How to Configure CDP and LLDP on Cisco (Step by Step)

Step 1 — Understand what CDP and LLDP can (and cannot) see

Both protocols are link-local. Each device sends periodic advertisements to a reserved Layer 2 multicast address, and the immediately adjacent device consumes that frame instead of forwarding it. CDP frames go to MAC 0100.0CCC.CCCC; LLDP frames go to 0180.C200.000E, an address that 802.1D bridges are specifically required not to forward. The practical consequence is the single most misunderstood fact about discovery: your neighbor is always the device on the far end of the physical link, and nothing beyond it.

This matters the moment a switch sits in the path. If R1 connects to SW1, and SW1 connects to R2, then R1's neighbor is SW1 — not R2. SW1 terminates R1's frames and originates its own. To learn about R2 you log into SW1 and look at its neighbor table. CDP and LLDP build a hop-by-hop map, not an end-to-end one. Treat every entry as 'what is one cable away,' and you will read the output correctly every time.

One caveat worth knowing: an intermediate device that does not participate in the protocol at all may flood the multicast like any unknown frame, which can make a two-hop device appear as a neighbor. Do not rely on that behavior — any Cisco switch in the path has CDP enabled by default and will consume the frame.

Step 2 — Confirm CDP is running and list your neighbors

CDP is enabled by default both globally and on every interface of a Cisco device, so on a fresh box there is usually nothing to turn on — you verify. `show cdp` confirms the global state and the advertisement/hold timers; `show cdp neighbors` prints the summary table.

Read the summary columns deliberately. Device ID is the neighbor's hostname; Local Intrfce is your port; Holdtme counts down the seconds until the entry is discarded if advertisements stop; Capability uses letter codes (R router, S switch, H host, P phone, and so on); Platform is the neighbor's hardware model; and Port ID is the neighbor's interface. That last column is what lets you trace a cable to the exact far-end port.

If you need to disable CDP everywhere — for example on an Internet-facing router where it should never run — use `no cdp run` at the global level. Re-enable with `cdp run`. Use the global switch only when you want the protocol off on the whole box; for a single port, use the per-interface control in Step 6.

R1# show cdp
Global CDP information:
        Sending CDP packets every 60 seconds
        Sending a holdtime value of 180 seconds

R1# show cdp neighbors
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
                  S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone

Device ID    Local Intrfce   Holdtme   Capability   Platform    Port ID
SW1          Gig 0/0         148          S I        WS-C3560    Gig 0/1

R1# show cdp interface GigabitEthernet0/0

! Global on/off (only if you need to change it):
R1(config)# cdp run          ! default state, CDP on everywhere
R1(config)# no cdp run       ! disable CDP on the entire device

Step 3 — Pull the details that actually matter

The summary table is for orientation; `show cdp neighbors detail` (or the equivalent `show cdp entry *`) is where the useful data lives. The detail view adds the neighbor's management IP address, the full software version string, the native VLAN, duplex, and the VTP domain — the facts you need to document a topology or troubleshoot a mismatch.

Notice what this output represents from a security standpoint: exact platform, exact IOS train, and a reachable management IP, all handed over for free to whatever is on the other end of the link. That is precisely why Step 6 exists. The convenience that makes CDP detail great for you makes it great for an attacker doing reconnaissance.

R1# show cdp neighbors detail
-------------------------
Device ID: SW1
Entry address(es):
  IP address: 10.0.0.2
Platform: cisco WS-C3560-24TS,  Capabilities: Switch IGMP
Interface: GigabitEthernet0/0,  Port ID (outgoing port): GigabitEthernet0/1
Holdtime : 142 sec

Version :
Cisco IOS Software, C3560 Software ...

advertisement version: 2
Native VLAN: 1
Duplex: full

! Same data, entry-oriented:
R1# show cdp entry *

Step 4 — Turn on LLDP for multivendor discovery

LLDP is disabled globally by default on Cisco IOS. Because CDP only speaks to other Cisco devices, LLDP is how you discover — and are discovered by — a Juniper router, an HP switch, a Linux server running lldpd, or an IP phone from a third party. Both ends of the link must run LLDP for a neighbor to appear.

Enable it globally with `lldp run`. Once LLDP is running, every eligible interface both transmits and receives LLDPDUs by default, so you often do not need to touch the interfaces at all. When you do need per-port control, `lldp transmit` and `lldp receive` (and their `no` forms) let you send only, listen only, or shut the protocol off on that port. Sending and receiving are independent — you can advertise nothing while still learning about a neighbor, or listen silently while advertising.

