Same for:
- 1.2.12 Packet Tracer - Use CDP to Map a Network
- 37.2.12 Packet Tracer - Use CDP to Map a Network
10.1.5 Packet Tracer - Use CDP to Map a Network Answers
Topology
10.1.5 Packet Tracer - Use CDP to Map a Network
Addressing Table
| Device | Interface | IP Address | Subnet Mask | Neighbor Interface - Connected Neighbor |
|---|---|---|---|---|
| Edge1 | G0/0 | 192.168.1.1 | 255.255.255.0 | G0/1 - S1 |
| S0/0/0 | 209.165.200.5 | 255.255.255.252 | S0/0/0 - ISP | |
| Branch-Edge | S0/0/1 | 209.165.200.10 | 255.255.255.252 | S0/0/1 - ISP |
| G0/0 | 192.168.3.249 | 255.255.255.248 | G0/0 – Branch-Firewall | |
| Branch-Firewall | G0/0 | 192.168.3.253 | 255.255.255.248 | G0/0 – Branch-Edge |
| G0/1 | 192.168.4.129 | 255.255.255.128 | G0/1 – sw-br-floor2 | |
| sw-br-floor1 | G0/1 | G0/1 - sw-br-floor3 | ||
| G0/2 | G0/2 - sw-br-floor2 | |||
| sw-br-floor2 | G0/1 | G0/1 – Branch-Firewall | ||
| G0/2 | G0/2 – sw-br-floor1 | |||
| F0/24 | F0/24 – sw-br-floor3 | |||
| SVI | 192.168.4.132 | 255.255.255.128 | ||
| sw-br-floor3 | F0/24 | F0/24 – sw-br-floor2 | ||
| G0/1 | G0/1 – sw-br-floor1 | |||
| SVI | 192.168.4.133 | 255.255.255.128 |
Objectives
Map a network using CDP and SSH remote access.
Background / Scenario
A senior network administrator requires you to map the Remote Branch Office network and discover the name of a recently installed switch that still needs an IP address to be configured. Your task is to create a map of the branch office network. You must record all of the network device names, IP addresses and subnet masks, and physical interfaces interconnecting the network devices, as well as the name of the switch that does not have an IP address.
To map the network, you will use SSH for remote access and the Cisco Discovery Protocol (CDP) to discover information about neighboring network devices. Because CDP is a Layer 2 protocol, it can be used to discover information about devices that do not have IP addresses. You will record the gathered information to complete the Addressing Table and provide a topology diagram of the Remote Branch Office network.
The local and remote administrative usernames and passwords are:
Local Network
Username: admin01
Password: S3cre7P@55
Branch Office Network
Username: branchadmin
Password: S3cre7P@55
Instructions
Part 1: Use SSH to Remotely Access Network Devices
In Part 1, use the Admin-PC to remotely access the Edge1 gateway router. Next, from the Edge1 router you will SSH into the Remote Branch Office.
a. On the Admin-PC, open a command prompt.
b. SSH into the gateway router at 192.168.1.1 using the username admin01 and the password S3cre7P@55
PC> ssh -l admin01 192.168.1.1 Open Password: Edge1#
Note: Notice that you are placed directly into privileged EXEC mode. This is because the admin01 user account is set to privilege level 15.
c. Use the show ip interface brief and show interfaces commands to document the Edge1 router’s physical interfaces, IP addresses, and subnet masks in the Addressing Table.
