A flat EIGRP network with hundreds of routers and no hierarchy will converge beautifully in the lab and fall over in production the first time a core route flaps: queries diffuse everywhere, and one slow spoke turns a local failure into a stuck-in-active reset storm. The three features in this chapter — summarisation, stub, authentication — are how real EIGRP networks are engineered to stay boring.
Summarisation: anywhere, not just at borders
Unlike OSPF, which can only summarise at area borders, EIGRP summarises on any interface of any router. The summary is advertised in place of its components, and the summarising router installs a discard route to Null0 for the summary (administrative distance 5) so traffic for non-existent component prefixes is dropped rather than looped toward a default route.
The scaling effect is double: neighbours carry fewer routes, and — the deeper win — a query for a component prefix arriving at a router that only knows the summary is answered immediately with 'unreachable', stopping diffusion dead. Summary boundaries are query boundaries.
R1(config)# interface gi0/0R1(config-if)# ip summary-address eigrp 100 10.20.0.0 255.255.0.0! named mode:R1(config-router-af-interface)# summary-address 10.20.0.0/16
Stub routing: the hub-and-spoke standard
A branch router with two WAN links should never be a transit path between data centres, and it should never be asked to help the core converge. Declaring it an EIGRP stub achieves both: the stub advertises only its connected and summary routes by default (options extend or restrict this — static, redistributed, receive-only, or leak-map for exceptions), and — the operationally crucial part — neighbours mark the stub in their topology tables and never send it queries. On a thousand-spoke DMVPN or MPLS WAN, hub convergence stops depending on the slowest branch router on the slowest link.
Spoke(config-router-af)# eigrp stub connected summaryHub# show ip eigrp neighbors detail | include stub Stub Peer Advertising (CONNECTED SUMMARY) Routes Suppressing queries
Authentication
Unauthenticated EIGRP will happily form an adjacency with anything speaking the right AS and K-values — including a rogue or mis-cabled router that then injects routes. Classic mode supports MD5 via key chains applied per interface; named mode adds HMAC-SHA-256 with a directly configured password, the current best practice. Key chains support overlapping lifetimes for hitless key rotation.
R1(config-router-af-interface)# authentication mode hmac-sha-256 R5tF0rum!! classic:R1(config)# key chain EIGRP-KEYSR1(config-keychain)# key 1R1(config-keychain-key)# key-string R5tF0rum!R1(config)# interface gi0/0R1(config-if)# ip authentication mode eigrp 100 md5R1(config-if)# ip authentication key-chain eigrp 100 EIGRP-KEYS
The design in one paragraph
Put summaries on every hub toward every spoke and on distribution routers toward the core; make every branch a stub; authenticate every adjacency. The result is an EIGRP domain where queries die within one hop, topology tables stay small, convergence stays sub-second, and a flapping branch circuit is a branch problem instead of a network problem. That is EIGRP at its best — and exactly the design conversation the ENARSI course builds labs around.