Detections
Analytics

1.29 CISC-RT-000360

Information

The Cisco perimeter router must be configured to have Link Layer Discovery Protocol (LLDP) disabled on all external interfaces.

GROUP ID: V-216764RULE ID: SV-216764r856442

LLDP is a neighbor discovery protocol used to advertise device capabilities, configuration information, and device identity. LLDP is media- and protocol-independent as it runs over layer 2; therefore, two network nodes that support different layer 3 protocols can still learn about each other. Allowing LLDP messages to reach external network nodes provides an attacker a method to obtain information of the network infrastructure that can be useful to plan an attack.

Solution

Disable LLDP transmit on all external interfaces as shown in the example below.

RP/0/0/CPU0:R3(config)#interface g0/0/0/1RP/0/0/CPU0:R3(config-if)#lldp transmit disable

See Also

https://workbench.cisecurity.org/benchmarks/23599

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-7(11), CAT|III, CCI|CCI-002403, Rule-ID|SV-216764r856442_rule, STIG-ID|CISC-RT-000360, Vuln-ID|V-216764

Plugin: Cisco

Control ID: 9d0da727bb0059c24984f91d0ad59dddd2d6138c05da3ebc6817ed4b843a674d