Turn off cdp

[Flyers01]

I was told to turn cdp off on all cisco switches except for the uplink ports. What is the the benefit of these.

 

[ADB100]

It stops CDP being sent on those ports.....

It can be considered a security risk - i.e. someone puts a sniffer on and captures the CDP packets sent from the switch, they will then determine its hostname and IP address, potentially leading to them trying to telnet/ssh/http to it (attack?).

Personally I would use other techniques to mitigate attacks as I think CDP is an excellent troubleshooting tool - i.e. apply ACL's to the VTY lines & HTTP/HHTPS (if enabled) and apply a service-policy to the control-plane.

HTH

Andy

 

[Flyers01]

Thank you I have access list for ssh

 

[burtsbees]

Also, it's not really a security risk if the device is not on the edge of the network---cdp can only be used to compromise an edge device.

Burt

 

[whykap]

Make sure that you do not have CISCO phones on the network as turning off CDP will cease all IP phones quickly.

 

[Flyers01]

NO cisco phones

 

[ADB100]

Actually turning off CDP won't stop Cisco phones. It will just prevent them from detecting the Voice VLAN and sending PoE Power requirements via CDP, so the switch (unless they are new phones that support 802.3af PoE) will just supply 15.4W of power per port. If the same options are in DHCP for the Access & Voice VLANs then the phones will just appear in the Access VLAN.

Andy

 

[whykap]

Andy,
how would you get them in the voice VLAN where they belong then? I know this is out of the scope of the original question but I was just wandering.

 

[ADB100]

how would you get them in the voice VLAN where they belong then? I know this is out of the scope of the original question but I was just wandering.

You wouldn't, they would be in the access VLAN (unless you manually configured it on the phone). If the same options are in the access VLAN scope (i.e. Option 150) then the phone will happily boot, lease an IP address in the access VLAN and attempt to register with the CCM.

Voice VLAN's are anything clever, just a way of segmenting your Voice & Data traffic on a switch. An IP Phone doesn't need a Voice VLAN to operate.

Andy

 

[ADB100]

There really needs to be an 'edit' option on the forum...

I meant to write 'Voice VLAN's aren't anything clever'

Andy