R1(config)# lldp run
R1(config)# interface GigabitEthernet0/0
R1(config-if)# lldp transmit
R1(config-if)# lldp receive

! To suppress one direction on a port:
R1(config-if)# no lldp transmit    ! stop advertising out this port
R1(config-if)# no lldp receive     ! stop learning on this port

Step 5 — Verify LLDP neighbors and read the detail

Verification mirrors CDP. `show lldp neighbors` gives the summary table; `show lldp neighbors detail` adds the management address, system description (often the full software version), the port description, and the advertised VLAN. `show lldp interface` confirms whether a given port is set to transmit, receive, or both.

Give it time before you conclude nothing is there. LLDP advertises every 30 seconds by default and applies a short reinitialization delay when a port comes up, so a neighbor can take up to a full interval to populate. An empty table usually means the far end is not running LLDP, is running it in one direction only, or has not advertised yet — not that your configuration is wrong.

R1# show lldp neighbors
Capability codes:
    (R) Router, (B) Bridge, (T) Telephone, (C) DOCSIS Cable Device
    (W) WLAN Access Point, (P) Repeater, (S) Station, (O) Other

Device ID   Local Intf   Hold-time   Capability   Port ID
SW1         Gi0/0        120         B            Gi0/1

R1# show lldp neighbors detail
R1# show lldp interface GigabitEthernet0/0

Step 6 — Disable discovery on untrusted and edge ports

Discovery belongs on trusted infrastructure links, not on ports that face untrusted endpoints, guest ports, or a provider handoff. As Step 3 showed, an advertisement leaks your model, software version, and management IP — a gift to anyone probing your network. The best-practice default is: keep CDP/LLDP running between your own switches and routers, and suppress it toward anything you do not control.

For a single port, use `no cdp enable` and `no lldp transmit` (add `no lldp receive` if you also want to stop learning on that port) in interface configuration. This is the surgical control: CDP and LLDP keep running everywhere else while going silent on that specific edge link. If a device should never run a protocol at all — say CDP on an Internet-facing router — disable it globally with `no cdp run` instead.

One caution before you blanket-disable LLDP on access ports: LLDP-MED is how many IP phones negotiate their voice VLAN and PoE. If a port serves a phone, killing LLDP transmit can break that negotiation. Scope the suppression to genuinely untrusted ports, not every access port reflexively.

R1(config)# interface GigabitEthernet0/1
R1(config-if)# no cdp enable       ! stop CDP on this untrusted port
R1(config-if)# no lldp transmit    ! stop advertising over LLDP
R1(config-if)# no lldp receive     ! optional: stop learning too

! Re-enable on a trusted port if it was ever turned off:
R1(config-if)# cdp enable
R1(config-if)# lldp transmit
R1(config-if)# lldp receive

Step 7 — Tune advertisement and hold timers (optional)

The defaults are sensible and rarely need changing, but both protocols expose their timers if you have a reason. CDP advertises every 60 seconds and holds an entry for 180 seconds; LLDP advertises every 30 seconds and holds for 120 seconds. The hold time should always be a comfortable multiple of the advertisement interval so a single lost frame does not age a neighbor out.

Shorter timers detect a dead neighbor faster at the cost of more control-plane chatter; longer timers do the opposite. Change them only with a clear goal — faster failure detection for documentation tools, or reduced overhead on a busy device — and set them consistently across the domain.

! CDP (global):
R1(config)# cdp timer 60
R1(config)# cdp holdtime 180

! LLDP (global):
R1(config)# lldp timer 30
R1(config)# lldp holdtime 120
R1(config)# lldp reinit 2

Common problems (and the fix)

Expecting LLDP to work with no configuration. Unlike CDP, LLDP is off by default on Cisco IOS. `show lldp neighbors` returns nothing and it looks broken. Fix: enter `lldp run` in global config on both ends of the link, then wait one advertisement interval before checking again.

Trying to discover a device through a switch. You expect `show cdp neighbors` on R1 to show R2, but a switch sits between them, so R1 only ever sees the switch. This is not a bug — it is the link-local design. Fix: read the table hop by hop; log into the intervening switch and view its neighbor table to reach the next device.

Looking for a non-Cisco device with CDP. A Juniper, HP, or Linux neighbor never appears under CDP because CDP is Cisco-proprietary. Fix: enable LLDP (`lldp run`) on the Cisco side and confirm the third-party device is running LLDP as well; the neighbor shows up under `show lldp neighbors`.

LLDP enabled globally but a specific port shows nothing. The port may have been set to one direction, or the far end is transmit-only or receive-only. Fix: run `show lldp interface` to confirm Tx and Rx state on both ends, and set `lldp transmit` / `lldp receive` as needed. Remember Tx and Rx are independent — a silent-but-listening port learns neighbors without advertising itself.

Discovery left on toward an untrusted endpoint. The port works, so it is easy to miss that it is broadcasting your platform, IOS version, and management IP to a device you do not control. Fix: apply `no cdp enable` and `no lldp transmit` on edge and untrusted ports, keeping discovery on trusted infrastructure links only — and mind the LLDP-MED exception for IP phones.