2#show ip route | in 0.0.0.0

Gateway of last resort is 10.12.1.1 to network 0.0.0.0

D*   0.0.0.0/0 [90/2681856] via 10.12.1.1, 00:23:21, Fa0/1

At this point, any destination that R1 receives packets for that are not specifically in the global routing table will take the default route to Null0.

Although not always recommended and depending on your needs, you can remove the Null0 route by adding the AD of 255. However, in this case, a high AD of 220 is configured.

R1 Sends EIGRP Summary to R2:

interface fa0/1

 ip summary-address eigrp 100 0.0.0.0 0.0.0.0 220

This allows the previously accepted route with the AD of 20 back to the global routing table, but still maintains a floating route to Null0 in the event the default eBGP route is lost.

Resulting routing table for R1:

R1# clear ip route*

R1# show ip route  | in 0.0.0.0  

Gateway of last resort is 10.1.1.100 to network 0.0.0.0

B*   0.0.0.0/0 [20/0] via 10.1.1.100, 00:00:08

R2 has no change, and still learns the advertised route via EIGRP

Resulting routing table for R2:

R2#show ip route | in 0.0.0.0

Gateway of last resort is 10.12.1.1 to network 0.0.0.0

D*   0.0.0.0/0 [90/2681856] via 10.12.1.1, 00:33:21, Fa0/1

Multiple Instance Spanning Tree Protocol (MSTP)

In this scenario, I have 4 switches connected in a loop with two links per switch for peering. I want to configure MSTP in such a way that half of the VLANs use SW1 as the root bridge, and the other half of the VLANs use SW2 as the root bridge. If either SW1 or SW2 were to fail, I want the remaining switch of the two to take over as the root bridge for the failed device. Additionally, I want to ensure that SW3 reaches the root for Instance 1 through SW4 by adjusting port cost, and SW4 to use Fa0/17 to reach the root of Instance 2 adjusting port priority.

To set a baseline; VLANs 10, 20, 30, and 40 are configured for the switching domain, and cabling has been done per the diagram.

I'l start with configuring MST instances 1 and 2 on all 4 Switches (SW1 is shown).

SW1(config)#spanning-tree mode mst

SW1(config)#

SW1(config)#spanning-tree mst configuration 

SW1(config-mst)#name MST

SW1(config-mst)#revision 1

SW1(config-mst)#instance 1 vlan 10,30

SW1(config-mst)#instance 2 vlan 20,40

SW1(config-mst)#

SW1(config-mst)#do show spanning-tree mst configuration  

Name      [MST]

Revision  1     Instances configured 3

Instance  Vlans mapped

--------  ---------------------------------------------------------------------

0         1-9,11-19,21-29,31-39,41-4094

1         10,30

2         20,40

-------------------------------------------------------------------------------

SW1(config-mst)#exit

SW1(config)#

Note that with MST, any VLAN that I have not specifically configured for an instance will be found in MST instance 0.

To configure priority for an instance, I can either use the spanning-tree mst 'x' priority command, or the spanning-tree mst 'x' root command. Using the priority command, I can manually set the value, but using the root command, I allow the switch to calculate the value. Depending on the environment, it may be beneficial to set the priority manually. For MST 1, I'll use the priority command, and for MST 2, I'll use the root command.

SW1(config)#spanning-tree mst 1 priority 0 

SW1(config)#spanning-tree mst 2 root secondary 

SW1(config)#

SW2(config)#spanning-tree mst 1 priority 4096

SW2(config)#spanning-tree mst 2 root primary 

SW2(config)#

Here are the MST 1 and 2 resulting outputs for Switch 1 and 2.

SW1(config)#do show spanning-tree mst 1

##### MST1    vlans mapped:   10,30

Bridge        address 0023.ab6f.b980  priority      1     (0 sysid 1)

Root          this switch for MST1

Interface        Role Sts Cost      Prio.Nbr Type

---------------- ---- --- --------- -------- --------------------------------

Fa0/13           Desg FWD 200000    128.15   P2p 

Fa0/14           Desg FWD 200000    128.16   P2p 

Fa0/16           Desg FWD 200000    128.18   P2p 

Fa0/17           Desg FWD 200000    128.19   P2p 

SW1(config)#do show spanning-tree mst 2

##### MST2    vlans mapped:   20,40

Bridge        address 0023.ab6f.b980  priority      28674 (28672 sysid 2)

Root          address 0014.a8e1.fa80  priority      24578 (24576 sysid 2)

              port    Fa0/13          cost          200000    rem hops 19

Interface        Role Sts Cost      Prio.Nbr Type

---------------- ---- --- --------- -------- --------------------------------

Fa0/13           Root FWD 200000    128.15   P2p 

Fa0/14           Altn BLK 200000    128.16   P2p 

Fa0/16           Desg FWD 200000    128.18   P2p 

Fa0/17           Desg FWD 200000    128.19   P2p 

SW1(config)#

SW2(config)#do show spanning-tree mst 1

##### MST1    vlans mapped:   10,30

Bridge        address 0014.a8e1.fa80  priority      4097  (4096 sysid 1)

