Configure and verify Layer 2 discovery protocols (Cisco Discovery Protocol and LLDP)

What discovery protocols do

When you sit down at a switch you have never seen before, the first question is “what is plugged into it?” A Layer 2 discovery protocol answers that. Every device periodically sends a small frame out each interface saying “I am SW1, I am a switch running this IOS version, my management address is X, and you are connected to my port Gi0/24.” The neighbor stores that in a table. No IP addresses are needed for it to work; the frames are sent to a special multicast MAC address and are never forwarded beyond the directly connected device. That is what “Layer 2” means here: each hop only knows about its immediate neighbors.

Discovery protocols are used for building network diagrams, for troubleshooting (“which switch port is this server actually on?”), and by Cisco IP phones to learn their voice VLAN and power requirements.

Two protocols do this job: CDP, Cisco’s proprietary version, and LLDP, the IEEE standard version that works between vendors.

CDP: Cisco Discovery Protocol

CDP is enabled by default on almost all Cisco devices (routers, switches, IP phones, wireless APs). Key characteristics:

• Cisco proprietary. Works only between Cisco devices (and some third parties that license it).
• Enabled globally and on every interface by default.
• Sends an advertisement every 60 seconds (the CDP timer).
• Advertisements carry a holdtime of 180 seconds: if a neighbor is not heard from for 180 seconds, it is removed from the table.
• Sent to multicast MAC 0100.0CCC.CCCC.
• Current version is CDPv2, which adds native VLAN mismatch detection and duplex mismatch detection.
• Shares: device ID (hostname), local and remote interface, platform (model), capabilities (R for router, S for switch, I for IGMP, etc.), IOS version, IP address, native VLAN, duplex, and VTP domain.

Commands:

! Global: disable or enable CDP on the whole device
SW1(config)# no cdp run
SW1(config)# cdp run
! Per interface: disable on ports facing untrusted devices
SW1(config)# interface gigabitethernet0/1
SW1(config-if)# no cdp enable
SW1(config-if)# cdp enable
! Change timers (seconds)
SW1(config)# cdp timer 30
SW1(config)# cdp holdtime 90

Verification commands:

• show cdp – whether CDP is running, timer, holdtime, version.
• show cdp neighbors – one line per neighbor.
• show cdp neighbors detail – everything about every neighbor, including IP address and IOS version.
• show cdp entry SW2 – detail for one neighbor. show cdp entry * equals show cdp neighbors detail.
• show cdp interface – which interfaces are sending CDP and their timers.
• show cdp traffic – packet counters.

SW1# show cdp neighbors
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
                  S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone,
                  D - Remote, C - CVTA, M - Two-port Mac Relay

Device ID        Local Intrfce     Holdtme    Capability  Platform  Port ID
SW2              Gig 0/24          155             S I    WS-C2960  Gig 0/24
R1               Gig 0/23          172             R S I  ISR4331   Gig 0/0
SEP001122334455  Gig 0/5           141            H P M   IP Phone  Port 1

The columns matter for the exam:

• Device ID – the neighbor’s hostname.
• Local Intrfce – my port that the neighbor is connected to.
• Holdtme – seconds remaining before this entry expires; it counts down from 180 and resets each time an advertisement arrives.
• Capability – what the neighbor is.
• Platform – hardware model.
• Port ID – the neighbor’s port. Mixing up Local Interface and Port ID is a common trap: in the first line, SW1’s Gi0/24 connects to SW2’s Gi0/24.

SW1# show cdp neighbors detail
-------------------------
Device ID: SW2
Entry address(es):
  IP address: 192.168.99.12
Platform: cisco WS-C2960-24TT-L,  Capabilities: Switch IGMP
Interface: GigabitEthernet0/24,  Port ID (outgoing port): GigabitEthernet0/24
Holdtime : 155 sec

Version :
Cisco IOS Software, C2960 Software (C2960-LANBASEK9-M), Version 15.2(7)E3
...
advertisement version: 2
VTP Management Domain: ''
Native VLAN: 99
Duplex: full
Management address(es):
  IP address: 192.168.99.12

Only the detail form shows the IP address and IOS version. If a question asks “which command shows the IP address of a directly connected Cisco device,” the answer is show cdp neighbors detail (or show cdp entry).

Security note: CDP leaks the model, IOS version, and management IP to anyone listening. Disable it on ports facing users, the internet, or other companies, but leave it on where IP phones need it. Some administrators run no cdp run globally and re-enable only on selected interfaces (cdp enable).

LLDP: Link Layer Discovery Protocol

LLDP is defined in IEEE 802.1AB and does the same job as CDP but works across vendors: a Cisco switch can discover an HP switch, a VMware host, or a Juniper router. Key characteristics:

• Open standard, multivendor.
• Disabled by default on Cisco devices; you must turn it on.
• Sends every 30 seconds (the LLDP timer).
• Holdtime of 120 seconds.
• Reinitialization delay of 2 seconds (the pause before LLDP restarts on an interface after being disabled).
• Sent to multicast MAC 0180.C200.000E.
• Information is carried in TLVs (type-length-value fields).
• Transmit and receive can be controlled separately per interface, unlike CDP which is simply on or off.
• LLDP-MED (Media Endpoint Discovery) is an extension that carries voice VLAN and PoE information for IP phones, the multivendor equivalent of what CDP does for Cisco phones.

Commands:

! Enable LLDP globally (required; it is off by default)
SW1(config)# lldp run
! Per interface: control transmit and receive independently
SW1(config)# interface gigabitethernet0/1
SW1(config-if)# no lldp transmit
SW1(config-if)# no lldp receive
SW1(config-if)# lldp transmit
SW1(config-if)# lldp receive
! Timers (seconds)
SW1(config)# lldp timer 15
SW1(config)# lldp holdtime 60
SW1(config)# lldp reinit 3

Verification:

SW1# show lldp
Global LLDP Information:
    Status: ACTIVE
    LLDP advertisements are sent every 30 seconds
    LLDP hold time advertised is 120 seconds
    LLDP interface reinitialisation delay is 2 seconds
SW1# show lldp neighbors
Capability codes:
    (R) Router, (B) Bridge, (T) Telephone, (C) DOCSIS Cable Device
    (W) WLAN Access Point, (P) Repeater, (S) Station, (O) Other

Device ID           Local Intf     Hold-time  Capability      Port ID
SW2                 Gi0/24         120        B               Gi0/24
HP-SW3              Gi0/22         120        B,R             1
R1                  Gi0/23         120        R               Gi0/0

Total entries displayed: 3

Note the differences from CDP output: the capability codes are different (a switch is B for Bridge in LLDP, S in CDP), and Hold-time here shows the advertised hold time (120) rather than a countdown. show lldp neighbors detail, show lldp entry SW2, show lldp interface, and show lldp traffic mirror the CDP equivalents.

CDP versus LLDP side by side