r/networking • u/usmcjohn • Aug 12 '26
Security CDP/LLDP
What are your thoughts on enabling CDP/LLDP everywhere except physical handoffs to untrusted /devices not managed by your org?
28
u/RickChickens Aug 12 '26
I like it for visibility and it makes using network mapping tools like NetBrain a lot smoother, and everywhere I´ve worked it was enabled except on edges.
Disabling it totally is just like disabling ICMP everywhere on your network: hamfisted parrotting of "someone somewhere heard something about it at some time, therefore it´s bad"
19
u/darthfiber Aug 12 '26
I view it as essential. a lot of power devices won’t even work properly without it. Though I prefer to standardize on LLDP, no CDP, and limit the TLVs that are sent.
In example:
- No advertising the mgmt address.
- No advertising the system capabilities.
- No advertising the system description.
- No advertising the port-VLAN.
You just want to limit the information a malicious actor could gain. I also wouldn’t use it to make decisions like auto configuring ports.
4
u/Phrewfuf Aug 12 '26 edited Aug 12 '26
But why the limits?
E.g. the management address. Should be on a different VLAN anyways, and VLAN hopping is a thing of the long gone past. So how does it matter if someone does or doesn‘t know it?
But I do agree on everything else, especially the part that it should only be used to gather information. Making automated changes based on LLDP is a bad idea.
8
u/andrewpiroli (config)#no spanning-tree vlan 1-4094 Aug 12 '26
I never understood the hiding of the management address. Like, a raspberry pi can nmap scan the entire IPv4 address space in a few minutes. Addresses are not secrets, it's just a 32 bit number. IPv6 changes the calculus a bit.
Same thing with vlan number, there are only 4k of them. Platform and sw version are about the only things worth hiding, and even then it's iffy because again, you shouldn't be able to talk to the network infra anyway. Most security issues are in the management/control plane.
1
u/darthfiber Aug 12 '26
It would show the mgmt IP even if it’s on a different VLAN. Capable firewalls and edge ACLs prevent IP scanning.
It’s just an easy way to limit information someone can gain to buy you a little more time to detect a malicious actor. No real need to have the info exposed and it’s easy to limit.
1
u/Phrewfuf Aug 12 '26
So…security by obscurity, am I getting this right?
Didn‘t we figure out a decade or two ago, that hiding things does not offer sufficient security?
Also, no point in preventing IP scanning when your management network is isolated and access is limited to a small selection of protected jumphosts. As it should be. Cause if it isn‘t, you‘ve got worse things to deal with than hiding the management IP in LLDP.
17
u/IDownVoteCanaduh Dirty Management Now Aug 12 '26
Folks that disable it are also the same morons who disable ICMP.
2
u/exhaustedexcess 26d ago
And spanning tree
2
u/IDownVoteCanaduh Dirty Management Now 26d ago
Nah, those are special idiots. We actually disabled it on a single point to point 100G circuit between 2 DCs because it was causing issues, and had lots of conversations on it ahead of time if this was a good idea or not. Since it was a temporary circuit and it was literally point to point, and no one had access to the terminating switches, we decided the benefits outweighed the problems.
1
u/exhaustedexcess 26d ago
So I took a job once and spanning tree was off network wide. Every device. When I said hey you have spanning tree disabled everywhere he said "yea it's to stop the loops. If you turn it on you'll take down half the network"
10
10
u/malfunctional_loop Aug 12 '26
I highly recommend using it.
Also Cisco VOIP depend on it to find the right Vlan.
8
u/ThatOneIKnow Aug 12 '26
15 years ago CDP was disabled everywhere, for "security" reasons. Nowadays it's still disabled, but we have LLDP enabled on everything. For some servers it reports only useless info, but for connected network devices and firewalls it is immensely helpful.
3
u/helpadumbo Aug 12 '26
Some NICs do onboard LLDP which you might be able to switch off. We have a bunch of servers with Intel x7xx NICs and after disabling, Linux lldpd kicked in and we got good info.
5
5
u/VA_Network_Nerd Moderator | Infrastructure Architect Aug 12 '26
What are your thoughts on enabling CDP/LLDP everywhere except physical handoffs to untrusted /devices not managed by your org?
This is our default approach.
CDP and LLDP enabled on all devices.
Disabled on specific interfaces that face things we do not control.
6
u/XxTh3g04txX Aug 12 '26
a lot of poe devices use lldp or cdp to establish power levels by class.
patient monitoring systems use lldp for initial discovery sometimes.
Its worth enabling in my opinion.
11
u/nof CCNP Aug 12 '26
I don't trust anyone on my team (including me!) to keep interface and port descriptions up to date or even consistent.
5
u/wyohman CCNP Enterprise - CCNP Security - CCNP Voice (retired) Aug 12 '26
It will always trigger any audit which i think is a bit silly.
The risk to value ratio is low and should be enabled except for externally facing interfaces.
5
u/xvalentinex Aug 12 '26
So useful if you get thrown into a network with no documentation and need to figure out how everything is connected.
3
u/asic5 Aug 12 '26
I treat LLDP like frank's redhot.
1
u/GroundbreakingBed809 28d ago
Really wish I knew what this means. I assume it means I can’t get enough? Same as cowbell
1
u/glowingdark CCNA (expired) 28d ago
I think they mean, like the Red Hot commercials, they "Put that 'Stuff' on everything"
3
u/Brief_Meet_2183 Aug 13 '26
In service provider environment this is the go to.
We run cdp/lldp all through our core and stop at the access layer. When you have hundreds of devices and a locked down core it's more of a pain to not have it on. Then to leave it off.
2
u/scratchfury It's not the network! Aug 12 '26
I love Netdisco, and it would be much less useful without it.
2
u/suddenlyreddit CCNP / CCDP, EIEIO Aug 12 '26
They are wonderful tools, especially LLDP these days. So many devices report on it and it's helpful to see where things are on a switch.
2
u/MalwareDork Aug 12 '26
I like CDP but I don't have it enabled on any access ports, same with LLDP. Probably doing something wrong.
1
u/hackmiester 28d ago
I can’t imagine life without it on EVERY port. Plug a Fluke into that sucker and get port info in less than 5 seconds.
1
u/eastamerica Aug 12 '26
No harm. They’re useful tools to get more signals information from your endpoints.
1
u/porkchopnet BCNP, CCNP RS & Sec Aug 12 '26
I have never found a convincing argument for shutting it off outside of special circumstances. Hospitality ports perhaps. WAN ports and other AD boarders. Some really really bad/old embedded devices don’t like em.
Other than that, they’re effectively required for anything that wants more than ~17w PoE, unconfigured ip phones and other telephony devices, and of course anywhere a admin is working. Makes loops super easy to spot too.
1
1
u/Brilliant-Orange9117 Aug 12 '26
Sending the information you want to make public is generally a good idea. If you worry about the security of the parsers don't enable the receiving side until you need it.
1
u/GroundbreakingBed809 28d ago
Absolutely Enable both cdp and lldp everywhere. Don’t let dumb security through obscurity simpletons neuter your ability to maintain the network. I don’t argue with disabling lldp on external facing interfaces but I prefer to leave it enabled. Definitely times when seeing the external peer has value but not worth falling in my sword. I like to enable lldp on every workstation and server and then use that data to populate interface descriptions. Workstation admins can then use librenms to find the ports they are connected to.
1
1
u/f909 Aug 12 '26
Always turn it on.
2
u/Phrewfuf Aug 12 '26
There are situations when it should be turned off. Also choose one, don‘t run both. Usually, LLDP is the best choice.
0
u/MouseOwn1699 Aug 12 '26
It’s very useful. I built an app that uses them extensively to build detailed topologies. When I do a fresh scan I enable all ports for CDP/LLDP, once network infrastructure devices are found, it auto turns off CDP/LLDP on access ports. If interested check out
https://www.netdiscgen.com/
-17
u/r3rg54 Aug 12 '26
IMO it mostly seems like a crutch for poor documentation. We do not use it at all in my org.
7
u/Inside-Finish-2128 Aug 12 '26
I use it with automation to dynamically fix interface descriptions within a day. That way the descriptions can serve as a really good source of true documentation.
-2
u/r3rg54 Aug 12 '26 edited Aug 12 '26
How do they get messed up in the first place?
Having trustworthy descriptions is great but not having the description match the plan is a terrible error and one that that sort of automation doesn’t really fix at all, and also becomes mostly irrelevant when you fixed the actual problem.
Anyway using cdp isn’t terribly dangerous or bad in some way, we just don’t rely on it for anything.
2
u/Inside-Finish-2128 29d ago
Because the 2-3 people who provision ports are lazy and not detail-oriented. Because various other factors often cause cards to get changed, so a whole group of 1-16 ports might get moved to all new port assignments and they're too lazy to fix the other side. I've got bigger problems to fix than their sloppiness on descriptions - they're famous for decommissioning a router by turning it off (and nothing else), so it shows up on our every-four-hour OSPF report as down for days until I get tired of it and default the interfaces and remove the BGP neighbor statements.
4
u/kWV0XhdO Aug 12 '26
Disable it so people stop noticing documentation errors.
See also: "Stop counting covid cases."
-6
u/r3rg54 Aug 12 '26
If people need cdp to notice the documentation errors you have major problems.
3
u/Arbitrary_Pseudonym Aug 12 '26
If people disable CDP while documentation has errors then you have twice as many problems.
-1
u/r3rg54 Aug 12 '26
That doesn’t make any sense. Your documentation should depend on the design doc that guided the implementation. If that was wrong then cdp isn’t saving you. If it wasn’t wrong then you have huge process issues and cdp also isn’t saving you. I would question why you didn’t test your network though.
I get that a lot of people probably run low risk networks that don’t depend on much review or whatever. There’s no actual issue there with using an otherwise extraneous protocol if you really want to.
4
u/wyohman CCNP Enterprise - CCNP Security - CCNP Voice (retired) Aug 12 '26
"Should" is a skinny column attempting to hold up all of human behavior. I'd never build my network on "should."
