Configuring and Troubleshooting EIGRP Stubs

What EIGRP Stubs Actually Do (and Why It Matters)

EIGRP stub configuration is one of those features that looks simple on the surface but has significant operational implications when misconfigured. At its core, the stub feature tells an EIGRP neighbor that a router should not be used as a transit path. The stub router will only advertise specific route categories defined by the stub keyword options, and crucially, it will never be queried by upstream routers during a topology change. That last point is what drives EIGRP stability improvements in hub-and-spoke and large-scale enterprise environments.

Without stub configuration, every EIGRP router in a domain is a candidate to receive a query during an active route computation. In networks with hundreds of spoke sites, a single route going active at the hub can flood queries to every router in the domain, waiting for replies before converging. If a spoke is unreachable, that query sits until the stuck-in-active (SIA) timer expires. Stub eliminates spoke routers from the query scope entirely.

Stub Configuration Options

The eigrp stub command accepts several keyword arguments, each controlling which routes the stub router will advertise to its neighbors:

• connected: Advertises directly connected networks. This is the default behavior along with summary when no keywords are specified.
• summary: Advertises summary routes. Also included in the default behavior.
• static: Advertises routes redistributed from static. Requires explicit keyword.
• redistributed: Advertises routes learned via redistribution from other protocols.
• receive-only: The router accepts routes but advertises nothing. Mutually exclusive with all other keywords.
• leak-map: Overrides stub suppression for specific prefixes matched by a route map. Useful when a stub must advertise select routes that would otherwise be blocked.

A typical spoke router in an enterprise hub-and-spoke deployment gets configured like this:

router eigrp ENTERPRISE
 !
 address-family ipv4 unicast autonomous-system 100
  !
  af-interface GigabitEthernet0/1
   shutdown
  !
  af-interface GigabitEthernet0/0
   summary-address 10.10.0.0/16
  !
  eigrp stub connected summary
  !
  topology base
  exit-af-topology
 exit-address-family

This named-mode configuration marks the router as a stub, advertising connected networks and summary routes only. The upstream hub router will suppress queries to this spoke for any destination not within those advertised categories.

How the Hub Sees Stub Neighbors

The hub router flags stub neighbors in its topology table. You can verify this with show eigrp address-family ipv4 neighbors detail:

Hub# show eigrp address-family ipv4 neighbors detail
EIGRP-IPv4 Neighbors for AS(100)
H   Address         Interface       Hold Uptime   SRTT   RTO  Q  Seq
                                    (sec)         (ms)       Cnt Num
0   10.1.1.2        Gi0/0             12 00:12:34   15   100  0  42
   Version 23.0/2.0, Retrans: 0, Retries: 0, Prefixes: 3
   Topology-ids from peer - 0
   Stub Peer Advertising (CONNECTED SUMMARY ) Routes
   Suppressing queries

The "Suppressing queries" line confirms the hub will not send queries to this neighbor during reconvergence. This is the key indicator for EIGRP stability improvements in your query domain.

Troubleshooting EIGRP Stub Configuration

Problem 1: Routes Not Being Advertised from Stub

The most common misconfiguration is configuring eigrp stub connected alone when the intent is to also advertise summaries or redistributed routes. If the spoke is redistributing OSPF routes into EIGRP but the stub keyword only includes connected, those redistributed routes are suppressed silently. The fix is to add the redistributed keyword explicitly:

eigrp stub connected redistributed

Verify what the stub is actually advertising with show eigrp address-family ipv4 topology on the stub router and compare against what the hub sees in show ip route eigrp.

Problem 2: Stub Router Being Used as Transit

If the stub router has multiple uplinks (dual-homed spoke), traffic may still route through it unless the stub configuration is in place on both uplinks. The stub flag is global to the EIGRP process, but you should verify that both neighbors on the hub see the stub flag using the neighbor detail command shown above. If one hub router is not showing "Suppressing queries," check that the neighbor relationship was established after the stub command was added. Sometimes a neighbor reset is needed:

clear eigrp address-family ipv4 neighbors 10.1.1.2

Problem 3: Leak-Map Not Working as Expected

When using eigrp stub connected summary leak-map LEAK_MAP, the route map must match the exact prefix with a permit statement. The route map references a prefix list, not an access list, for prefix matching in EIGRP leak-map contexts. A common mistake is using an access list instead:

ip prefix-list LEAK_PREFIXES seq 5 permit 192.168.50.0/24

route-map LEAK_MAP permit 10
 match ip address prefix-list LEAK_PREFIXES

router eigrp ENTERPRISE
 address-family ipv4 unicast autonomous-system 100
  eigrp stub connected summary leak-map LEAK_MAP

Verify the leak-map is functional with show eigrp address-family ipv4 topology 192.168.50.0/24 on the hub and confirm the prefix appears in the routing table.

Problem 4: SIA Conditions Still Occurring with Stubs Configured

If you're still seeing SIA log messages after implementing stubs, verify that all spoke routers in the domain have the stub flag configured. One unconfigured spoke is enough to propagate queries through to deeper parts of the network. Use the following on the hub to audit all neighbors:

show eigrp address-family ipv4 neighbors detail | include Stub|Address

Any neighbor not showing a Stub advertisement line is a potential query propagation point and should be reviewed for stub configuration eligibility.

Exam-Level Precision: What EIGRP Stub Does NOT Do

The stub feature does not filter routes on the stub router itself. The stub router still installs all routes it receives from the hub. Stub only controls what the stub advertises outbound and whether the hub queries it. If you need to filter inbound routes on the stub, use a distribute list or prefix list under the EIGRP address family. Confusing these two mechanisms is a reliable way to introduce connectivity issues and a common exam distractor.

What's Next

With EIGRP stub configuration and troubleshooting covered, the next logical step in the ENARSI EIGRP domain is EIGRP authentication, where you'll configure MD5 and SHA-256 HMAC authentication in named mode to secure neighbor relationships against unauthorized adjacency formation. For deeper coverage of the query domain mechanics, stub behavior, and everything else in this section, the Cisco Press CCNP Enterprise Advanced Routing ENARSI 300-410 Official Cert Guide by Raymond Lacoste is the reference to have on your desk.

Tools and resources for this topic

• CCNP ENARSI 300-410 Official Cert Guide — The definitive ENARSI study resource by Raymond Lacoste. Covers advanced routing, services, and troubleshooting.