Root          address 0023.ab6f.b980  priority      1     (0 sysid 1)

              port    Fa0/13          cost          200000    rem hops 19

Interface        Role Sts Cost      Prio.Nbr Type

---------------- ---- --- --------- -------- --------------------------------

Fa0/13           Root FWD 200000    128.15   P2p 

Fa0/14           Altn BLK 200000    128.16   P2p 

Fa0/19           Desg FWD 200000    128.21   P2p 

Fa0/20           Desg FWD 200000    128.22   P2p 

SW2(config)#do show spanning-tree mst 2

##### MST2    vlans mapped:   20,40

Bridge        address 0014.a8e1.fa80  priority      24578 (24576 sysid 2)

Root          this switch for MST2

Interface        Role Sts Cost      Prio.Nbr Type

---------------- ---- --- --------- -------- --------------------------------

Fa0/13           Desg FWD 200000    128.15   P2p 

Fa0/14           Desg FWD 200000    128.16   P2p 

Fa0/19           Desg FWD 200000    128.21   P2p 

Fa0/20           Desg FWD 200000    128.22   P2p 

SW2(config)#

Note that the output shows SW1 as the root for MST 1, and SW2 as the root for MST 2; with SW1's priority for MST 2 putting it as the successor if there were a root bridge election, and SW2's priority for MST 1 putting it as the successor if there were a root bridge election. I can look at the inferior bridge priorities for SW3 and SW4 to verify that would indeed be the case.

SW3#show spanning-tree mst 1

##### MST1    vlans mapped:   10,30

Bridge        address 000c.30fd.2e80  priority      32769 (32768 sysid 1)

Root          address 0023.ab6f.b980  priority      1     (0 sysid 1)

              port    Fa0/13          cost          200000    rem hops 19

Interface        Role Sts Cost      Prio.Nbr Type

---------------- ---- --- --------- -------- --------------------------------

Fa0/13           Root FWD 200000    128.13   P2p 

Fa0/14           Altn BLK 200000    128.14   P2p 

Fa0/19           Desg FWD 200000    128.19   P2p 

Fa0/20           Desg FWD 200000    128.20   P2p 

SW3#show spanning-tree mst 2

##### MST2    vlans mapped:   20,40

Bridge        address 000c.30fd.2e80  priority      32770 (32768 sysid 2)

Root          address 0014.a8e1.fa80  priority      24578 (24576 sysid 2)

              port    Fa0/13          cost          400000    rem hops 18

Interface        Role Sts Cost      Prio.Nbr Type

---------------- ---- --- --------- -------- --------------------------------

Fa0/13           Root FWD 200000    128.13   P2p 

Fa0/14           Altn BLK 200000    128.14   P2p 

Fa0/19           Altn BLK 200000    128.19   P2p 

Fa0/20           Altn BLK 200000    128.20   P2p 

SW3#

SW4#show spanning-tree mst 1

##### MST1    vlans mapped:   10,30

Bridge        address 000b.be51.a680  priority      32769 (32768 sysid 1)

Root          address 0023.ab6f.b980  priority      1     (0 sysid 1)

              port    Fa0/16          cost          400000    rem hops 18

Interface        Role Sts Cost      Prio.Nbr Type

---------------- ---- --- --------- -------- --------------------------------

Fa0/16           Root FWD 200000    128.16   P2p 

Fa0/17           Altn BLK 200000    128.17   P2p 

Fa0/19           Altn BLK 200000    128.19   P2p 

Fa0/20           Altn BLK 200000    128.20   P2p 

SW4#show spanning-tree mst 2

##### MST2    vlans mapped:   20,40

Bridge        address 000b.be51.a680  priority      32770 (32768 sysid 2)

Root          address 0014.a8e1.fa80  priority      24578 (24576 sysid 2)

              port    Fa0/16          cost          200000    rem hops 19

Interface        Role Sts Cost      Prio.Nbr Type

---------------- ---- --- --------- -------- --------------------------------

Fa0/16           Root FWD 200000    128.16   P2p 

Fa0/17           Altn BLK 200000    128.17   P2p 

Fa0/19           Desg FWD 200000    128.19   P2p 

Fa0/20           Desg FWD 200000    128.20   P2p 

SW4#

Looking above, I can see that SW3's root port for MST 1 is currently Fa0/13 which is directly connected to SW1. In order for SW3 to use SW4 for its path to the root using port cost, I'll use 'show spanning-tree mst 1 detail' to learn how much I'll need to adjust the cost.

SW3#show spanning-tree mst 1 detail

##### MST1    vlans mapped:   10,30

Bridge        address 000c.30fd.2e80  priority      32769 (32768 sysid 1)

Root          address 0023.ab6f.b980  priority      1     (0 sysid 1)

