Cisco Discovery Protocol (CDP) is an invaluable protocol that was created to ease troubleshooting by providing remote device identification. On multi-vendor networks, the use of this propitiatory protocol can cause headaches as it may pass though non-Cisco equipment and falsely identify remote devices. We’ve instituted a standard it to use the Link Layer Discovery Protocol (LLDP) in favor of CDP.

To help clean up excess multicast traffic, we’ve applied the following filter on our Juniper devices that face Cisco equipment.

Lab Topology

Cisco Catalyst connected to an EX switch over a LACP connection. The filter gets applied to the native vlan, which in my lab testing is was vlan 1.

Firewall Filter

Use the load merge terminal command to easily import the following filter. The count cdp-count term is optional and you may find that you have no use for it.

firewall {
    family ethernet-switching {
        filter block-cdp {
            term block-cdp {
                from {
                    destination-mac-address {
                        01:00:0c:cc:cc:cc/48;
                    }
                }
                then {
                    discard;
                    count cdp-count;
                }
            }
            term traffic-allow {
                then accept;
            }
        }
    }
}

Use filter counters to confirm that the filter is being hit or confirm by issuing a show cdp neighbors command on your Cisco devices.

root> show firewall filter block-cdp

Filter: block-cdp
Counters:
Name                                                Bytes              Packets
cdp-count                                            4760                   24