Cisco CDP – Is Dot1q Native Tagging Required?

cdpvlan

The only way the router could receive CDP advertisements over a switch trunk, was by creating a sub-interface on the router with "encapsulation dot1Q 1 native" configured. If this sub-if was disabled advertisements were not processed and show neighbors displayed nothing. There are multiple sub-ifs in the up up state, but know of these sub-ifs would process the cdp advertisement. Only the dot1q native sub-if will. The question(s) are
Will cdp only send an advertisement encapsulated in non tagged Ethernet frames?
Does cdp require native vlans to be configured on every device?

Best Answer

CDP frames can be sent tagged or untagged. I think it is better for you to read directly from the linked CIsco tech note that explains the behavior pretty well and is specifically written for your scenario - a switch sending traffic to a router using sub-interfaces.

https://www.cisco.com/c/en/us/support/docs/network-management/discovery-protocol-cdp/118736-technote-cdp-00.html

To summarize though, in order to satisfy the Stack Exchange requirement for post,

Important

The behavior of CDP can be very different depending on which software platform (IOS, IOS-XE, IOS-XR, NX-OS etc ..) you are running. The Cisco document linked above is for general purpose routers and switches running IOS.

Summary

Common behavior for both types of devices (switches and routers) is that CDP always chooses the lowest VLAN to send CDP packets. Whether it is tagged depends on configuration on either devices.

Switches always use VLAN 1 to send CDP packets since VLAN 1 can not be removed from the VLAN database. If you have not changed the native VLAN for that trunk port then the CDP packet will be sent untagged. If you have changed the native VLAN on the trunk port then the switch will send the CDP packets tagged on VLAN 1.

Routers will use the lowest VLAN configured on a sub-interface (that is in the Up state) to send the CDP packets with the following exception. If there is no sub-interface for VLAN 1 the router will use the primary interface to send CDP packets. It uses the main interface since it is in VLAN 1 by default and VLAN 1 is considered the native VLAN on the router.

R1#show run | section interface GigabitEthernet0/0
interface GigabitEthernet0/0
 no ip address
 duplex auto
 speed auto
interface GigabitEthernet0/0.10
 encapsulation dot1Q 10
interface GigabitEthernet0/0.20
 encapsulation dot1Q 20

R1#show int gi0/0    
GigabitEthernet0/0 is up, line protocol is up 
  Hardware is CN Gigabit Ethernet, address is 8843.e1e3.c460 (bia 8843.e1e3.c460)
  MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec, reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation 802.1Q Virtual LAN, Vlan ID  1., loopback not set

The CDP packets in this default situation are sent untagged.

Changes and Affects

  1. If you create a sub-interface for VLAN 1 on the router and then shut it down the router will send the CDP packets on the next lowest VLAN - they will be tagged since the native VLAN on the router is still VLAN 1. The switch will receive the CDP packets from the router but because you disabled the router's VLAN 1 sub-interface, the router will drop the incoming CDP packets since the interface it sends all untagged frames to is shut down.

  2. If you then change the native VLAN on the router from VLAN 1 to the lowest VLAN sub-interface, the CDP packets sent by the router would be expected to be untagged but this is incorrect - they will still be tagged. Whether this is a design feature or a bug in the IOS, a router will send CDP packets tagged from a sub-interface if it is configured with any VLAN that is not 1, even if you have configured the VLAN as native. The router will receive the untagged CDP packets coming from the switch though, since there is now a configured sub-interface in the up state that is set as the native VLAN. From a Security standpoint you would not want to change the native VLAN on a router to be a sub-interface used for data traffic. You could create one just for CDP but I do not see the benefit of moving CDP off of VLAN 1 on the router.

A few points to remember.

  • CDP is not a negotiated protocol. It sends a CDP packets out all interfaces that are in the Up state at a periodic interval (60 seconds by default)
  • For any physical interface it doesn't care if it receives CDP packets on one VLAN and sends out CDP packets on another.
  • There is a difference between control traffic and data traffic. If you have switchport trunk allowed vlan 10,20 configured on a trunk switchport and have not changed the native VLAN from the default of 1, the switch is still going to send out CDP as untagged frames on that trunk because CDP is control plane traffic (not affected by the allowed list) and always sent on VLAN 1 from a switch. No data traffic will ever be sent untagged out this switchport.

Fixing your issue

  1. Determine if your switch is sending tagged or untagged CDP packets to your router (did you change the native VLAN on the trunk?).
  2. Are you blocking the incoming CDP traffic on your router because you created a sub-interface in VLAN 1 and shut it down, or do not have a sub-interface with the same VLAN as the incoming tagged CDP packets.

In your case it is because someone created a sub-interface on the router for VLAN 1 and shut it down, probably because they though it would make the network more secure - it doesn't. You should always have a manually configured VLAN allowed list on a switch trunk port when the connected device is a router (without the native VLAN 1 in that allowed list).