LLDP Security

[ITGURU]

As part of security with having LLDP enabled on switches for fluke testers to pick up switch port/location/name etc, is there any way that it can be secured by setting only authorised IP addresses, so that just not any old person could plug in and obtain the information, but a tester programmed with a static authorised IP can?

 

[Chris_Cook]

Probably not as its a layer 2 broadcast packet. There's no IP addresses involved.

 

You might be able to limit what data is broadcast, but I'm not sure if any switches actually support that. You might be able to have the switch name or location, but not its IP address.

 

Probably the next best solution is to have really tight documentation and port labelling. Maybe have labels on the cable or behind the desktop socket as well in case kids pick them off.

 

If the switches are secure then it should be a reasonably low risk. You could look at maybe firewalling the management interface of the switches so a bad actor can't access the switch even if they know the name/IP

[Davit2005]

I don't think there is a way. You could always enable lldp tx on edge ports when needed. As others have said if you have restricted management access, only allow SNMPv3 and use ssh/https (and not http/telnet you should be OK).

 

Don't forget not to use untagged uplinks for client data either 🙂

 

 

Edited May 20, 2025 by Davit2005