              port    Fa0/13          cost          200000    rem hops 19

FastEthernet0/13 of MST1 is root forwarding 

Port info             port id         128.13  priority    128  cost      200000

Designated root       address 0023.ab6f.b980  priority      1  cost           0

Designated bridge     address 0023.ab6f.b980  priority      1  port id   128.18

Timers: message expires in 5 sec, forward delay 0, forward transitions 2

Bpdus (MRecords) sent 6072, received 4544

FastEthernet0/14 of MST1 is alternate blocking 

Port info             port id         128.14  priority    128  cost      200000

Designated root       address 0023.ab6f.b980  priority      1  cost           0

Designated bridge     address 0023.ab6f.b980  priority      1  port id   128.19

Timers: message expires in 4 sec, forward delay 0, forward transitions 1

Bpdus (MRecords) sent 15955, received 15033

FastEthernet0/19 of MST1 is designated forwarding 

Port info             port id         128.19  priority    128  cost      200000

Designated root       address 0023.ab6f.b980  priority      1  cost      200000

Designated bridge     address 000c.30fd.2e80  priority  32769  port id   128.19

Timers: message expires in 0 sec, forward delay 0, forward transitions 1

Bpdus (MRecords) sent 5677, received 7710

FastEthernet0/20 of MST1 is designated forwarding 

Port info             port id         128.20  priority    128  cost      200000

Designated root       address 0023.ab6f.b980  priority      1  cost      200000

Designated bridge     address 000c.30fd.2e80  priority  32769  port id   128.20

Timers: message expires in 0 sec, forward delay 0, forward transitions 2

Bpdus (MRecords) sent 13667, received 19642

SW3#    

Since I have a total cost of 200000 to reach the root through Fa0/13 and Fa0/14, and a total cost of 400000 for ports Fa0/19 and Fa0/20. I'll increase Fa0/13 and Fa0/14's cost to something higher.

SW3#conf t       

Enter configuration commands, one per line.  End with CNTL/Z.

SW3(config)#interface range fa0/13 - 14

SW3(config-if-range)#spanning-tree mst 1 cost 20000000

SW3(config-if-range)#exit

SW3(config)# 

SW3(config)#do show spanning-tree mst 1

##### MST1    vlans mapped:   10,30

Bridge        address 000c.30fd.2e80  priority      32769 (32768 sysid 1)

Root          address 0023.ab6f.b980  priority      1     (0 sysid 1)

              port    Fa0/19          cost          600000    rem hops 17

Interface        Role Sts Cost      Prio.Nbr Type

---------------- ---- --- --------- -------- --------------------------------

Fa0/13           Altn BLK 20000000  128.13   P2p 

Fa0/14           Altn BLK 20000000  128.14   P2p 

Fa0/19           Root FWD 200000    128.19   P2p 

Fa0/20           Altn BLK 200000    128.20   P2p 

SW3(config)#

Looking above, I can see that SW4 is currently using Fa0/16 to reach the root bridge for MST 2. I'll adjust where SW4 will use Fa0/17 as the root port to reach MST 2 by changing the port priority on SW2. Note that this adjustment must be done on SW2 and NOT on SW4 to be effective.

SW2(config)#interface fa0/20

SW2(config-if)#spanning-tree mst 2 port-priority 0

SW2(config-if)#

SW2(config-if)#do show spanning-tree mst 2

##### MST2    vlans mapped:   20,40

Bridge        address 0014.a8e1.fa80  priority      24578 (24576 sysid 2)

Root          this switch for MST2

Interface        Role Sts Cost      Prio.Nbr Type

---------------- ---- --- --------- -------- --------------------------------

Fa0/13           Desg FWD 200000    128.15   P2p 

Fa0/14           Desg FWD 200000    128.16   P2p 

Fa0/19           Desg FWD 200000    128.21   P2p 

Fa0/20           Desg FWD 200000      0.22   P2p 

SW2(config-if)#

With the port priority adjusted on SW2, I should now see on SW4 that Fa0/17 is the root port for MST 2.

SW4#show spanning-tree mst 2

##### MST2    vlans mapped:   20,40

Bridge        address 000b.be51.a680  priority      32770 (32768 sysid 2)

Root          address 0014.a8e1.fa80  priority      24578 (24576 sysid 2)

              port    Fa0/17          cost          200000    rem hops 19

Interface        Role Sts Cost      Prio.Nbr Type

---------------- ---- --- --------- -------- --------------------------------

Fa0/16           Altn BLK 200000    128.16   P2p 

Fa0/17           Root FWD 200000    128.17   P2p 

Fa0/19           Desg FWD 200000    128.19   P2p 

Fa0/20           Desg FWD 200000    128.20   P2p 

SW4#

Private VLANs

I want to simulate an environment where two customers - Customer A and Customer B - are supported by a service provider with private VLANs. In this scenario Customer A has two routers; R3 and R5, Customer B has a single router; R4, and the provider is offering Internet access with R1 and monitoring services to the Customers' loopback addresses with R2.

In this scenario, all Router FastEthernet interfaces are in "Primary" VLAN 20 with addressing in the 10.20.1.0/24 space. With private VLANs, the provider can conserve VLANs by not assigning each customer their own VLAN ID. With this configuration I will allow both Customers access to the services they need, but also ensure that they do not gain access to each other.

Here's a baseline before I begin configuring the Private VLANs.

Switches:

Both switches have had their VTP domain names set to cisco, and have had their VTP modes set to transparent. Fa0/13 on both switches will serve as the trunk port. Currently, only VLAN 1 is configured.

Routers:

All routers have had their Fa0/0 interfaces configured with the IP and mask of 10.20.1.X/24, where X = the router number.

With a PINGSCRIPT, I'll test connectivity from R3 to all devices.



R3#tclsh
R3(tcl)#proc PINGSCRIPT [] {
+>(tcl)#foreach IP {
+>(tcl)#10.20.1.1
+>(tcl)#10.20.1.2
+>(tcl)#10.20.1.3
+>(tcl)#10.20.1.4
+>(tcl)#10.20.1.5
+>(tcl)#} {
+>(tcl)#                set RESULT [exec "ping $IP repeat 3 timeout 1"];
+>(tcl)#if { [regexp "!!!"  $RESULT]} { puts "$IP OK"} else { puts "$IP Unreachable" }     
+>(tcl)#                }
+>(tcl)#  }


R3(tcl)#PINGSCRIPT
10.20.1.1 OK
10.20.1.2 OK
10.20.1.3 OK
10.20.1.4 OK
10.20.1.5 OK


R3(tcl)#

Connectivity appears to be successful.

