Routing & SwitchingNetworking SecurityIntermediate

EIGRP named mode and authentication: MD5, HMAC-SHA-256 and per-interface keys

By Mohamed Fayas 8 min readUpdated 15 October 2026

In short: EIGRP named mode gathers all settings under one process with address-family, af-interface and topology sections, and adds wide metrics and SHA-256 authentication. Classic mode supports MD5 through key chains. Authentication is set per interface, so each link or neighbour group can use its own key.

Classic mode and named mode

Traditional EIGRP configuration is split: the process and its networks sit under router eigrp 100, while timers, authentication and summaries are typed on each interface. IPv6 needs a separate process. Named mode, available on current IOS and IOS XE, puts everything in one place under a process name, and brings newer features: wide metrics, HMAC-SHA-256 authentication and IPv4 and IPv6 in one process.

Figure 1. Named mode puts every EIGRP setting under one process, in levels, instead of spreading them across interface configuration.

router eigrp CAMPUS
 address-family ipv4 unicast autonomous-system 100
  eigrp router-id 10.0.0.1
  network 10.0.0.0 0.0.255.255
  af-interface default
   passive-interface
  exit-af-interface
  af-interface GigabitEthernet0/1
   no passive-interface
   hello-interval 2
   hold-time 6
  exit-af-interface
  topology base
   variance 2
  exit-af-topology

The neighbour on the other side only needs the same autonomous system number; it can run classic or named mode. Many IOS releases can convert a classic configuration with eigrp upgrade-cli, which is handy for migrations.

Why authenticate EIGRP

Without authentication, any device on an EIGRP-enabled segment that uses the right AS number can become a neighbour and advertise routes. Authentication makes every EIGRP packet carry a keyed hash, so routers drop packets from anyone who does not know the key. Combine it with passive interfaces on all user-facing ports.

MD5 with key chains

MD5 works in both classic and named mode. It is acceptable in older networks but considered weak today.

key chain EIGRP-KEYS
 key 1
  key-string Br4nch-Key-2026
!
interface GigabitEthernet0/1
 ip authentication mode eigrp 100 md5
 ip authentication key-chain eigrp 100 EIGRP-KEYS

Key chains can hold several keys with accept-lifetime and send-lifetime values. A router sends with the lowest-numbered valid key and accepts any valid key, which lets you roll keys without an outage. Keep clocks synchronised with NTP.

HMAC-SHA-256 in named mode

HMAC-SHA-256 is only available in named mode. You can give the password directly or use a key chain.

router eigrp CAMPUS
 address-family ipv4 unicast autonomous-system 100
  af-interface default
   authentication mode hmac-sha-256 C0re-Secret-2026
  exit-af-interface
  af-interface GigabitEthernet0/3
   authentication mode hmac-sha-256 Partner-Link-Key
  exit-af-interface

Settings under af-interface default apply to every interface, and a specific af-interface overrides them. Because authentication is configured per interface, you can give each link, or each group of neighbours, its own key. That limits the damage if one key leaks, for example on a link to a partner or a site run by another team. Verify with show eigrp address-family ipv4 interfaces detail, which shows the authentication mode and key chain in use.

Real-world example: a council's partner link

A local council ran EIGRP across its offices and also exchanged a few routes with a shared-services partner over a dedicated link. Originally every interface used the same MD5 key, which the partner's engineers also knew. During a security review the council moved to named mode, set HMAC-SHA-256 with an internal key under af-interface default, and gave the partner-facing interface its own separate key. It also filtered which routes were accepted on that interface. If the partner key is ever exposed, it cannot be used to join the council's internal links.

Practice

Which EIGRP configuration style is required for HMAC-SHA-256 authentication?

Named mode.

Under named mode, where do you put settings that should apply to every interface?

Under af-interface default. Specific af-interface sections override it.

Why might you use a different authentication key on one interface?

To limit the impact if a key leaks, for example on a link shared with a partner or another team.

Key takeaways

Named mode keeps all EIGRP settings under one process in clear sections.
Named mode adds wide metrics, SHA-256 authentication and one process for IPv4 and IPv6.
MD5 uses key chains and works in both modes, but is now considered weak.
Authentication is per interface, so different links can use different keys.
Key lifetimes and NTP allow key rotation without dropping neighbours.

Tracks your learning on this device only. See your progress on the learning paths.

About the author

Mohamed Fayas

Founder of FM TecHub. CCNA certified, with a BTEC HND in Network Engineering, and BEng (Hons) in Computer Networking and Cloud Security. He writes practical, plain-English guides on networking, security and cloud.

More about the author