EIGRP Authentication with HMAC-SHA-256 and Keychains

EIGRP requires certain configurations for successful neighbor relationships when using HMAC-SHA-256 for authentication. When configuring routers with both a keychain and an HMAC-SHA-256 password, both elements must be identical across all routers for the neighborship to be established successfully.

Despite the keychain having identical key-strings on both routers, the HMAC-SHA-256 password specified in the authentication mode must also match. Specifically, the following interface configuration mode command must have the SECRET_KEY password correctly configured...

R1(config-router-af-interface)#authentication mode hmac-sha-256 SECRET_KEY

... and the following keychain command must also have the OUR_SECRET password configured correctly:

R1(config)#key chain R1_R2_CHAIN
R1(config-keychain)#key 1
R1(config-keychain-key)#key-string OUR_SECRET
R1(config-keychain-key)#exit

The fact that both passwords must be configured indicates that EIGRP internally combines the HMAC-SHA-256 password with the key-string to form an authentication digest. Discrepancy in passwords between routers will lead to mismatched hash values and failed authentication.

To configure HMAC-SHA-256 with a keychain, ensure a consistent password is specified in the authentication mode command across all routers alongside the keychain configurations.

https://networklessons.com/cisco/ccie-routing-switching-written/eigrp-sha-authentication