Note: there are 3 port types, or roles, that are used in Private VLANs. There are Promiscuous ports, which talk to all ports, there are Isolated ports, which can only talk to Promiscuous ports, and there are Community ports, which can talk to other Community ports in the same community, as well as promiscuous ports.

In this scenario, R1 and R2's Fa0/0s are operating as Promiscuous ports, R3 and R5's Fa0/0s are operating as mutual Community Ports, and R4's Fa0/0 is operating as an Isolated port. After a successful Private VLAN configuration, I should be able to see that R3 and R5 can communicate within their own Community, as well as with the Promiscuous ports, but will not be able to speak to R4's Isolated port.

Starting with SW1, I'll configure primary and secondary VLANs, and associate the secondaries to the primary:

Sw1#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
Sw1(config)#vlan 21
Sw1(config-vlan)#name PVLAN_Community
Sw1(config-vlan)#private-vlan ?
  association       Configure association between private VLANs
  community         Configure the VLAN as a community private VLAN
  isolated          Configure the VLAN as an isolated private VLAN
  primary           Configure the VLAN as a primary private VLAN
  twoway-community  Configure the VLAN as a two way community private VLAN
Sw1(config-vlan)#private-vlan community
Sw1(config-vlan)#
Sw1(config-vlan)#vlan 22
Sw1(config-vlan)#name PVLAN_Isolated
Sw1(config-vlan)#private-vlan isolated
Sw1(config-vlan)#
Sw1(config-vlan)#vlan 20
Sw1(config-vlan)#name PVLAN_Primary
Sw1(config-vlan)#private-vlan primary
Sw1(config-vlan)#private-vlan association 21,22
Sw1(config-vlan)#exit
SW1(config)#do sh vlan b


VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Fa0/1, Fa0/2, Fa0/3, Fa0/4
                                                Fa0/5, Fa0/6, Fa0/7, Fa0/8
                                                Fa0/9, Fa0/10, Fa0/11, Fa0/12
                                                Fa0/14, Fa0/15, Fa0/16, Fa0/17
                                                Fa0/18, Fa0/19, Fa0/20, Fa0/21
                                                Fa0/22, Fa0/23, Fa0/24, Gi0/1
                                                Gi0/2
20   PVLAN_Primary                    active    
21   PVLAN_Community                  active    
22   PVLAN_Isolated                   active    
1002 fddi-default                     act/unsup 
1003 trcrf-default                    act/unsup 
1004 fddinet-default                  act/unsup 
1005 trbrf-default                    act/unsup 
SW1(config)#

Next, I'll configure the individual port modes and map the private VLANs to the correct ports for R1, R3 and R5's switchports on SW1.


SW1(config)#int fa0/1
SW1(config-if)#switchport mode private-vlan promiscuous
SW1(config-if)#switchport private-vlan mapping 20 21,22
SW1(config-if)#
SW1(config-if)#int fa0/3
SW1(config-if)#switchport mode private-vlan host
SW1(config-if)#switchport private-vlan host-association 20 21
SW1(config-if)#
SW1(config-if)#int fa0/5
SW1(config-if)#switchport mode private-vlan host
SW1(config-if)#switchport private-vlan host-association 20 21
SW1(config-if)#


I'll test connectivity from R1 to R3 and R5. I should not be able to connect to R4.



R1(tcl)#
R1(tcl)#proc PINGSCRIPT [] {
+>(tcl)#
+>(tcl)#foreach IP {
+>(tcl)#10.20.1.3
+>(tcl)#10.20.1.5
+>(tcl)#10.20.1.4
+>(tcl)#} { set RESULT [exec "ping $IP repeat 3 timeout 1"];
+>(tcl)#        $p "!!!"  $RESULT]} { puts "$IP OK"} else { puts "$IP Unreachable" }         
+>(tcl)#}
+>(tcl)# }


R1(tcl)#PINGSCRIPT
10.20.1.3 OK
10.20.1.5 OK
10.20.1.4 Unreachable


Now I'll configure primary and secondary VLANs, and associate the secondaries to the primary for SW2. I'll follow it up with configuring the individual port modes and map the private VLANs to the correct ports for R2 and R4's switchports.


SW2(config)#vlan 21
SW2(config-vlan)#name PVLAN_Community
SW2(config-vlan)#private-vlan community
SW2(config-vlan)# 
SW2(config-vlan)#vlan 22
SW2(config-vlan)#name PVLAN_Isolated
SW2(config-vlan)#private-vlan isolated 
SW2(config-vlan)#vlan 20
SW2(config-vlan)#name PVLAN_Primary
SW2(config-vlan)#private-vlan association 21,22
SW2(config-vlan)#exit
SW2(config)#
SW2(config)#int fa0/4
SW2(config-if)#switchport mode private-vlan host
SW2(config-if)#
SW2(config-if)#switchport private-vlan host-association 20 22
SW2(config-if)#end
SW2#


At this point, I should have connectivity from R2 to all other router's FastEthernet ports, but R4 should only have access to R1 and R2's FastEthernet ports.