Edge1# show ip interface brief Interface IP-Address OK? Method Status Protocol GigabitEthernet0/0 192.168.1.1 YES manual up up GigabitEthernet0/1 unassigned YES unset administratively down down Serial0/0/0 209.165.200.5 YES manual up up Serial0/0/1 unassigned YES unset administratively down down Vlan1 unassigned YES unset administratively down down
Edge1# show interfaces GigabitEthernet0/0 is up, line protocol is up (connected) Hardware is CN Gigabit Ethernet, address is 00e0.a3dd.7001 (bia 00e0.a3dd.7001) Internet address is 192.168.1.1/24 MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Full Duplex, 100Mbps, link type is auto, media type is RJ45 output flow-control is unsupported, input flow-control is unsupported ARP type: ARPA, ARP Timeout 04:00:00, Last input 00:00:08, output 00:00:05, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0 (size/max/drops); Total output drops: 0 Queueing strategy: fifo Output queue :0/40 (size/max) 5 minute input rate 54 bits/sec, 0 packets/sec 5 minute output rate 52 bits/sec, 0 packets/sec 1956 packets input, 79158 bytes, 0 no buffer Received 0 broadcasts, 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 0 watchdog, 1017 multicast, 0 pause input 0 input packets with dribble condition detected 1978 packets output, 80876 bytes, 0 underruns 0 output errors, 0 collisions, 1 interface resets 0 unknown protocol drops 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier 0 output buffer failures, 0 output buffers swapped out GigabitEthernet0/1 is administratively down, line protocol is down (disabled) Hardware is CN Gigabit Ethernet, address is 00e0.a3dd.7002 (bia 00e0.a3dd.7002) MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Half Duplex, 100Mbps, link type is auto, media type is RJ45 output flow-control is unsupported, input flow-control is unsupported ARP type: ARPA, ARP Timeout 04:00:00, Last input 00:00:08, output 00:00:05, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0 (size/max/drops); Total output drops: 0 Queueing strategy: fifo Output queue :0/40 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec 0 packets input, 0 bytes, 0 no buffer Received 0 broadcasts, 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 0 watchdog, 1017 multicast, 0 pause input 0 input packets with dribble condition detected 0 packets output, 0 bytes, 0 underruns 0 output errors, 0 collisions, 2 interface resets 0 unknown protocol drops 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier 0 output buffer failures, 0 output buffers swapped out Serial0/0/0 is up, line protocol is up (connected) Hardware is HD64570 Internet address is 209.165.200.5/30 MTU 1500 bytes, BW 1544 Kbit, DLY 20000 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation HDLC, loopback not set, keepalive set (10 sec) Last input never, output never, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0 (size/max/drops); Total output drops: 0 Queueing strategy: weighted fair Output queue: 0/1000/64/0 (size/max total/threshold/drops) Conversations 0/1/256 (active/max active/max total) Reserved Conversations 0/0 (allocated/max allocated) Available Bandwidth 1158 kilobits/sec 5 minute input rate 62 bits/sec, 1 packets/sec 5 minute output rate 46 bits/sec, 0 packets/sec 2551 packets input, 104287 bytes, 0 no buffer Received 0 broadcasts, 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 1533 packets output, 62069 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 output buffer failures, 0 output buffers swapped out 0 carrier transitions DCD=up DSR=up DTR=up RTS=up CTS=up Serial0/0/1 is administratively down, line protocol is down (disabled) Hardware is HD64570 MTU 1500 bytes, BW 1544 Kbit, DLY 20000 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation HDLC, loopback not set, keepalive set (10 sec) Last input never, output never, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0 (size/max/drops); Total output drops: 0 Queueing strategy: weighted fair Output queue: 0/1000/64/0 (size/max total/threshold/drops) Conversations 0/0/256 (active/max active/max total) Reserved Conversations 0/0 (allocated/max allocated) Available Bandwidth 1158 kilobits/sec 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec 0 packets input, 0 bytes, 0 no buffer Received 0 broadcasts, 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 0 packets output, 0 bytes, 0 underruns 0 output errors, 0 collisions, 2 interface resets 0 output buffer failures, 0 output buffers swapped out 0 carrier transitions DCD=down DSR=down DTR=down RTS=down CTS=down Vlan1 is administratively down, line protocol is down Hardware is CPU Interface, address is 0060.70bd.dd13 (bia 0060.70bd.dd13) MTU 1500 bytes, BW 100000 Kbit, DLY 1000000 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set ARP type: ARPA, ARP Timeout 04:00:00 Last input 21:40:21, output never, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec 1682 packets input, 530955 bytes, 0 no buffer Received 0 broadcasts (0 IP multicast) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 563859 packets output, 0 bytes, 0 underruns 0 output errors, 23 interface resets 0 output buffer failures, 0 output buffers swapped out
Based on the output of the show command, the s0/0/0 interface on the Edge1 router has the IP address 209.165.200.5. The /30 prefix corresponds to the subnet mask 255.255.255.252.
d. From Edge1, use SSH to access the Remote Branch Office at 209.165.200.10 with the username branchadmin and the same password as above (S3cre7P@55):
Edge1# ssh -l branchadmin 209.165.200.10 Open Password: Branch-Edge#
After connecting to the Remote Branch Office what piece of previously missing information can now be added to the Addressing Table above?
The Branch-Edge router hostname
Part 2: Use CDP to Discover Neighboring Devices
You are now remotely connected to the Branch-Edge router. Using CDP, begin looking for connected network devices.
a. Issue the show ip interface brief and show interfaces commands to document the Branch-Edge router’s network interfaces, IP addresses, and subnet masks. Add the missing information to the Addressing Table to map the network:
Branch-Edge# show ip interface brief Interface IP-Address OK? Method Status Protocol GigabitEthernet0/0 192.168.3.249 YES manual up up GigabitEthernet0/1 unassigned YES unset administratively down down Serial0/0/0 unassigned YES unset administratively down down Serial0/0/1 209.165.200.10 YES manual up up Vlan1 unassigned YES unset administratively down down
Branch-Edge# show interfaces GigabitEthernet0/0 is up, line protocol is up (connected) Hardware is CN Gigabit Ethernet, address is 0001.9660.0053 (bia 0001.9660.0053) Internet address is 192.168.3.249/29 MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Full Duplex, 100Mbps, link type is auto, media type is RJ45 output flow-control is unsupported, input flow-control is unsupported ARP type: ARPA, ARP Timeout 04:00:00, Last input 00:00:08, output 00:00:05, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0 (size/max/drops); Total output drops: 0 Queueing strategy: fifo Output queue :0/40 (size/max) 5 minute input rate 3 bits/sec, 0 packets/sec 5 minute output rate 4 bits/sec, 0 packets/sec 1261 packets input, 51537 bytes, 0 no buffer Received 0 broadcasts, 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 0 watchdog, 1017 multicast, 0 pause input 0 input packets with dribble condition detected 1139 packets output, 46285 bytes, 0 underruns 0 output errors, 0 collisions, 1 interface resets 0 unknown protocol drops 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier 0 output buffer failures, 0 output buffers swapped out GigabitEthernet0/1 is administratively down, line protocol is down (disabled) Hardware is CN Gigabit Ethernet, address is 0001.9727.a463 (bia 0001.9727.a463) MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Half Duplex, 100Mbps, link type is auto, media type is RJ45 output flow-control is unsupported, input flow-control is unsupported ARP type: ARPA, ARP Timeout 04:00:00, Last input 00:00:08, output 00:00:05, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0 (size/max/drops); Total output drops: 0 Queueing strategy: fifo Output queue :0/40 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec 0 packets input, 0 bytes, 0 no buffer Received 0 broadcasts, 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 0 watchdog, 1017 multicast, 0 pause input 0 input packets with dribble condition detected 0 packets output, 0 bytes, 0 underruns 0 output errors, 0 collisions, 2 interface resets 0 unknown protocol drops 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier 0 output buffer failures, 0 output buffers swapped out Serial0/0/0 is administratively down, line protocol is down (disabled) Hardware is HD64570 MTU 1500 bytes, BW 1544 Kbit, DLY 20000 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation HDLC, loopback not set, keepalive set (10 sec) Last input never, output never, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0 (size/max/drops); Total output drops: 0 Queueing strategy: weighted fair Output queue: 0/1000/64/0 (size/max total/threshold/drops) Conversations 0/0/256 (active/max active/max total) Reserved Conversations 0/0 (allocated/max allocated) Available Bandwidth 1158 kilobits/sec 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec 0 packets input, 0 bytes, 0 no buffer Received 0 broadcasts, 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 0 packets output, 0 bytes, 0 underruns 0 output errors, 0 collisions, 2 interface resets 0 output buffer failures, 0 output buffers swapped out 0 carrier transitions DCD=down DSR=down DTR=down RTS=down CTS=down Serial0/0/1 is up, line protocol is up (connected) Hardware is HD64570 Internet address is 209.165.200.10/30 MTU 1500 bytes, BW 1544 Kbit, DLY 20000 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation HDLC, loopback not set, keepalive set (10 sec) Last input never, output never, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0 (size/max/drops); Total output drops: 0 Queueing strategy: weighted fair Output queue: 0/1000/64/0 (size/max total/threshold/drops) Conversations 0/1/256 (active/max active/max total) Reserved Conversations 0/0 (allocated/max allocated) Available Bandwidth 1158 kilobits/sec 5 minute input rate 11 bits/sec, 0 packets/sec 5 minute output rate 8 bits/sec, 0 packets/sec 2084 packets input, 84711 bytes, 0 no buffer Received 0 broadcasts, 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 984 packets output, 40087 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 output buffer failures, 0 output buffers swapped out 0 carrier transitions DCD=up DSR=up DTR=up RTS=up CTS=up Vlan1 is administratively down, line protocol is down Hardware is CPU Interface, address is 0001.4360.6197 (bia 0001.4360.6197) MTU 1500 bytes, BW 100000 Kbit, DLY 1000000 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set ARP type: ARPA, ARP Timeout 04:00:00 Last input 21:40:21, output never, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec 1682 packets input, 530955 bytes, 0 no buffer Received 0 broadcasts (0 IP multicast) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 563859 packets output, 0 bytes, 0 underruns 0 output errors, 23 interface resets 0 output buffer failures, 0 output buffers swapped out
b. Security best practice recommends only running CDP when needed, so CDP may need to be turned on. Use the show cdp command to display its status.
Branch-Edge# show cdp % CDP is not enabled
c. You need to turn on CDP, but it is a good idea to only broadcast CDP information to internal network devices and not to external networks. To do this, turn on the CDP protocol and then disable CDP on the S0/0/1 interface.
Branch-Edge(config)# cdp run Branch-Edge(config)# interface serial 0/0/1 Branch-Edge(config-if)# no cdp enable
d. Issue a show cdp neighbors command to find any neighboring network devices.
Note: CDP will only show connected Cisco devices that are also running CDP.
Branch-Edge# show cdp neighbors
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone
Device ID Local Intrfce Holdtme Capability Platform Port ID
Branch-Firewall
Gig 0/0 164 R C1900 Gig 0/0Is there a neighboring network device? What type of device is it? What is its name? On what interface is it connected? Is the device’s IP address listed? Record the information in the Addressing Table.
Note: It may take some time for CDP updates to be received. If you see no output from the command, press the Fast Forward Time button several times.
Yes. It is a router (Capability R, Platform C1900). Its name is Branch-Firewall and it is connected to the local interface G0/0 of Branch-Edge (Port ID G0/0 on Branch-Firewall). The IP address of the device is not listed.
e. To find the IP address of the neighboring device use the show cdp neighbors detail command and record the ip address:
Branch-Edge# show cdp neighbors detail Device ID: Branch-Firewall Entry address(es): IP address : 192.168.3.253 Platform: cisco C1900, Capabilities: Router Interface: GigabitEthernet0/0, Port ID (outgoing port): GigabitEthernet0/0 Holdtime: 129 Version : Cisco IOS Software, C1900 Software (C1900-UNIVERSALK9-M), Version 15.1(4)M4, RELEASE SOFTWARE (fc2) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2012 by Cisco Systems, Inc. Compiled Thurs 5-Jan-12 15:41 by pt_team advertisement version: 2 Duplex: full
Aside from the neighboring device’s IP address, what other piece of potentially sensitive information is listed?
The IP address of Branch-Firewall is 192.168.3.253. Aside from the IP address, the output also lists the neighboring device’s IOS software version (Cisco IOS Software, C1900 Software, Version 15.1(4)M4). This could be a potential security vulnerability if it is known by a threat actor.
f. Now that you know the IP address of the neighbor device, connect to it with SSH in order to discover other devices that may be its neighbors.
Note: To connect with SSH use the same Remote Branch Office username and password (S3cre7P@55).
Branch-Edge# ssh -l branchadmin 192.168.3.253
After successfully connecting with SSH, what does the command prompt show?
Branch-Firewall#
g. You are remotely connected to the next neighbor. Use the show cdp neighbors command, and the show cdp neighbors detail command, to discover other connected neighbor devices.
Branch-Firewall# show cdp neighbors
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone
Device ID Local Intrfce Holdtme Capability Platform Port ID
sw-br-floor2
Gig 0/1 175 S 2960 Gig 0/1
Branch-Edge Gig 0/0 172 R C1900 Gig 0/0Branch-Firewall# show cdp neighbors detail Device ID: sw-br-floor2 Entry address(es): IP address : 192.168.4.132 Platform: cisco 2960, Capabilities: Switch Interface: GigabitEthernet0/1, Port ID (outgoing port): GigabitEthernet0/1 Holdtime: 168 Version : Cisco IOS Software, C2960 Software (C2960-LANBASEK9-M), Version 15.0(2)SE4, RELEASE SOFTWARE (fc1) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2013 by Cisco Systems, Inc. Compiled Wed 26-Jun-13 02:49 by mnguyen advertisement version: 2 Duplex: full --------------------------- Device ID: Branch-Edge Entry address(es): IP address : 192.168.3.249 Platform: cisco C1900, Capabilities: Router Interface: GigabitEthernet0/0, Port ID (outgoing port): GigabitEthernet0/0 Holdtime: 165 Version : Cisco IOS Software, C1900 Software (C1900-UNIVERSALK9-M), Version 15.1(4)M4, RELEASE SOFTWARE (fc2) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2012 by Cisco Systems, Inc. Compiled Thurs 5-Jan-12 15:41 by pt_team advertisement version: 2 Duplex: full
What types of network devices neighbor this device? Record any newly discovered devices in the Addressing Table. Include their hostname, interfaces, and IP addresses.
A router (Branch-Edge, on G0/0) and a switch (sw-br-floor2, on G0/1). The sw-br-floor2 switch is a newly discovered device. Its IP address is 192.168.4.132 and it is connected to the G0/1 interface of Branch-Firewall (Port ID G0/1 on sw-br-floor2).
h. Continue discovering new network devices using SSH and the show CDP commands. Eventually, you will reach the end of the network and there will be no more devices to discover.
Branch-Firewall# ssh -l branchadmin 192.168.4.132 Password: sw-br-floor2#
sw-br-floor2# show cdp neighbors
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone
Device ID Local Intrfce Holdtme Capability Platform Port ID
Branch-Firewall
Gig 0/1 164 R C1900 Gig 0/1
sw-br-floor3
Fas 0/24 164 S 2960 Fas 0/24
sw-br-floor1
Gig 0/2 164 S 2960 Gig 0/2sw-br-floor2# show cdp neighbors detail Device ID: Branch-Firewall Entry address(es): IP address : 192.168.4.129 Platform: cisco C1900, Capabilities: Router Interface: GigabitEthernet0/1, Port ID (outgoing port): GigabitEthernet0/1 Holdtime: 158 Version : Cisco IOS Software, C1900 Software (C1900-UNIVERSALK9-M), Version 15.1(4)M4, RELEASE SOFTWARE (fc2) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2012 by Cisco Systems, Inc. Compiled Thurs 5-Jan-12 15:41 by pt_team advertisement version: 2 Duplex: full --------------------------- Device ID: sw-br-floor3 Entry address(es): IP address : 192.168.4.133 Platform: cisco 2960, Capabilities: Switch Interface: FastEthernet0/24, Port ID (outgoing port): FastEthernet0/24 Holdtime: 158 Version : Cisco IOS Software, C2960 Software (C2960-LANBASEK9-M), Version 15.0(2)SE4, RELEASE SOFTWARE (fc1) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2013 by Cisco Systems, Inc. Compiled Wed 26-Jun-13 02:49 by mnguyen advertisement version: 2 Duplex: full --------------------------- Device ID: sw-br-floor1 Entry address(es): Platform: cisco 2960, Capabilities: Switch Interface: GigabitEthernet0/2, Port ID (outgoing port): GigabitEthernet0/2 Holdtime: 158 Version : Cisco IOS Software, C2960 Software (C2960-LANBASEK9-M), Version 15.0(2)SE4, RELEASE SOFTWARE (fc1) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2013 by Cisco Systems, Inc. Compiled Wed 26-Jun-13 02:49 by mnguyen advertisement version: 2 Duplex: full
What is the name of the switch that does not have an IP address on the network?
sw-br-floor1. In the show cdp neighbors detail output on sw-br-floor2, the Entry address(es) field of sw-br-floor1 is empty, so this switch has no IP address.
i. Draw a topology of the Remote Branch Office network using the information you have gathered using CDP.