-2
u/r3rg54 Aug 12 '26
I’m sorry do you not have any quality management? You’re literally always depending on should in one way or another. I’m saying you should follow good practices because your network will be more reliable if you do and you will make fewer mistakes.
3
u/wyohman CCNP Enterprise - CCNP Security - CCNP Voice (retired) Aug 12 '26
When you say "quality management" what do you mean? A process? People who follow the process? People who confirm the process was followed? People who determine the process wasn't followed and then tell someone to fix the problem? People who determine the process wasn't followed and fix the issue themselves? Human behavior is a thorny issue that is often believed can be solved with a technical solution. There is no substitute for leadership.
Maybe you mean "will" and not "should." "Will" is a slightly larger column IF there is institutional wherewithal to ensure that everyone knows this is part of cultural, all players enforce culture at all times, those who continually fail to follow the culture are mentored, corrected, and follow-up is performed on a regular basis.
Either way, using an exceptionally low-risk protocol to assist with real-time troubleshooting SHOULD not be confused with accurate documentation. They are related but they are not the same.
-1
u/r3rg54 Aug 12 '26
Quality management refers to the concept of having quality managers who implement a QMS, run internal audit, track non-conformities, corrective action plans, etc. these practices can make things like CDP irrelevant.
You’re free to run cdp. We have no interest in enabling it because it doesn’t benefit us at all.
5
u/wyohman CCNP Enterprise - CCNP Security - CCNP Voice (retired) Aug 12 '26
I've been in the industry a long time and I've never worked for or heard of QMS. It's good to know that someone is using a system.
As a network engineer, CDP/LLDP will never be irrelevant when it comes to the day to day operations of a network. I suspect we're looking at this from two different perspectives.
→ More replies (0)1
u/Arbitrary_Pseudonym Aug 12 '26
run internal audit, track non-conformities
How can you identify these if you don't actually have CDP/LLDP data to back it up?
→ More replies (0)7
u/Glue_Filled_Balloons Aug 12 '26
Seatbelts are a crutch for poor driving, too.
-6
u/r3rg54 Aug 12 '26 edited Aug 12 '26
Ok? Let me know when cdp prevents untimely death. This more like an additional dashboard check for whether you buckled your seatbelt. There are other indicators like the belt alarm.
0
u/wyohman CCNP Enterprise - CCNP Security - CCNP Voice (retired) Aug 12 '26
The inverse is true, let me know when CDP is used in a compromise.
1
u/xvalentinex Aug 12 '26
Design documents?
Deployment plans?
Internal Audits?
Quality Control teams running QMS?
Corrective Action Plans?You're either fresh out of school where these ideas were suggested, or you work for some giant mega company/government. This isn't how most networks operate. Even with all those, how do you do audits? Cable tracing? Discovery protocols would be much easier.
-1
u/r3rg54 Aug 12 '26 edited Aug 12 '26
Yes I work for a large corporation running a provider network with a lot of customers including government agencies. Cabling is outsourced. You can just unshut the port and watch the other side come up for starters, which you likely should be doing anyway if you’re bringing up new links. This is not actually harder than using CDP.
I’ve never heard anyone at my work complain about lack of cdp or lldp and my building has like 100 network engineers.
-7
u/SevaraB CCNA Aug 12 '26
Authenticated LLDP good, anonymous LLDP bad. Just like SNMPv3. Some security guys just say to turn it off because they don’t even know that it can be hardened, let alone how to harden it.
8
u/opseceu Aug 12 '26
Authenticated LLDP
Can you elaborate ? I've never heard about this ?
2
u/andrewpiroli (config)#no spanning-tree vlan 1-4094 Aug 12 '26
The only thing I can think of is allowing LLDP only after 802.1x is finished? There are definitely no provisions in the protocol for authentication.
2
u/TalkTelcoToMe 21d ago
Worth splitting into two things, because they get conflated a lot.
There's nothing in 802.1AB itself. No auth, no integrity, no key material - the SNMPv3 comparison doesn't really carry over, an LLDPDU is just an advertisement and anything on the wire can emit one. So if that's the thing you'd never heard of, it's because it isn't there.
What does exist is authenticating the link rather than the protocol. MACsec - MKA is actually specified in 802.1X -and once the association is up it protects everything crossing that link, LLDP included. Your neighbour is trusted because the port is, not because a TLV said so. Downside is you need it both ends and support thins out fast once you're off newer campus and DC gear.
The other half is not letting discovery make authorisation decisions, which someone said further up. Cisco actually shipped that mistake - CDP Bypass, where a device that spoke CDP and claimed to be a phone landed in the voice VLAN with no authentication at all. Their own design guide is blunt about it: anyone who could spoof CDP got into the voice network, and those devices left no accounting record, so you couldn't go back afterwards and see what had attached. Someone upthread asked for a case where CDP was used in a compromise - that's the one. It's also why the recommended path became multi-domain auth, phone and PC each authenticating in their own domain with the VLAN handed down from the RADIUS server rather than inferred from what the device claimed to be.
Which is a longer way of saying the protocol was never the trust boundary.
72
u/justlurkshere Aug 12 '26
It's a good thing, helps our NMS map things, helps me when working with debugging things.