R1:

R1(tcl)#PINGSCRIPT
10.20.1.1 OK
10.20.1.2 OK
10.20.1.3 OK
10.20.1.4 OK
10.20.1.5 OK

R3:

R3(tcl)#PINGSCRIPT
10.20.1.1 OK
10.20.1.2 OK
10.20.1.3 OK
10.20.1.4 Unreachable
10.20.1.5 OK


R5:

R5(tcl)#PINGSCRIPT
10.20.1.1 OK
10.20.1.2 OK
10.20.1.3 OK
10.20.1.4 Unreachable
10.20.1.5 OK


R2:

R2(tcl)#PINGSCRIPT
10.20.1.1 OK
10.20.1.2 OK
10.20.1.3 OK
10.20.1.4 OK
10.20.1.5 OK


R4:

R4(tcl)#PINGSCRIPT
10.20.1.1 OK
10.20.1.2 OK
10.20.1.3 Unreachable
10.20.1.4 OK
10.20.1.5 Unreachable

Looks good!

EIGRP - Authentication and Summarization with Leak-Maps

I have R1, R2, and R3, and I want to configure EIGRP with MD5 authentication with rotating keys based on time. Additionally, I want to redistribute RIP into EIGRP. I want to follow up the redistribution by summarizing a default route from R1, and then leak a single network along with the default route.

(All interfaces have already been assigned)


I'll start by configuring RIPv2 on R1

R1#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
R1(config-if)#router rip    
R1(config-router)#version 2
R1(config-router)#no auto-summary
R1(config-router)#net 10.10.1.1
R1(config-router)#net 10.11.1.1
R1(config-router)#do show ip protocols
Routing Protocol is "rip"
  Outgoing update filter list for all interfaces is not set
  Incoming update filter list for all interfaces is not set
  Sending updates every 30 seconds, next due in 0 seconds
  Invalid after 180 seconds, hold down 180, flushed after 240
  Redistributing: rip
  Default version control: send version 2, receive version 2
    Interface             Send  Recv  Triggered RIP  Key-chain
    FastEthernet0/0       2     2                                  
    Loopback10            2     2                                  
    Loopback11            2     2                                  
  Automatic network summarization is not in effect
  Maximum path: 4
  Routing for Networks:
    10.0.0.0
  Routing Information Sources:
    Gateway         Distance      Last Update
  Distance: (default is 120)

Next, I'll configure EIGRP with autonomous system 1

R1(config)#router eigrp 1
R1(config-router)#network 10.1.12.1 0.0.0.0
R1(config-router)#no auto-summary
R1(config-router)#do show ip protocols
<...RIPv2 output supressed>
Routing Protocol is "eigrp 1"
  Outgoing update filter list for all interfaces is not set
  Incoming update filter list for all interfaces is not set
  Default networks flagged in outgoing updates
  Default networks accepted from incoming updates
  EIGRP metric weight K1=1, K2=0, K3=1, K4=0, K5=0
  EIGRP maximum hopcount 100
  EIGRP maximum metric variance 1
  Redistributing: eigrp 1
  EIGRP NSF-aware route hold timer is 240s
  Automatic network summarization is in effect
  Maximum path: 4
  Routing for Networks:
    10.1.12.1/32
  Routing Information Sources:
    Gateway         Distance      Last Update
  Distance: internal 90 external 170

I'll configure EIGRP 1 for R2 and R3.

R2(config)#router eigrp 1
R2(config-router)#network 10.1.12.2 0.0.0.0
R2(config-router)#network
*Mar  1 00:39:46.683: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 10.1.12.1 (FastEthernet0/0) is up: new adjacency
R2(config-router)#network 10.1.23.2 0.0.0.0
R2(config-router)#do show ip protocols
Routing Protocol is "eigrp 1"
  Outgoing update filter list for all interfaces is not set
  Incoming update filter list for all interfaces is not set
  Default networks flagged in outgoing updates
  Default networks accepted from incoming updates
  EIGRP metric weight K1=1, K2=0, K3=1, K4=0, K5=0
  EIGRP maximum hopcount 100
  EIGRP maximum metric variance 1
  Redistributing: eigrp 1
  EIGRP NSF-aware route hold timer is 240s
  Automatic network summarization is in effect
  Maximum path: 4
  Routing for Networks:
    10.1.12.2/32
    10.1.23.2/32
  Routing Information Sources:
    Gateway         Distance      Last Update
  Distance: internal 90 external 170


R3(config)#router eigrp 1
R3(config-router)#network 10.1.23.3 0.0.0.0
R3(config-router)#
*Mar  1 00:40:44.511: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 10.1.23.2 (FastEthernet0/0) is up: new adjacency
R3(config-router)#do show ip protocols
Routing Protocol is "eigrp 1"
  Outgoing update filter list for all interfaces is not set
  Incoming update filter list for all interfaces is not set
  Default networks flagged in outgoing updates
  Default networks accepted from incoming updates
  EIGRP metric weight K1=1, K2=0, K3=1, K4=0, K5=0
  EIGRP maximum hopcount 100
  EIGRP maximum metric variance 1
  Redistributing: eigrp 1
  EIGRP NSF-aware route hold timer is 240s
  Automatic network summarization is in effect
  Maximum path: 4
  Routing for Networks:
    10.1.23.3/32
  Routing Information Sources:
    Gateway         Distance      Last Update
    10.1.23.2             90      00:00:06
  Distance: internal 90 external 170

Now, I'll look at the routing tables of each device.

R1#show ip route | exclude -


Gateway of last resort is not set


     10.0.0.0/24 is subnetted, 4 subnets
C       10.11.1.0 is directly connected, Loopback11
C       10.10.1.0 is directly connected, Loopback10
C       10.1.12.0 is directly connected, FastEthernet0/0
D       10.1.23.0 [90/307200] via 10.1.12.2, 00:02:22, FastEthernet0/0


R2#sh ip route | exclude -


Gateway of last resort is not set


     10.0.0.0/24 is subnetted, 2 subnets
C       10.1.12.0 is directly connected, FastEthernet0/0
C       10.1.23.0 is directly connected, FastEthernet0/1
R2#


R3#show ip route | exclude -


Gateway of last resort is not set


     10.0.0.0/24 is subnetted, 2 subnets
D       10.1.12.0 [90/307200] via 10.1.23.2, 00:02:24, FastEthernet0/0
C       10.1.23.0 is directly connected, FastEthernet0/0
R3#

I notice that R2 and R3 neither have access to the loopback networks of R1. I also notice that there is no Gateway of last resort set for any router.
Next, I'll look at the routing information base of each device

R1#show ip rip database
10.0.0.0/8    auto-summary
10.1.12.0/24    directly connected, FastEthernet0/0
10.10.1.0/24    directly connected, Loopback10
10.11.1.0/24    directly connected, Loopback11


R1#show ip eigrp topology | exclude -


P 10.1.12.0/24, 1 successors, FD is 281600
        via Connected, FastEthernet0/0
P 10.1.23.0/24, 1 successors, FD is 307200
        via 10.1.12.2 (307200/281600), FastEthernet0/0


R2#show ip eigrp topology | exclude -


P 10.1.12.0/24, 1 successors, FD is 281600
        via Connected, FastEthernet0/0
P 10.1.23.0/24, 1 successors, FD is 281600
        via Connected, FastEthernet0/1


R3#show ip eigrp topology | exclude -


P 10.1.12.0/24, 1 successors, FD is 307200
        via 10.1.23.2 (307200/281600), FastEthernet0/0
P 10.1.23.0/24, 1 successors, FD is 281600
        via Connected, FastEthernet0/0
R3#


Now I'll verify EIGRP neighbors; Ensuring that the queue count is zero. If this value was not zero, I would need to troubleshoot the cause of an increasing queue count.

R1#show ip eigrp neighbors
IP-EIGRP neighbors for process 1
H   Address                 Interface       Hold Uptime   SRTT   RTO  Q  Seq
                                            (sec)         (ms)       Cnt Num
0   10.1.12.2               Fa0/0             13 07:35:11   31  5000  0  4


R2#show ip eigrp neighbors
IP-EIGRP neighbors for process 1
H   Address                 Interface       Hold Uptime   SRTT   RTO  Q  Seq
                                            (sec)         (ms)       Cnt Num
1   10.1.23.3               Fa0/1             14 07:34:22   56   336  0  4
0   10.1.12.1               Fa0/0             12 07:35:19 1027  5000  0  3


R3#show ip eigrp neighbors
IP-EIGRP neighbors for process 1
H   Address                 Interface       Hold Uptime   SRTT   RTO  Q  Seq
                                            (sec)         (ms)       Cnt Num
0   10.1.23.2               Fa0/0             11 07:34:33   61   366  0  7


Something I've seen asked several times is; what does the H value mean? From Cisco's 12.4T EIGRP command reference, this column lists the order in which a peering session was established with the specified neighbor. The order is specified with sequential numbering starting with 0.


Now that the EIGRP neighbor relationship, topology and routing tables are displaying expected results, I want to configure MD5 authentication for EIGRP. Since I will be doing key rotation based on time, I will configure R2 as the NTP master with a stratum of 1, and point R1 and R3 there for time.
R2#show clock
08:25:26.269 UTC Fri Mar 1 2002
R2#clock set 00:40:00 17 Jan 2012
R2#
.Jan 17 00:40:00.000: %SYS-6-CLOCKUPDATE: System clock has been updated from 08:27:01 UTC Fri Mar 1 2002 to 00:40:00 UTC Tue Jan 17 2012, configured from console by console.
R2#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
R2(config)#ntp master 1
R2(config)#do sh ntp associations

      address         ref clock     st  when  poll reach  delay  offset    disp
*~127.127.7.1      .LOCL.            1     9    64  377     0.0    0.00     0.0
 * master (synced), # master (unsynced), + selected, - candidate, ~ configured
R2(config)#

R1#sh clock
*08:26:22.657 UTC Fri Mar 1 2002
R1#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
R1(config)#ntp server 10.1.12.2
R1(config)#do show ntp associations

      address         ref clock     st  when  poll reach  delay  offset    disp
*~10.1.12.2        .LOCL.            1     0    64   77    23.9   10.05    10.5
 * master (synced), # master (unsynced), + selected, - candidate, ~ configured
R1(config)#do sh clock
00:46:45.522 UTC Tue Jan 17 2012

R3#show clock
*08:34:33.645 UTC Fri Mar 1 2002
R3#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
R3(config)#ntp server 10.1.23.2
R3(config)#do show ntp associations

      address         ref clock     st  when  poll reach  delay  offset    disp
*~10.1.23.2        .LOCL.            1     0    64    7    11.9  -15.88  3878.0
 * master (synced), # master (unsynced), + selected, - candidate, ~ configured
R3(config)#do sh clock
00:48:26.877 UTC Tue Jan 17 2012
R3(config)#

Now with time syncronized across the devices, I'll create a key chain two keys on each device. The first key will remain valid for use for the next 12 hours. At that point, the new key will become vaild, and will remain as such. Note that a space in a key string is a valid character.

