In which configuration mode is passive-interface [intf] used?

The passive-interface [intf] command is entered in Router Config mode on Cisco IOS devices.

EIGRPRouter Config

passive-interface [intf]

Prevents an interface from sending EIGRP hello packets and forming neighbor adjacencies, while still allowing the router to advertise the subnet of that interface in EIGRP updates.

Definition: passive-interface [intf] is a Cisco IOS router config command. Prevents an interface from sending EIGRP hello packets and forming neighbor adjacencies, while still allowing the router to advertise the subnet of that interface in EIGRP updates.

Overview

The `passive-interface` command in EIGRP configuration mode is used to prevent an interface from sending EIGRP hello packets and forming neighbor adjacencies, while still allowing the router to advertise the subnet of that interface in EIGRP updates. This is a critical tool for network engineers who need to control EIGRP neighbor relationships without losing route advertisement for a connected network. The command is typically applied on interfaces that connect to end devices, such as PCs or servers, where forming an EIGRP adjacency is unnecessary and could waste resources or cause security concerns.

By default, EIGRP sends hello packets out of all interfaces enabled for EIGRP, attempting to discover neighbors. In many network designs, especially at the access layer, interfaces facing end users should not participate in routing protocol exchanges. The `passive-interface` command suppresses hello packets, preventing the router from sending or receiving EIGRP hellos on that interface, thus no adjacency is formed.

However, the network address of the interface is still included in EIGRP updates sent to other neighbors, ensuring reachability. This behavior distinguishes it from simply removing the network from EIGRP configuration, which would hide the subnet entirely. The command is often used in hub-and-spoke topologies where spoke routers should not form adjacencies with each other, or in DMVPN deployments where only the tunnel interface should be active.

Alternatives include using distribute-lists or route-maps to filter routes, but those do not prevent adjacency formation. The `passive-interface` command is simpler and more direct. In terms of IOS behavior, the command takes effect immediately; no reload is required.

It is stored in the running configuration and can be verified with `show ip eigrp interfaces` or `show ip eigrp neighbors`. The command requires privileged EXEC mode (enable) to configure, and it is available in all IOS versions that support EIGRP. Understanding this command is essential for CCNA and CCNP candidates as it appears in both exam topics and real-world network design.

It helps optimize routing protocol overhead and enhances network stability by preventing unnecessary neighbor relationships on interfaces where they are not needed. Additionally, it can be used to troubleshoot EIGRP adjacency issues by selectively disabling hellos on suspect interfaces. The command is also useful in multi-access networks where only certain routers should form adjacencies.

Overall, `passive-interface` is a fundamental EIGRP feature that balances route advertisement with neighbor management.

Syntax·Router Config

passive-interface [intf]

When to Use This Command

On a LAN interface where no other EIGRP routers exist, to reduce unnecessary multicast hello traffic.
On a loopback interface to advertise its subnet without forming a neighbor relationship.
On a WAN interface connected to a non-EIGRP device, to avoid sending hellos and wasting bandwidth.
On a management interface that should be reachable via EIGRP but should not participate in neighbor discovery.

Parameters

Parameter	Syntax	Required	Description
intf	Interface type and number (e.g., GigabitEthernet0/0, Serial0/0/0)	Required	Specifies the interface to be made passive. Valid values include any router interface (physical or logical) that is enabled for EIGRP. Common mistakes include using an interface that is not configured with an IP address or not part of the EIGRP network statement, which will result in no effect. Also, using the wrong interface type or number can lead to configuration on the wrong interface.

Command Examples

Making a single interface passive

router eigrp 100
 passive-interface GigabitEthernet0/1

R1(config-router)# passive-interface GigabitEthernet0/1
R1(config-router)#

The command is entered under router configuration mode. No output is shown upon success; the interface is now passive.

Making all interfaces passive and then enabling specific ones

router eigrp 100
 passive-interface default
 no passive-interface GigabitEthernet0/0

R1(config-router)# passive-interface default
R1(config-router)# no passive-interface GigabitEthernet0/0
R1(config-router)#

First, all interfaces are set passive. Then, GigabitEthernet0/0 is removed from passive mode, allowing it to send hellos and form adjacencies.

Understanding the Output

The passive-interface command does not produce any output when executed successfully. To verify which interfaces are passive, use 'show ip eigrp interfaces'. In the output, look for the 'Passive' column: 'Yes' means the interface is passive (no hellos sent, no neighbors formed), 'No' means it is active.

Also, 'show ip eigrp neighbors' will not show any neighbors learned via passive interfaces. If you expect a neighbor but don't see it, check if the interface is accidentally passive.

Configuration Scenarios

Prevent EIGRP adjacency on a LAN interface connecting to end users

A router R1 connects to a switch with multiple end users on GigabitEthernet0/1. The network 192.168.1.0/24 is advertised in EIGRP, but no EIGRP neighbors should form on that interface to avoid unnecessary hello traffic and potential security risks.

Topology

R1(Gi0/0)---10.0.12.0/30---(Gi0/0)R2
R1(Gi0/1)---192.168.1.0/24---Switch---End Users

Steps

1.Step 1: Enter global configuration mode: Router> enable then Router# configure terminal
2.Step 2: Enter EIGRP configuration mode: Router(config)# router eigrp 100
3.Step 3: Make the LAN interface passive: Router(config-router)# passive-interface GigabitEthernet0/1
4.Step 4: Exit configuration mode and verify: Router(config-router)# end
5.Step 5: Verify with show commands: Router# show ip eigrp interfaces and Router# show ip eigrp neighbors

Configuration

! Full IOS config block
Router> enable
Router# configure terminal
Router(config)# router eigrp 100
Router(config-router)# network 10.0.12.0 0.0.0.3
Router(config-router)# network 192.168.1.0 0.0.0.255
Router(config-router)# passive-interface GigabitEthernet0/1
Router(config-router)# end

Verify: Use 'show ip eigrp interfaces' to see that GigabitEthernet0/1 is listed as passive. Use 'show ip eigrp neighbors' to confirm no neighbor is formed on that interface. Expected output: 'show ip eigrp interfaces' shows 'Passive' for Gi0/1; 'show ip eigrp neighbors' shows only R2's adjacency on Gi0/0.

Watch out: A common mistake is forgetting to include the network statement for the passive interface's subnet. Without it, the subnet is not advertised, which may cause reachability issues. Ensure the network command covers the passive interface's IP address.

Configure EIGRP passive interface on a spoke router in a hub-and-spoke topology

In a hub-and-spoke EIGRP network, spoke routers should only form adjacencies with the hub, not with other spokes. On the spoke router, the interface facing the hub is active, while the interface facing the local LAN is made passive to prevent any unwanted adjacencies.

Topology

Hub(R1)---10.0.1.0/30---(Gi0/0)Spoke1(Gi0/1)---192.168.1.0/24
Hub(R1)---10.0.2.0/30---(Gi0/0)Spoke2(Gi0/1)---192.168.2.0/24

Steps

1.Step 1: On Spoke1, enter global configuration mode: enable then configure terminal
2.Step 2: Enter EIGRP configuration: router eigrp 100
3.Step 3: Make the LAN interface passive: passive-interface GigabitEthernet0/1
4.Step 4: Ensure the WAN interface is not passive (default is active): no passive-interface GigabitEthernet0/0 (if previously set)
5.Step 5: Verify the configuration: end then show ip eigrp interfaces

Configuration

! Spoke1 configuration
Router> enable
Router# configure terminal
Router(config)# router eigrp 100
Router(config-router)# network 10.0.1.0 0.0.0.3
Router(config-router)# network 192.168.1.0 0.0.0.255
Router(config-router)# passive-interface GigabitEthernet0/1
Router(config-router)# end

Verify: Use 'show ip eigrp neighbors' on Spoke1 to confirm only the hub (10.0.1.1) is a neighbor. Use 'show ip eigrp interfaces' to see Gi0/1 as passive and Gi0/0 as active. Expected output: neighbor table shows only hub; interface table shows Gi0/1 passive.

Watch out: If the hub router also has a passive interface configured on its LAN side, ensure that the hub's LAN interface is not passive if it needs to form adjacencies with other routers. Also, verify that the network statement on the spoke includes the LAN subnet; otherwise, it won't be advertised.

Troubleshooting with This Command

When troubleshooting EIGRP adjacency issues, the `passive-interface` command is often a suspect if a router fails to form a neighbor relationship on an interface. The first step is to verify the interface status with `show ip eigrp interfaces`. This command displays all interfaces on which EIGRP is enabled, along with their passive/active status.

A healthy output shows the expected interfaces as active (not passive) if adjacencies are desired. If an interface is listed as passive, it will not send or receive hellos, and no neighbor will form. Common symptoms include missing routes from a subnet that should be reachable, or a neighbor that appears in `show ip eigrp neighbors` but then disappears after a hold timer expiry.

To diagnose, check the passive-interface configuration with `show running-config | section router eigrp`. Look for the `passive-interface` command under the EIGRP process. If an interface is incorrectly set to passive, remove it with `no passive-interface <interface>`.

Another useful command is `debug eigrp packets hello`, which shows hello packets being sent and received. If no hello packets are seen on an interface, it may be passive. However, use debug with caution in production.

Also, correlate with `show ip eigrp topology` to see if routes from the missing neighbor are present. If the passive interface is intentional, ensure that the subnet is still advertised by checking `show ip eigrp topology all-links` to see if the route is in the topology table. A common pitfall is that the `passive-interface default` command makes all interfaces passive, and then individual interfaces must be enabled with `no passive-interface`.

This can lead to unintentional passive interfaces if the engineer forgets to activate the necessary ones. To troubleshoot, always start with `show ip eigrp interfaces` to get a quick overview. If an interface is missing from the output, it may not be enabled for EIGRP (check network statement).

If it appears but is passive, verify the configuration. If it appears active but no neighbor forms, check for ACLs blocking hellos, mismatched AS numbers, or authentication issues. The `passive-interface` command is a powerful tool but can cause connectivity issues if misapplied.

Always verify both sides of the adjacency. In summary, the diagnostic flow is: 1) Check `show ip eigrp neighbors` for missing adjacencies. 2) Check `show ip eigrp interfaces` for passive status. 3) Review running config for passive-interface statements. 4) Use debug or packet capture if needed. 5) Correct any misconfiguration. This systematic approach will quickly isolate passive-interface related problems.

CCNA Exam Tips

Remember that passive interfaces still advertise their subnet in EIGRP updates; they just don't send hellos or form neighbors.

The 'passive-interface default' command makes all interfaces passive, then you use 'no passive-interface' to enable specific ones.

On the CCNA exam, you might be asked to configure EIGRP on a router with multiple interfaces, but only one should form a neighbor adjacency.

Passive interfaces reduce unnecessary traffic and improve security by not exposing EIGRP to untrusted networks.

Common Mistakes

Mistake: Applying passive-interface to an interface that should form a neighbor adjacency, causing no neighbor relationship to form.

Mistake: Forgetting that passive interfaces still advertise the network, which can lead to routing loops if the subnet is not actually reachable.

Mistake: Using 'passive-interface default' and then forgetting to enable the necessary interfaces, resulting in no EIGRP adjacencies at all.

passive-interface [intf] vs show ip eigrp interfaces

The passive-interface and show ip eigrp interfaces commands both relate to EIGRP interface participation, but one is a configuration command that suppresses neighbor formation, while the other is a verification command that displays active interfaces and adjacency status. They are often paired when troubleshooting or tuning EIGRP behavior.

Aspect	passive-interface [intf]	show ip eigrp interfaces
Scope	Single interface only	All EIGRP-enabled interfaces
Configuration mode	Router config (config-router)	Privileged EXEC (#)
Persistence	Persistent in running-config	Ephemeral (output only)
Precedence	Overrides network statement on interface	Reflects current operational state
Typical use	Prevent neighbor adjacencies on LAN/WAN links	Verify interface participation and adjacency

Use passive-interface [intf] when you want to prevent EIGRP from forming neighbor adjacencies on a specific interface while still advertising its subnet in EIGRP updates.

Use show ip eigrp interfaces when you need to verify which interfaces have EIGRP enabled, check neighbor counts, and confirm interface state for troubleshooting.

Platform Notes

In IOS-XE, the `passive-interface` command syntax and behavior are identical to classic IOS. The command is configured under the EIGRP router configuration mode, and verification commands like `show ip eigrp interfaces` work the same. However, in IOS-XE, there may be additional options for VRF-aware EIGRP, where the passive-interface command can be applied within a VRF context.

For NX-OS, the equivalent command is `passive-interface` under `router eigrp <instance>`, but the syntax is slightly different: NX-OS uses `passive-interface <interface>` and also supports `passive-interface default`. Verification is done with `show ip eigrp interfaces` or `show ip eigrp neighbors`. NX-OS also supports the `no passive-interface` command.

On ASA firewalls, EIGRP is not supported; instead, ASA uses OSPF or RIP. Therefore, there is no direct equivalent. For IOS-XR, the command is `passive-interface` under `router eigrp <instance>`, but IOS-XR uses a different configuration hierarchy (e.g., `router eigrp <instance>` then `interface <interface>` then `passive-interface`).

The behavior is the same: suppresses hellos but advertises the subnet. In terms of version differences, IOS 12.x and 15.x behave identically for this command. IOS 16.x (IOS-XE) also maintains compatibility.

One nuance: in some older IOS versions, the `passive-interface` command was not available for EIGRP named mode configurations; it was only for classic mode. However, modern IOS supports it for both. Always check the specific platform documentation.

Overall, the command is consistent across Cisco platforms, with minor syntax variations in NX-OS and IOS-XR.

Related Commands

show ip eigrp interfaces

Displays detailed information about interfaces on which EIGRP is enabled, including neighbor status, pending routes, and interface statistics, used to verify EIGRP adjacency and interface participation.

show ip eigrp neighbors

Displays all EIGRP neighbours with their addresses, interfaces, hold time, uptime, SRTT (smooth round-trip time), RTO, queue count, and sequence numbers.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions