# LLDP (Link Layer Discovery Protocol) in VyOS > Configure LLDP in VyOS to automatically discover neighboring devices - view network topology, diagnose connections, and monitor L2 neighbors Source: https://opennix.org/en/docs/vyos/services/vyos-lldp/ LLDP (Link Layer Discovery Protocol) is a standard data-link layer protocol (IEEE 802.1AB) used to automatically discover neighboring network devices and exchange configuration information. LLDP allows network devices to advertise their identity, capabilities, and neighbors on the local network. ## Overview LLDP is used for: - **Automatic network topology discovery**: Determining how devices are physically connected - **Infrastructure documentation**: Automatically collecting information about neighboring devices - **Diagnostics**: Verifying that cables are connected correctly - **Monitoring**: Integration with monitoring systems to visualize topology - **Inventory**: Collecting information about models, software versions, and serial numbers ### How LLDP works LLDP works by transmitting special Ethernet frames (multicast) to the address `01:80:c2:00:00:0e`: 1. The device periodically sends LLDP packets on all active interfaces 2. Neighboring devices receive these packets and store the information 3. The information is retained for a specific period (TTL) 4. Devices also listen for LLDP packets from their neighbors ### Information transmitted LLDP can transmit the following types of data (TLVs - Type-Length-Value): - **Chassis ID**: Unique device identifier (MAC address, serial number) - **Port ID**: Port/interface identifier - **TTL**: Record lifetime (usually 120 seconds) - **System Name**: Device name (hostname) - **System Description**: System description (model, OS version) - **System Capabilities**: Device capabilities (router, switch, bridge) - **Management Address**: IP address for management - **Port Description**: Port description - **Port VLAN ID**: VLAN on the port (optional) - **Link Aggregation**: Link aggregation information (optional) ### LLDP vs CDP | Characteristic | LLDP | CDP (Cisco Discovery Protocol) | |----------------|------|--------------------------------| | Standard | IEEE 802.1AB (open) | Cisco proprietary | | Support | All vendors | Cisco only | | Multicast address | 01:80:c2:00:00:0e | 01:00:0c:cc:cc:cc | | Send interval | 30 seconds (default) | 60 seconds | | Recommendation | Preferred | For Cisco-only networks | ## Basic configuration ### Enabling LLDP ```bash # Enable LLDP globally set service lldp commit save ``` Once enabled, LLDP runs on all interfaces by default. ### Viewing LLDP neighbors ```bash # Show all neighbors show lldp neighbors # Detailed information about neighbors show lldp neighbors detail # Neighbors on a specific interface show lldp neighbors interface eth0 ``` Example output: ``` Interface Device ID Port ID Capability --------- --------- ------- ---------- eth0 switch-core-01 Gi1/0/1 Bridge,Router eth1 switch-access-02 Gi2/0/24 Bridge ``` ### Configuring LLDP parameters ```bash # Enable LLDP set service lldp # LLDP packet send interval (in seconds) set service lldp legacy-protocols cdp # Optional: for CDP compatibility # Management address (for accessing the device) set service lldp management-address 192.168.1.1 commit save ``` ## Advanced configuration ### Configuring LLDP on specific interfaces ```bash # Enable LLDP set service lldp # Disable LLDP on a specific interface set service lldp interface eth2 disable # Re-enable it (remove disable) delete service lldp interface eth2 disable commit save ``` ### Configuring a description for neighbors ```bash # Enable LLDP set service lldp # Set the location (physical placement) set service lldp snmp location "DataCenter-1, Rack-15, RU-42" commit save ``` ### Configuring legacy protocols (CDP) For compatibility with Cisco devices, you can enable CDP: ```bash # Enable LLDP with CDP support set service lldp set service lldp legacy-protocols cdp commit save ``` **Note**: CDP is a proprietary Cisco protocol, but VyOS can listen for CDP packets for compatibility. ### SNMP integration ```bash # Enable LLDP set service lldp # Set the SNMP location for LLDP set service lldp snmp location "Building-A, Floor-3, Room-301" # Enable SNMP to access the LLDP MIB set service snmp community public authorization ro set service snmp listen-address 0.0.0.0 commit save ``` The LLDP MIB (LLDP-MIB) is available via SNMP: - Base OID: `1.0.8802.1.1.2` - Local information: `1.0.8802.1.1.2.1.3` - Remote information: `1.0.8802.1.1.2.1.4` ## Configuration examples ### Example 1: Basic LLDP configuration ```bash # Enable LLDP on all interfaces set service lldp # Set