2

My techs just got a pile of fluke test equipment, which can use LLDP to determine what switchport it is connected to. However, the network guys have disabled lldp / cdp as by default it exposes the specific version of IOS that is running.

Is there a Cisco command on C3750E or C3560 series switches on IOS 12.2 to either not supply that specific TLV or have custom response independent of actual IOS version?

I have found via google references to NX-OS being able to do this with no lldp tlv-select system-desc but nothing for IOS.

Not sure which specific TLV has the IOS version in it - maybe basic TLV type 6 "System Description" or one of the LLDP-MED extensions with OUI 00-12-BB subtypes 6 or 7 ("Inventory - Firmware Revision" and "Inventory - Software Revision" respectively)

Many thanks for your input.

Improve this question

2 Answers 2

Reset to default
2

It's there in later versions. 15.0 supports it on my 2960S's. And yes, system-description is the TLV:

SysDescr: Cisco IOS Software, C2960S Software (C2960S-UNIVERSALK9-M), Version 15.0(2)SE3

I'm curious why the admins think hiding the IOS version is in any way a security enhancement?

[If I find the specific command reference that lists when it was introduced, I'll add a link.]

Improve this answer
1
  • Gotcha, doesn't exist in IOS 12.2 Thanks!
    – William
    Apr 28, 2015 at 16:12
0

You can enable lldp while leaving cdp disabled, globally and per interface. Don't know if lldp will include TLV with IOS version.

Improve this answer
1
  • The System Description TLV includes the IOS version.
    – user2964971
    May 30, 2019 at 9:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.