no cdp run
Globally disables Cisco Discovery Protocol (CDP) on the router or switch to prevent device discovery and reduce unnecessary traffic.
Definition: no cdp run is a Cisco IOS global config command. Globally disables Cisco Discovery Protocol (CDP) on the router or switch to prevent device discovery and reduce unnecessary traffic.
Overview
The `no cdp run` command is a global configuration command used on Cisco IOS devices to disable the Cisco Discovery Protocol (CDP) entirely. CDP is a Layer 2, media- and protocol-independent protocol that runs on all Cisco-manufactured equipment (routers, switches, access servers, etc.). By default, CDP is enabled globally and on all interfaces.
CDP allows network devices to advertise their identity, capabilities, and neighbors to directly connected Cisco devices. This information is critical for network discovery, topology mapping, and troubleshooting. However, there are scenarios where disabling CDP is necessary: security concerns (CDP can leak device information to potential attackers), reducing unnecessary traffic on low-bandwidth links, or when operating in a multi-vendor environment where CDP advertisements are meaningless.
The `no cdp run` command is the global kill switch; alternatively, you can disable CDP on a per-interface basis with `no cdp enable`. The choice between global and per-interface disabling depends on the requirement: if you want to completely eliminate CDP from the device, use `no cdp run`; if you only want to disable it on specific interfaces (e.g., those facing untrusted networks), use `no cdp enable` on those interfaces. Disabling CDP globally removes all CDP advertisements and neighbor table entries.
The command takes effect immediately and is written to the running configuration. There is no impact on other protocols or device functionality. CDP is a Cisco proprietary protocol, so in multi-vendor environments, you might use LLDP (Link Layer Discovery Protocol) instead.
The `no cdp run` command is available in global configuration mode, which requires privileged EXEC access (enable mode). The command does not have any parameters. After issuing the command, you can verify with `show cdp` which will indicate that CDP is not enabled globally.
The command is supported across all Cisco IOS versions, including IOS-XE, IOS-XR, and NX-OS (though NX-OS uses a different syntax). Understanding when and why to disable CDP is essential for network security and efficient operation.
no cdp runWhen to Use This Command
- Disabling CDP on a router connected to an untrusted network to prevent information leakage.
- Disabling CDP globally on a switch in a secure environment where device discovery is not required.
- Troubleshooting network issues by eliminating CDP-related traffic to isolate problems.
- Complying with security policies that prohibit the use of discovery protocols.
Command Examples
Disabling CDP globally
Router(config)# no cdp runRouter(config)#
The command is entered in global configuration mode. No output is displayed upon successful execution; the prompt returns without error.
Verifying CDP is disabled
Router# show cdpGlobal CDP information: Sending CDP packets every 60 seconds Sending a holdtime value of 180 seconds Sending CDPv2 advertisements is enabled CDP is not enabled on any interfaces.
The output shows CDP global parameters but indicates 'CDP is not enabled on any interfaces' because the 'no cdp run' command disables CDP globally, overriding any per-interface enablement.
Understanding the Output
The 'no cdp run' command does not produce any output on success. To verify CDP status, use 'show cdp'. The output displays global CDP parameters such as packet interval (default 60 seconds), holdtime (default 180 seconds), and CDP version (v2).
The key line is 'CDP is not enabled on any interfaces', which confirms that CDP is disabled globally. If CDP were enabled, the output would list interfaces with CDP active. A common mistake is to assume CDP is off based on the absence of interface output, but the global parameters still appear; the critical indicator is the last line.
Configuration Scenarios
Disable CDP Globally on a Router for Security Hardening
A company security policy requires that all network devices disable CDP globally to prevent information leakage about device types, IOS versions, and IP addresses to potential attackers on adjacent networks.
Topology
R1(Gi0/0)---(Gi0/0)SW1
R1(Gi0/1)---(Gi0/1)ISPSteps
- 1.Step 1: Enter privileged EXEC mode: R1> enable
- 2.Step 2: Enter global configuration mode: R1# configure terminal
- 3.Step 3: Disable CDP globally: R1(config)# no cdp run
- 4.Step 4: Exit configuration mode: R1(config)# end
- 5.Step 5: Verify CDP status: R1# show cdp
! R1(config)# no cdp run R1(config)# end
Verify: R1# show cdp % CDP is not enabled globally
Watch out: After disabling CDP globally, you cannot enable CDP on individual interfaces; CDP is either on or off globally. If you need CDP on some interfaces but not others, use per-interface `no cdp enable` instead.
Disable CDP on a Switch Facing a Non-Cisco Firewall
A network engineer needs to disable CDP on a switch port that connects to a non-Cisco firewall because CDP advertisements are unnecessary and may cause confusion or security concerns. However, CDP should remain enabled on other ports for network discovery.
Topology
SW1(Gi0/1)---(eth0)Firewall
SW1(Gi0/2)---(Gi0/0)R2Steps
- 1.Step 1: Enter privileged EXEC mode: SW1> enable
- 2.Step 2: Enter global configuration mode: SW1# configure terminal
- 3.Step 3: Enter interface configuration mode for Gi0/1: SW1(config)# interface gigabitEthernet 0/1
- 4.Step 4: Disable CDP on this interface: SW1(config-if)# no cdp enable
- 5.Step 5: Exit interface configuration: SW1(config-if)# end
- 6.Step 6: Verify CDP status on the interface: SW1# show cdp interface gigabitEthernet 0/1
! SW1(config)# interface gigabitEthernet 0/1 SW1(config-if)# no cdp enable SW1(config-if)# end
Verify: SW1# show cdp interface gigabitEthernet 0/1 CDP is not enabled on this interface
Watch out: If you later issue `no cdp run` globally, it overrides per-interface settings and disables CDP everywhere. To re-enable CDP on an interface after global disable, you must first enable CDP globally with `cdp run`.
