Securing Discovery on Edge Ports

Bundle lab

Harden Cisco IOS edge interfaces by disabling CDP/LLDP toward untrusted endpoints while keeping discovery active on trusted infrastructure links. Routers share a management LAN with a server and form a direct router-to-router adjacency for CDP/LLDP. The learner enables discovery globally, selectively suppresses it on the client-facing edge, and verifies the outcome with show commands.

Learning objectives

• Enable CDP and LLDP globally to support infrastructure discovery on trusted links
• Disable discovery on a specific client-facing edge port using interface-level controls
• Explain why link-local discovery should not be exposed to untrusted hosts
• Verify discovery state using show cdp/lldp interface and neighbor outputs
• Differentiate discovery behavior on direct links vs across a switch

Troubleshooting focus

• If no neighbors appear on the router-to-router link, verify CDP/LLDP are enabled globally on both routers
• If the edge port still shows up in discovery, confirm interface-level suppression: no cdp enable, no lldp transmit, and no lldp receive
• If a router seems to discover a non-adjacent device, re-check cabling: discovery only works to directly connected neighbors and is terminated by switches
• If verifications fail intermittently, confirm the correct interface names and that links are up/up with matching IP subnets