Lab Objective
Use CDP to discover information about directly connected Cisco devices, examine the detailed information CDP reveals about each neighbor, and selectively disable CDP on an interface facing an untrusted network while leaving it enabled internally.
Lab Purpose
CDP is invaluable for quickly mapping an unfamiliar network's physical topology, showing exactly what is connected to what without needing prior documentation. However, because CDP freely advertises device details, it should be disabled on any interface facing outside the organization's trust boundary.
Lab Topology
R1 ---- Gi0/0 ---- Switch1 ---- Gi1/0/5 ---- R2
R1 ---- Gi0/1 ---- ISP Router (untrusted, external)Task 1: Verify CDP Is Running by Default
Confirm CDP is enabled globally and on the relevant interfaces of R1.
Task 2: View the Neighbor Summary
Display a summary list of R1's directly connected CDP neighbors.
Task 3: View Detailed Neighbor Information
Display detailed information about one specific neighbor, including its IP address, platform, and software version.
Task 4: Disable CDP on the Untrusted Interface
Disable CDP specifically on the interface facing the ISP router, while leaving it running elsewhere.
Task 5: Verify Selective Disablement
Confirm CDP is disabled only on the ISP-facing interface and still active on the internal interface.
Solution and Verification
R1# show cdp
Global CDP information:
Sending CDP packets every 60 seconds
Sending a holdtime value of 180 secondsR1# show cdp neighbors
Device ID Local Intrfce Holdtme Capability Platform Port ID
Switch1 Gig 0/0 156 S I WS-C2960 Gig 1/0/1
ISPRouter Gig 0/1 174 R ISR4331 Gig 0/0R1# show cdp neighbors detail
Device ID: Switch1
IP address: 192.168.1.2
Platform: cisco WS-C2960-24TT-L, Capabilities: Switch IGMP
Interface: GigabitEthernet0/0, Port ID (outgoing port): GigabitEthernet1/0/1
Version:
Cisco IOS Software, C2960 Software...R1(config)# interface gigabitethernet0/1
R1(config-if)# no cdp enableR1# show cdp interface gigabitethernet0/1
-- (no output -- CDP is disabled on this
-- interface specifically)
R1# show cdp interface gigabitethernet0/0
GigabitEthernet0/0 is up, line protocol is up
Sending CDP packets every 60 seconds
-- CDP remains fully active on the internal
-- interface toward Switch1Key Takeaway
CDP information should never be exposed toward an untrusted network, since it reveals exact hardware platform, IOS version, and IP addressing information useful to an attacker planning further reconnaissance — no cdp enable at the interface level provides this selective control without needing to disable CDP globally and lose its diagnostic value on trusted internal links.