2.1.2 Set 'no cdp run'

Information

Disable Cisco Discovery Protocol (CDP) service at device level.

Rationale:

The Cisco Discovery Protocol is a proprietary protocol that Cisco devices use to identify each other on a LAN segment. It is useful only in network monitoring and troubleshooting situations but is considered a security risk because of the amount of information provided from queries. In addition, there have been published denial-of-service (DoS) attacks that use CDP. CDP should be completely disabled unless necessary.

Impact:

To reduce the risk of unauthorized access, organizations should implement a security policy restricting network protocols and explicitly require disabling all insecure or unnecessary protocols.

Solution

Disable Cisco Discovery Protocol (CDP) service globally.


hostname(config)#no cdp run

Default Value:

Enabled on all platforms except the Cisco 10000 Series Edge Services Router

See Also

https://workbench.cisecurity.org/files/2936

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7, CSCv6|9.1, CSCv7|9.2

Plugin: Cisco

Control ID: e0f71c57fb90e178d6820b4fc4d6fcd1e92cb510d6e402dbe65cb708ad435e32