LogoفارسیFA

Hands-On Lab: Cisco Discovery Protocol (CDP)

This hands-on lab uses CDP to discover directly connected Cisco devices without any prior configuration knowledge of the neighboring device, and covers disabling CDP on a specific interface for security reasons while leaving it active elsewhere.

CDP Neighbor DiscoveryCDP VerificationCDP Security Considerations

~3 min read · Updated Sep 22, 2026

Lab Objective

Use CDP to discover information about directly connected Cisco devices, examine the detailed information CDP reveals about each neighbor, and selectively disable CDP on an interface facing an untrusted network while leaving it enabled internally.

Lab Purpose

CDP is invaluable for quickly mapping an unfamiliar network's physical topology, showing exactly what is connected to what without needing prior documentation. However, because CDP freely advertises device details, it should be disabled on any interface facing outside the organization's trust boundary.

Lab Topology

R1 ---- Gi0/0 ---- Switch1 ---- Gi1/0/5 ---- R2
R1 ---- Gi0/1 ---- ISP Router (untrusted, external)

Task 1: Verify CDP Is Running by Default

Confirm CDP is enabled globally and on the relevant interfaces of R1.

Task 2: View the Neighbor Summary

Display a summary list of R1's directly connected CDP neighbors.

Task 3: View Detailed Neighbor Information

Display detailed information about one specific neighbor, including its IP address, platform, and software version.

Task 4: Disable CDP on the Untrusted Interface

Disable CDP specifically on the interface facing the ISP router, while leaving it running elsewhere.

Task 5: Verify Selective Disablement

Confirm CDP is disabled only on the ISP-facing interface and still active on the internal interface.

Solution and Verification

R1# show cdp

Global CDP information:
        Sending CDP packets every 60 seconds
        Sending a holdtime value of 180 seconds

R1# show cdp neighbors

Device ID    Local Intrfce  Holdtme  Capability  Platform  Port ID
Switch1      Gig 0/0        156      S I         WS-C2960  Gig 1/0/1
ISPRouter    Gig 0/1        174      R           ISR4331   Gig 0/0

R1# show cdp neighbors detail

Device ID: Switch1
IP address: 192.168.1.2
Platform: cisco WS-C2960-24TT-L, Capabilities: Switch IGMP
Interface: GigabitEthernet0/0, Port ID (outgoing port): GigabitEthernet1/0/1
Version:
Cisco IOS Software, C2960 Software...

R1(config)# interface gigabitethernet0/1
R1(config-if)# no cdp enable

R1# show cdp interface gigabitethernet0/1

-- (no output -- CDP is disabled on this
--  interface specifically)

R1# show cdp interface gigabitethernet0/0

GigabitEthernet0/0 is up, line protocol is up
Sending CDP packets every 60 seconds
-- CDP remains fully active on the internal
-- interface toward Switch1

Key Takeaway

CDP information should never be exposed toward an untrusted network, since it reveals exact hardware platform, IOS version, and IP addressing information useful to an attacker planning further reconnaissance — no cdp enable at the interface level provides this selective control without needing to disable CDP globally and lose its diagnostic value on trusted internal links.

Written & researched by Dr. Shahin Siami

Related Articles

Hands-On Lab: Configuring IPv6 Static Routes

This hands-on lab configures static routes for IPv6 destinations between two routers, mirroring the IPv4 static routing syntax covered earlier in this series while highlighting the IPv6-specific command keyword and address format.

Continue

Hands-On Lab: Configuring Default Static Routes

This hands-on lab configures a default static route on an edge router to reach the internet through an ISP connection, demonstrating how a single route can represent every otherwise-unknown destination rather than requiring individual routes for each one.

Continue

Hands-On Lab: Configuring and Naming Static Routes

This hands-on lab configures static routes with descriptive names attached using the name keyword, improving documentation and making the routing table significantly easier to interpret for anyone reviewing the configuration later.

Continue

Hands-On Lab: Configuring Static Routing via IP Addresses

This hands-on lab configures static routes using a next-hop IP address rather than an outgoing interface, the generally preferred syntax, and compares the resulting routing table entry against the interface-based approach from the previous lab.

Continue

Hands-On Lab: Configuring Static Routing via Interfaces

This hands-on lab configures static routes using an outgoing interface rather than a next-hop IP address, demonstrating this approach's suitability for point-to-point links and its important limitation on multi-access networks.

Continue

Hands-On Lab: Installing a Wireless LAN Controller

This hands-on lab performs the initial setup of a Wireless LAN Controller, joins a lightweight access point to it, and creates a centrally managed WLAN, demonstrating the controller-based architecture that scales far beyond standalone access points.

Continue
Previous ArticleNext Article