Pause4Tech - EIGRP Module A: Troubleshooting Vault (Part 3 of 5)

🔥 Troubleshooting Vault

Six production failures with authentic syslog messages and hardened fixes

Critical Errors

📌 How to Use This Vault

Each error below includes the exact syslog message you'll see in production, the root cause, the business impact, and the verified CLI fix. Match your syslog to the error heading to jump to the resolution.

1 K-value Mismatch Critical

📋 Syslog Message

%DUAL-5-NBRCHANGE: EIGRP-IPv4 1234: Neighbor 10.1.12.2 (GigabitEthernet0/0) is down: K-value mismatch

🔍 Root Cause

One router has custom metric weights configured (e.g., metric weights 0 1 1 1 1 1), while the other router uses the default K-values (K1=1, K2=0, K3=1, K4=0, K5=0). EIGRP requires identical K-values on both sides of the adjacency.

⚠️ Business Impact

Adjacency flaps immediately and cannot form
All routes learned from this neighbor are lost
Traffic reroutes or drops depending on alternate paths
Repeated syslog floods consume device CPU

🛠️ Production Fix

! Verify current K-values on both routers
show ip protocols | include K-values

! Align to default on BOTH routers
router eigrp 1234
 metric weights 0 1 0 1 0 0

2 Neighbor Flapping – Hold Time Expired Critical

📋 Syslog Message

%DUAL-5-NBRCHANGE: EIGRP-IPv4 1234: Neighbor 10.1.12.2 (GigabitEthernet0/0) is down: holding time expired

🔍 Root Cause

Hello packets are not being received within the hold timer window (default 15 seconds). Common causes: congested link, high CPU on the remote router, mismatched hello/hold timers, or physical layer errors causing packet drops.

⚠️ Business Impact

Intermittent route flaps cause packet loss and jitter
Applications relying on this path experience timeouts
Frequent SPF recalculations spike CPU on all routers
If repeated, routes may be permanently removed

🛠️ Production Fix

! Step 1: Verify timers on both routers
show ip eigrp interfaces detail

! Step 2: Align timers (recommend hold = 3x hello)
interface GigabitEthernet0/0
 ip hello-interval eigrp 1234 5
 ip hold-time eigrp 1234 15

! Step 3: Check for physical errors
show interface GigabitEthernet0/0 | include error|drop
show processes cpu | include EIGRP

3 Static & Dynamic Neighborship Incompatibility Critical

📋 Syslog Message

%DUAL-5-NBRCHANGE: EIGRP-IPv4 1234: Neighbor 10.1.12.2 (GigabitEthernet0/0) is down: Static and dynamic neighbor configurations are incompatible

🔍 Root Cause

One router is configured for static unicast neighborship (neighbor command), while the other expects dynamic multicast discovery (224.0.0.10). EIGRP does not support mixing these modes on the same link.

⚠️ Business Impact

Adjacency never forms—complete loss of routing between peers
No multicast hello reaches the static-only neighbor
Silent failure if both sides assume the other is correct
Requires manual intervention to detect and resolve

🛠️ Production Fix

! Option A: Use static on BOTH sides
router eigrp 1234
 neighbor 10.1.12.1 GigabitEthernet0/0     ! On Router A
 neighbor 10.1.12.2 GigabitEthernet0/0     ! On Router B

! Option B: Use dynamic on BOTH sides (remove neighbor commands)
router eigrp 1234
 no neighbor 10.1.12.1 GigabitEthernet0/0
 no neighbor 10.1.12.2 GigabitEthernet0/0

! Verify: should show multicast Hello counters increasing
show ip eigrp traffic

4 Passive-Interface Blocking Hellos Warning

📋 Syslog Message

%DUAL-5-NBRCHANGE: EIGRP-IPv4 1234: Neighbor 10.1.12.2 (GigabitEthernet0/0) is down: Interface is passive

🔍 Root Cause

The command passive-interface default was applied globally but the specific interface was not re-enabled with no passive-interface. Passive interfaces do not send or receive EIGRP hello packets.

⚠️ Business Impact

Neighbor relationship terminates abruptly
Routes via this interface are removed from the topology table
Common after a "blanket" hardening change—easy to miss one interface

🛠️ Production Fix

! Identify all passive interfaces
show ip protocols | section Passive Interface

! Re-enable the affected interface
router eigrp 1234
 no passive-interface GigabitEthernet0/0

! Verify adjacency returns
show ip eigrp neighbors

5 Duplicate Router ID Detected Warning

📋 Syslog Message

%DUAL-4-DUP_RID: Duplicate router ID 10.1.1.1 detected from 10.1.12.2, discarding routes

🔍 Root Cause

Two routers in the same EIGRP domain have the same router ID. This typically happens when loopback interfaces are reused or when a router is cloned during deployment. Router IDs are auto-derived from the highest loopback IP unless manually configured.

⚠️ Business Impact

Neighborship forms, but routes from the duplicate are silently discarded
Partial reachability failures with no obvious log correlation
Difficult to troubleshoot—routing table looks "half-populated"

🛠️ Production Fix

! Verify current router ID
show ip protocols | include Router ID

! Set unique ID on the affected router
router eigrp 1234
 eigrp router-id 10.1.1.99

! Clear the EIGRP process to force re-initialization
clear ip eigrp 1234 neighbors *

6 Authentication Mismatch (MD5) Warning

📋 Syslog Message

%DUAL-5-NBRCHANGE: EIGRP-IPv4 1234: Neighbor 10.1.12.2 (GigabitEthernet0/0) is down: authentication mismatch

🔍 Root Cause

MD5 authentication is configured with different key strings, key IDs, or key chains on the two routers. Or one side is configured for authentication while the other is not.

⚠️ Business Impact

Adjacency refuses to form—routing is completely broken on that link
Common during security audits or credential rotations
Blind failure if key rotation is applied to only one side

🛠️ Production Fix

! Verify key-chain on both sides
show key chain EIGRP-KEY

! Ensure key-string and key ID match
key chain EIGRP-KEY
 key 1
 key-string SecureEigrp123!

! Apply consistently on both interfaces
interface GigabitEthernet0/0
 ip authentication mode eigrp 1234 md5
 ip authentication key-chain eigrp 1234 EIGRP-KEY

! Verify adjacency
show ip eigrp neighbors

Troubleshooting Vault & Production Error Reference