CDP Vulnerability

[londint]

We need to trace all the switches and routers connection in the office and will require the protocol cdp enabled.

Please what are the advantages/disadvantages and Vulnerability of enabling this protocol?

What is the best practice?

Thanks

[n.bowbridge]

Best practice is disable CDP on any interfaces accessible from outside your network.

CDP can be used by intruders to determine:

Device type

IOS version

IP address

And more....

With this information in hand a network can be compromised quite easily, especially if out-dated IOS versions are being used.

HTH

[londint]

Thanks

Is there any documentation I can read further on this as I need to convince my boss.

Thanks

[n.bowbridge · Accepted solution]

Do you have a CCO login?

If so:

http://www.cisco.com/en/US/customer/tech/tk962/technologies_tech_note09186a00801aa000.shtml

http://www.cisco.com/en/US/customer/products/sw/iosswrel/ps1835/products_configuration_guide_chapter09186a008030c764.html#1000952

Otherwise:

http://www.google.com.au/search?hl=en&q=cdp+protocol+cisco&meta=

[peterledwidge]

You can disable cdp globally using no cdp run

or disable cdp on certain interfaces

config t

int x/x

no cdp enable

this way you can turn it off with points which might have external network connections such as border routers.

HTH

Peter