Troubleshooting with This Command
When troubleshooting CDP-related issues, the `no cdp run` command is typically used to disable CDP when it is causing problems. However, more often you will use `show cdp` commands to diagnose why CDP is not working. If CDP is disabled globally, you will see '% CDP is not enabled globally' when issuing `show cdp`.
This indicates that no CDP advertisements are sent or received. If you suspect CDP is causing excessive traffic or security issues, you can temporarily disable it with `no cdp run` and monitor the impact. After disabling, you can verify that CDP neighbor entries are cleared using `show cdp neighbors` (which will show no entries).
If you need to re-enable CDP, use `cdp run` in global configuration mode. Common symptoms that lead to disabling CDP include: high CPU utilization due to CDP processing on devices with many neighbors, security audits flagging CDP as a risk, or interoperability issues with non-Cisco devices that misinterpret CDP packets. When troubleshooting, always check the CDP status first: `show cdp` gives global status, `show cdp interface` shows per-interface status.
If CDP is enabled globally but not on a specific interface, use `show cdp interface [interface]` to verify. Another useful command is `debug cdp packets` to see CDP advertisements in real-time, but use with caution in production. If you disable CDP globally and later need to enable it on a specific interface, remember that global enable is required first.
The `no cdp run` command is also useful when migrating from CDP to LLDP; you can disable CDP globally and enable LLDP. Always document the change and verify with `show cdp` and `show lldp` accordingly.
CCNA Exam Tips
CCNA exam tip: 'no cdp run' disables CDP globally, while 'no cdp enable' disables it per interface. Know the difference.
CCNA exam tip: CDP is enabled by default on Cisco devices. You may need to disable it for security reasons in exam scenarios.
CCNA exam tip: After disabling CDP globally, you cannot enable it on individual interfaces; the global setting overrides.
CCNA exam tip: Use 'show cdp neighbors' to see neighbors; if CDP is disabled, the command returns no output.
Common Mistakes
Mistake 1: Using 'no cdp enable' instead of 'no cdp run' to disable globally — 'no cdp enable' only disables on the current interface.
Mistake 2: Forgetting to save the configuration after disabling CDP — the change is lost on reload if not saved.
Mistake 3: Assuming CDP is disabled because 'show cdp neighbors' shows nothing — CDP might be enabled but no neighbors discovered.
no cdp run vs cdp run
These two commands are direct opposites used to globally enable or disable Cisco Discovery Protocol (CDP). They are commonly confused because one is the negation of the other, and both affect CDP operation on all interfaces unless overridden by per-interface settings.
| Aspect | no cdp run | cdp run |
|---|---|---|
| Scope | Global: affects all interfaces | Global: affects all interfaces |
| Configuration mode | Global configuration | Global configuration |
| Persistence | Persists in running-config; saves to startup-config with 'write' | Persists in running-config; saves to startup-config with 'write' |
| Effect on interfaces | Disables CDP on all interfaces unless overridden by 'cdp enable' on specific interface | Enables CDP on all interfaces unless overridden by 'no cdp enable' on specific interface |
| Precedence | Overridden by per-interface 'cdp enable' | Overridden by per-interface 'no cdp enable' |
| Typical use | Security hardening to prevent device discovery | Network troubleshooting and topology discovery |
Use 'no cdp run' when you need to disable CDP globally for security reasons or to reduce unnecessary protocol traffic on networks with many non-Cisco devices.
Use 'cdp run' when you want to enable CDP globally to allow device discovery, gather neighbor information for troubleshooting, or support network management tools that rely on CDP.
Platform Notes
In Cisco IOS-XE, the `no cdp run` command behaves identically to classic IOS. The syntax and output are the same. In NX-OS (Cisco Nexus switches), CDP is also supported but the global command is `no cdp enable` (note: not `no cdp run`).
To disable CDP globally on NX-OS, use `no cdp enable` in global configuration mode. To verify, use `show cdp status`. In IOS-XR, CDP is not supported by default; instead, LLDP is used.
However, some IOS-XR platforms may support CDP via a specific feature license. The ASA (Adaptive Security Appliance) does not support CDP; it uses a proprietary protocol for neighbor discovery. Therefore, `no cdp run` is not applicable on ASA.
Across IOS versions (12.x, 15.x, 16.x), the command syntax and behavior are consistent. The command is available in all IOS versions that support CDP. Note that in some older IOS versions, the command might be `no cdp enable` globally?
No, that is per-interface. Always use `no cdp run` for global disable. The command is not available in IOS-XR by default.
For network engineers working in multi-platform environments, it's important to know these differences to apply the correct command.
Related Commands
cdp enable
Enables Cisco Discovery Protocol (CDP) on a specific interface to allow the device to advertise itself and discover neighboring Cisco devices.
cdp run
Enables Cisco Discovery Protocol (CDP) globally on the device to discover directly connected Cisco devices and gather information about them.
show cdp neighbors
Displays information about directly connected Cisco devices discovered via CDP (Cisco Discovery Protocol) including device IDs, local and remote interfaces, holdtime, device capabilities, and platform model.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions