EIGRP Query Storm Causing Network-Wide Instability
Presenting Symptom
Users across multiple remote sites report intermittent connectivity and slow application performance; network-wide EIGRP routes are flapping, causing instability.
Network Context
The network is an enterprise campus with a hub-and-spoke topology using a Cisco 4500 series core router at headquarters and Cisco 2900 series routers at 50 branch offices. All routers run EIGRP as the routing protocol with default timers. The issue began after a new branch router was added with a misconfigured EIGRP stub setting.
Diagnostic Steps
Check EIGRP neighbor status
show ip eigrp neighborsH Address Interface Hold Uptime SRTT RTO Q Seq 0 10.1.1.2 Gi0/0 13 00:00:05 12 200 0 45 1 10.1.2.2 Gi0/1 14 00:00:03 15 200 0 67
Look for neighbors in 'Init' state or with high Q count. If Q count is non-zero, queries are pending. Normal output shows all neighbors in 'Up' state with Q=0.
Check EIGRP topology table for active queries
show ip eigrp topology activeIP-EIGRP Topology Table for AS(100)/ID(10.0.0.1)
Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,
r - reply status, s - sia status
A 10.0.0.0/24, 1 successors, FD is 28160, Q
1 replies, 0 replies, 0 repliesRoutes in Active state (A) indicate that the router is waiting for replies to queries. If many routes are active, a query storm is likely. Normal output shows only Passive (P) routes.
Identify routers sending excessive queries
debug eigrp packets queryEIGRP: received query from 10.1.1.2 on Gi0/0 EIGRP: sending query to 10.1.2.2 on Gi0/1 EIGRP: received query from 10.1.3.2 on Gi0/2
If queries are being sent and received repeatedly, a query storm is occurring. Look for a specific router that initiates many queries. Normal debug shows occasional queries only during topology changes.
Check EIGRP stub configuration on suspect router
show running-config | section router eigrprouter eigrp 100 network 10.0.0.0 eigrp stub
If the router is configured as 'eigrp stub' without the 'receive-only' keyword, it will still send queries. A stub router should be configured with 'eigrp stub receive-only' to prevent query propagation. Misconfigured stub routers can cause query storms.
Root Cause
A newly added branch router was configured as an EIGRP stub using the command 'eigrp stub' without the 'receive-only' keyword. This caused the stub router to still send queries to its neighbors, and due to a flapping link on that router, it generated repeated queries that propagated throughout the network, overwhelming routers and causing route flapping.
Resolution
Verification
Run 'show ip eigrp topology active' — should show no active routes. Run 'show ip eigrp neighbors' — all neighbors should be in 'Up' state with Q=0. Run 'show ip route eigrp' — routes should be stable and not flapping.
Prevention
1. Always configure EIGRP stub routers with 'eigrp stub receive-only' unless they need to advertise specific routes. 2. Use EIGRP query scope boundaries like summarization or distribute-lists to limit query propagation. 3. Implement EIGRP stub with 'leak-map' only when necessary and ensure proper design.
CCNA Exam Relevance
On the CCNA 200-301 exam, this scenario tests understanding of EIGRP query propagation and stub router functionality. Questions may present a troubleshooting scenario where routes are flapping and ask to identify the cause (misconfigured stub) or the correct fix. The exam expects candidates to know that 'eigrp stub' without 'receive-only' still allows queries.
Exam Tips
Memorize that 'eigrp stub receive-only' prevents the router from sending queries and only accepts routes.
Remember that a high number of active routes in 'show ip eigrp topology' indicates a query storm.
Know that default EIGRP timers (hello 5, hold 15) can exacerbate query storms; adjusting timers is not a fix.
Commands Used in This Scenario
clear ip eigrp neighbors
This command immediately resets all EIGRP neighbor adjacencies, forcing the router to re-establish neighbor relationships and re-learn routes from all EIGRP neighbors.
show ip eigrp neighbors
Displays the neighbor table for EIGRP, showing all directly connected EIGRP routers and their status, used to verify EIGRP adjacencies and troubleshoot neighbor relationships.
show ip eigrp topology
Displays the EIGRP topology table, showing all learned routes and their feasible successors, used to verify EIGRP convergence and path selection.
Test Your CCNA Knowledge
Practice with scenario-based questions to prepare for the CCNA 200-301 exam.
Practice CCNA Questions