12

I have been searching for this for a while and haven't found one yet. I need a Cisco IOS command to send a syslog message or snmp trap whenever an interface that has a CDP neighbor goes down.

Some people have told me just rely on routing protocol neighbor drops, but that isn't really good enough. I have routers that are connected via static, switches, and wireless controllers. All of those devices don't run a routing protocol.

Is there a command to enable CDP syslog? I have searched for this for a while and it seems like such a basic need that Cisco would have already built something for it.

Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Commented Jan 3, 2021 at 4:15

2 Answers 2

Reset to default
6

The "event neighbor discovery" command will generate syslog messages based on CDP events. It has to be used in conjunction with EEM, but it's pretty simple to set up.

http://www.cisco.com/en/US/docs/ios/netmgmt/command/reference/nm_06.html#wp1181238

However, I don't think that these events occur as quickly as you are hoping they will. CDP is not a protocol designed for keepalives, it's for neighbor discovery. You'd probably be better off logging against link status changes (up/down) or setting up IP SLA probes to monitor the presence of a device.

Improve this answer
2
  • Re: "CDP is not a protocol designed for keepalives"; pedantically, that is a true statement. However, I'm not asking for the CDP protocol itself to detect neighbor down. I'm saying Cisco IOS already has a table of CDP neighbors, and it should be smart enough to tell me when an interface with a neighbor drops. In other words, if I ask for it IOS walks the list of CDP neighbors when an interface drops and syslogs that event.
    – radio-free-europe
    Commented Jul 17, 2013 at 11:13
  • So the command I provided will generate a syslog entry when a CDP neighbor is deleted from the neighbor table (about as analogous to a CDP neighbor going "down" as you can get). Since this event will coincide with a link down event, what more, precisely, are you looking to achieve? You seem to be looking to correlate two individual things (flagging an interface with a CDP neighbor somehow and only reporting a link down event on an interface based on that fact). That is possible, but you're going to need to do some complex EEM scripting to accomplish it.
    – totallystubby
    Commented Jul 17, 2013 at 18:41
4

You ask about interface going down, this is easily satisfied by SNMP trap:

snmp-server enable traps snmp linkdown
snmp-server host 192.0.2.1 version 2c foo 
interface NoCDP
 no snmp trap link-status

Now you'd get trap from all other interfaces going down, except for 'NoCDP' interface.

However I think you actually don't care about interfaces going up/down, you care about CDP neighbors disappearing, for that you'd need to use EEM. EEM can match CDP event and can do plethora of actions based on event, such as syslog.

As a starting point, you could use this script

Improve this answer
4
  • 1
    I am sorry if my question was unclear. I care about interfaces going down that have a CDP neighbor on them. I'm trying to avoid EEM, if possible. SNMP Linkdown traps do nothing for me, really
    – radio-free-europe
    Commented Jul 17, 2013 at 11:07
  • Then configure 'no snmp trap link-status' on all interfaces except those which have CDP.
    – ytti
    Commented Jul 17, 2013 at 11:08
  • Umm, I still don't think you understand. I care about the correlation between an interface going down that has a known CDP neighbor. SNMP link up/down traps know nothing about CDP
    – radio-free-europe
    Commented Jul 17, 2013 at 11:09
  • 1
    I guess what you're saying is that you can't do it manually, but it must be dynamic. For dynamic solution I can't think of way to do it without EEM.
    – ytti
    Commented Jul 17, 2013 at 11:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.