R1(config)#key chain EIGRP-NOW
R1(config-keychain)#key 1
R1(config-keychain-key)#key-string CISCO-NOW
R1(config-keychain-key)#send-lifetime 00:40:00 17 Jan 2012 12:40:00 17 Jan 2012
R1(config-keychain-key)#accept-lifetime 00:40:00 17 Jan 2012 12:40:00 17 Jan 2012
R1(config-keychain-key)#key 2
R1(config-keychain-key)#key-string CISCO-LATER
R1(config-keychain-key)#send-lifetime 12:40:00 17 Jan 2012 infinite
R1(config-keychain-key)#accept-lifetime 12:40:00 17 Jan 2012 infinite


R2(config)#key chain KC_EIGRP_1
R2(config-keychain)#key 1
R2(config-keychain-key)#key-string CISCO-NOW
R2(config-keychain-key)#accept-lifetime 00:40:00 Jan 17 2012 12:40:00 Jan 17 2012  
R2(config-keychain-key)#send-lifetime 00:40:00 Jan 17 2012 12:40:00 Jan 17 2012    
R2(config-keychain-key)#key 2
R2(config-keychain-key)#key-string CISCO-LATER
R2(config-keychain-key)#accept-lifetime 12:40:00 Jan 17 2012 infinite
R2(config-keychain-key)#send-lifetime 12:40:00 Jan 17 2012 infinite


R3(config)#key chain KC_EIGRP_1
R3(config-keychain)#key 1
R3(config-keychain-key)#key-string CISCO-NOW
R3(config-keychain-key)#accept-lifetime 00:40:00 Jan 17 2012 12:40:00 Jan 17 2012  
R3(config-keychain-key)#send-lifetime 00:40:00 Jan 17 2012 12:40:00 Jan 17 2012    
R3(config-keychain-key)#key 2
R3(config-keychain-key)#key-string CISCO-LATER
R3(config-keychain-key)#accept-lifetime 12:40:00 Jan 17 2012 infinite
R3(config-keychain-key)#send-lifetime 12:40:00 Jan 17 2012 infinite


Verify the key chain

R1#show key chain
Key-chain KC_EIGRP_1:
    key 1 -- text "CISCO-NOW"
        accept lifetime (00:40:00 UTC Jan 17 2012) - (12:40:00 UTC Jan 17 2012) [valid now]
        send lifetime (00:40:00 UTC Jan 17 2012) - (12:40:00 UTC Jan 17 2012) [valid now]
    key 2 -- text "CISCO-LATER"
        accept lifetime (12:40:00 UTC Jan 17 2012) - (infinite)
        send lifetime (12:40:00 UTC Jan 17 2012) - (infinite)


With the keys configured on each device, I will configure the interfaces for EIGRP authentication.

R1(config)#interface fa0/0
R1(config-if)#ip authentication key-chain eigrp 1 KC_EIGRP_1  
R1(config-if)#ip authentication mode eigrp 1 md5
R1(config-if)#
Jan 17 01:11:53.746: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 10.1.12.2 (FastEthernet0/0) is down: keychain changed
Jan 17 01:11:53.982: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 10.1.12.2 (FastEthernet0/0) is up: new adjacency
Jan 17 01:11:54.418: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 10.1.12.2 (FastEthernet0/0) is down: authentication mode changed


R2(config)#interface fa0/0
R2(config-if)#ip authentication key-chain eigrp 1 KC_EIGRP_1  
R2(config-if)#ip authentication mode eigrp 1 md5
R2(config-if)#
Jan 17 01:13:07.463: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 10.1.12.1 (FastEthernet0/0) is up: new adjacency


R2(config-if)#interface fa0/1
R2(config-if)#ip authentication key-chain eigrp 1 KC_EIGRP_1  
R2(config-if)#ip authentication mode eigrp 1 md5
R2(config-if)#
Jan 17 01:13:37.947: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 10.1.23.3 (FastEthernet0/1) is down: keychain changed


R3(config)#interface fa0/0
R3(config-if)#ip authentication key-chain eigrp 1 KC_EIGRP_1  
R3(config-if)#ip authentication mode eigrp 1 md5
R3(config-if)#
Jan 17 01:14:20.018: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 10.1.23.2 (FastEthernet0/0) is up: new adjacency


I'll verify that EIGRP authentication is working properly with Key 1. I will check later to verify that the key change occurs at the correct time.

R1#debug eigrp packets hello
EIGRP Packets debugging is on
    (HELLO)
R1#
Jan 17 01:23:19.207: EIGRP: received packet with MD5 authentication, key id = 1
Jan 17 01:23:19.207: EIGRP: Received HELLO on FastEthernet0/0 nbr 10.1.12.2
Jan 17 01:23:19.207:   AS 1, Flags 0x0, Seq 0/0 idbQ 0/0 iidbQ un/rely 0/0 peerQ un/rely 0/0


R2#debug eigrp packets hello
EIGRP Packets debugging is on
    (HELLO)
R2#
Jan 17 01:24:46.795: EIGRP: received packet with MD5 authentication, key id = 1
Jan 17 01:24:46.795: EIGRP: Received HELLO on FastEthernet0/1 nbr 10.1.23.3
Jan 17 01:24:46.795:   AS 1, Flags 0x0, Seq 0/0 idbQ 0/0 iidbQ un/rely 0/0 peerQ un/rely 0/0
Jan 17 01:24:48.975: EIGRP: received packet with MD5 authentication, key id = 1
Jan 17 01:24:48.975: EIGRP: Received HELLO on FastEthernet0/0 nbr 10.1.12.1
Jan 17 01:24:48.979:   AS 1, Flags 0x0, Seq 0/0 idbQ 0/0 iidbQ un/rely 0/0 peerQ un/rely 0/0


R3#debug eigrp packet hello
EIGRP Packets debugging is on
    (HELLO)
R3#
Jan 17 03:36:41.447: EIGRP: received packet with MD5 authentication, key id = 1
Jan 17 03:36:41.451: EIGRP: Received HELLO on FastEthernet0/0 nbr 10.1.23.2
Jan 17 03:36:41.451:   AS 1, Flags 0x0, Seq 0/0 idbQ 0/0 iidbQ un/rely 0/0 peerQ un/rely 0/0


Now I'll redistribute the RIP routes into EIGRP and verify visibility of the RIP networks on R3

R1(config)#router eigrp 1
R1(config-router)#redistribute rip metric 10000 1 255 1 1500


R3#sh ip route | ex -


Gateway of last resort is not set


     10.0.0.0/24 is subnetted, 4 subnets
D EX    10.11.1.0 [170/307456] via 10.1.23.2, 00:01:05, FastEthernet0/0
D EX    10.10.1.0 [170/307456] via 10.1.23.2, 00:01:05, FastEthernet0/0
D       10.1.12.0 [90/307200] via 10.1.23.2, 03:09:18, FastEthernet0/0
C       10.1.23.0 is directly connected, FastEthernet0/0


Now I'll summarize a default route from R1 to R2's interface and view the results on R3

R1(config)#interface fa0/0
R1(config-if)#ip summary-address eigrp 1 0.0.0.0 0.0.0.0
R1(config-if)#
Jan 17 03:52:10.316: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 10.1.12.2 (FastEthernet0/0) is resync: summary configured


R3#sh ip route | ex -


Gateway of last resort is 10.1.23.2 to network 0.0.0.0


     10.0.0.0/24 is subnetted, 2 subnets
D       10.1.12.0 [90/307200] via 10.1.23.2, 03:11:34, FastEthernet0/0
C       10.1.23.0 is directly connected, FastEthernet0/0
D*   0.0.0.0/0 [90/307456] via 10.1.23.2, 00:00:49, FastEthernet0/0
R3#ping 10.10.1.1


Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 40/48/60 ms
R3#ping 10.11.1.1


Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.11.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 24/41/60 ms


I see that the gateway of last resort is now set, and I still have reachability to the loopback networks on R1. Although I don't need the loopback networks in R3s routing table for reachability, I still want to meet my requirement of leaking a single network through with the default route with a leak-map

R1(config)#ip prefix-list LM_LEAK permit 10.10.1.0/24
R1(config)#route-map RM_LEAK permit 10
R1(config-route-map)#match ip address prefix LM_LEAK
R1(config-route-map)#exit
R1(config)#interface fa0/0
R1(config-if)#ip summary-address eigrp 1 0.0.0.0 0.0.0.0 leak-map RM_LEAK
R1(config-if)#
Jan 17 03:59:20.693: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 10.1.12.2 (FastEthernet0/0) is resync: summary configured


Now on R3, I should see the 10.10.1.0/24 network leaked from the summary route.

R3#show ip route | ex -


Gateway of last resort is 10.1.23.2 to network 0.0.0.0


     10.0.0.0/24 is subnetted, 3 subnets
D EX    10.10.1.0 [170/307456] via 10.1.23.2, 00:00:57, FastEthernet0/0
D       10.1.12.0 [90/307200] via 10.1.23.2, 03:18:52, FastEthernet0/0
C       10.1.23.0 is directly connected, FastEthernet0/0
D*   0.0.0.0/0 [90/307456] via 10.1.23.2, 00:00:57, FastEthernet0/0


At this point, I'll set the NTP master clock to 11:40, and see what happens after lunch!

R2#show key chain
Key-chain KC_EIGRP_1:
    key 1 -- text "CISCO-NOW"
        accept lifetime (00:40:00 UTC Jan 17 2012) - (12:40:00 UTC Jan 17 2012)
        send lifetime (00:40:00 UTC Jan 17 2012) - (12:40:00 UTC Jan 17 2012)
    key 2 -- text "CISCO-LATER"
        accept lifetime (12:40:00 UTC Jan 17 2012) - (infinite) [valid now]
        send lifetime (12:40:00 UTC Jan 17 2012) - (infinite) [valid now]


R2#show ip eigrp neighbors
IP-EIGRP neighbors for process 1
H   Address                 Interface       Hold Uptime   SRTT   RTO  Q  Seq
                                            (sec)         (ms)       Cnt Num
1   10.1.23.3               Fa0/1             14 10:06:05   77   462  0  20
0   10.1.12.1               Fa0/0             11 10:06:08   68   408  0  44
R2#


Looks as expected.