Note: Answers will vary. All responses should show the same physical connections between the devices. The G0/1 link between sw-br-floor1 and sw-br-floor3 cannot be discovered with CDP in this activity, because sw-br-floor1 has no IP address and the SSH login to sw-br-floor3 fails.
Packet Tracer – Use CDP to Map a Network - Answers
Quick Reference Summary
Only one real configuration change exists in this entire lab – enabling and selectively disabling CDP on Branch-Edge. Everything else is SSH-hopping and reading CDP output. Use this table to jump straight to the answers without re-reading every step.
| Device / Step | Command | Answer / Result |
|---|---|---|
| Admin-PC → Edge1 | ssh -l admin01 192.168.1.1 |
Lands directly in privileged EXEC (admin01 is privilege level 15) |
| Edge1 | show ip interface brief / show interfaces |
Record Edge1's interfaces: G0/0 192.168.1.1/24 (to S1), S0/0/0 209.165.200.5/30 (to ISP) |
| Edge1 → Branch-Edge | ssh -l branchadmin 209.165.200.10 |
New info learned: the Branch-Edge router's hostname |
| Branch-Edge | show cdp |
% CDP is not enabled |
| Branch-Edge (the only real config in this lab) |
Branch-Edge(config)# cdp run Branch-Edge(config)# interface serial 0/0/1 Branch-Edge(config-if)# no cdp enable |
CDP enabled globally, but suppressed on the ISP-facing link so internal topology isn't leaked outward |
| Branch-Edge | show cdp neighbors |
Neighbor found: a router named Branch-Firewall, on interface G0/0 – IP address not shown by this command |
| Branch-Edge | show cdp neighbors detail |
Sensitive info besides the IP: the neighbor's IOS software version (a potential vulnerability if known to a threat actor) Branch-Firewall's IP: 192.168.3.253 |
| Branch-Edge → Branch-Firewall | ssh -l branchadmin 192.168.3.253 |
Prompt becomes: Branch-Firewall# |
| Branch-Firewall | show cdp neighbors / detail |
Neighbors: Branch-Edge (router, already known) and sw-br-floor2 (switch, newly discovered) at 192.168.4.132 on G0/1 |
| Branch-Firewall → sw-br-floor2 | ssh -l branchadmin 192.168.4.132 |
Discovers sw-br-floor1 (G0/2) and sw-br-floor3 (F0/24) |
| sw-br-floor2 | show cdp neighbors detail |
sw-br-floor3 at 192.168.4.133 (F0/24); sw-br-floor1 (G0/2) lists no IP address |
| sw-br-floor1 | — | Switch with no IP address on the network: sw-br-floor1 |
Device Configs - Final
ROUTER Branch-Edge
! ============================================================== !--- 10.1.5 Packet Tracer - Use CDP to Map a Network !--- ANSWER SCRIPT FOR ROUTER Branch-Edge !--- Usage: SSH from Admin-PC to Edge1, then to Branch-Edge (Part 1), and paste this whole file at the Branch-Edge# prompt. Every line beginning with "!" is a comment; IOS ignores it, so pasting a comment by accident is harmless. ! ============================================================== enable configure terminal ! -------------------------------------------------------------- !--- Part 2: Use CDP to Discover Neighboring Devices ! -------------------------------------------------------------- !--- c. Turn on CDP globally. cdp run !--- c. Disable CDP on S0/0/1 so CDP information is not sent to the ISP (external network). interface serial 0/0/1 no cdp enable exit end ! -------------------------------------------------------------- !--- Save the configuration to NVRAM. (Press Enter when prompted for the destination filename.) ! -------------------------------------------------------------- copy running-config startup-config ! ============================================================== !--- Verification: !--- show cdp -> Sending CDP packets every 60 seconds (CDP is enabled) !--- show cdp neighbors -> Branch-Firewall on Gig 0/0; no neighbor on Ser 0/0/1 !--- show cdp neighbors detail -> Branch-Firewall IP address 192.168.3.253 ! ==============================================================
Download Packet Tracer (.pka) file:
Previous Lab
7.6.1 Packet Tracer – WAN Concepts