the management address set service lldp management-address 192.168.1.1 # Set the location set service lldp snmp location "Main Office, Network Closet A" commit save ``` Verification: ```bash show lldp neighbors show lldp neighbors detail ``` ### Example 2: LLDP in an environment with Cisco devices ```bash # Enable LLDP with CDP compatibility set service lldp set service lldp legacy-protocols cdp # Management address set service lldp management-address 10.0.0.1 commit save ``` Verifying Cisco neighbors: ```bash show lldp neighbors # Or on the Cisco side: # show cdp neighbors ``` ### Example 3: Selectively enabling LLDP ```bash # Enable LLDP globally set service lldp # Disable on interfaces facing end users (security) set service lldp interface eth2 disable set service lldp interface eth3 disable # Keep it enabled on uplink interfaces (eth0, eth1) commit save ``` ### Example 4: LLDP for data center documentation ```bash # Enable LLDP set service lldp # Detailed location information set service lldp snmp location "DC1, Pod-3, Rack-15, RU-42, Row-G" # Management address set service lldp management-address 10.255.255.1 # SNMP for monitoring set service snmp community monitoring authorization ro set service snmp community monitoring network 10.0.0.0/8 commit save ``` ### Example 5: LLDP with automation (Ansible) VyOS configuration: ```bash # Enable LLDP set service lldp set service lldp management-address 192.168.1.1 commit save ``` Ansible playbook for collecting LLDP information: ```yaml - name: Collect LLDP information from VyOS routers hosts: vyos_routers gather_facts: no tasks: - name: Get LLDP neighbors vyos.vyos.vyos_command: commands: - show lldp neighbors detail register: lldp_output - name: Display LLDP neighbors debug: var: lldp_output.stdout_lines - name: Save to file copy: content: "{{ lldp_output.stdout[0] }}" dest: "./lldp_{{ inventory_hostname }}.txt" ``` ### Example 6: LLDP monitoring with LibreNMS VyOS configuration: ```bash # LLDP set service lldp set service lldp management-address 192.168.1.1 # SNMP for LibreNMS set service snmp community librenms authorization ro set service snmp community librenms network 192.168.1.0/24 set service snmp listen-address 0.0.0.0 commit save ``` LibreNMS automatically discovers LLDP neighbors and builds a topology map. ## Monitoring and diagnostics ### Viewing LLDP neighbors ```bash # All neighbors (brief format) show lldp neighbors # Detailed information about all neighbors show lldp neighbors detail # Neighbors on a specific interface show lldp neighbors interface eth0 # Information about a specific neighbor show lldp neighbors interface eth0 detail ``` ### Output examples **Brief format**: ``` Capability Codes: R - Router, B - Bridge, W - Wlan r - Repeater, S - Station D - Docsis, T - Telephone, O - Other Interface Local Remote Remote Capability Port ID Chassis ID Port ID --------- ------- -------------- ------------------- ---------- eth0 eth0 00:1b:21:d4:d0 GigabitEthernet1/0/1 B,R eth1 eth1 00:1b:21:d4:d1 GigabitEthernet2/0/5 B ``` **Detailed format**: ``` Interface: eth0 Chassis ID: 00:1b:21:d4:d0:00 System Name: switch-core-01 System Description: Cisco IOS Software, Version 15.2(4)E Port ID: GigabitEthernet1/0/1 Port Description: Uplink to VyOS Router Capability: Bridge, Router Management Address: 192.168.1.10 Time to Live: 120 seconds ``` ### Checking local information ```bash # Local LLDP information show lldp interface # Details for a local interface show lldp interface eth0 ``` ### Debugging LLDP ```bash # Check that the LLDP daemon is running show log | match lldp # Check the lldpd process ps aux | grep lldpd # Restart LLDP service (if needed) sudo systemctl restart lldpd # Service status sudo systemctl status lldpd ``` ### Monitoring LLDP packets ```bash # Capture LLDP packets on an interface sudo tcpdump -i eth0 -vv ether proto 0x88cc # Or using the multicast address sudo tcpdump -i eth0 ether dst 01:80:c2:00:00:0e ``` ### SNMP monitoring of LLDP ```bash # Retrieve LLDP information via SNMP snmpwalk -v2c -c public 192.168.1.1 LLDP-MIB::lldpRemTable # Local information snmpwalk -v2c -c public 192.168.1.1 LLDP-MIB::lldpLocPortTable # Remote devices snmpwalk -v2c -c public 192.168.1.1 LLDP-MIB::lldpRemChassisId ``` ## Troubleshooting ### Problem: LLDP neighbors are not discovered **Diagnosis**: ```bash # 1. Check that LLDP is enabled show configuration service lldp # 2. Check the interface (whether it is disabled) show configuration service lldp interface # 3. Check the interface status show interfaces # 4. Capture LLDP traffic sudo tcpdump -i eth0 ether proto 0x88cc # 5. Check the logs show log | match lldp ``` **Solution**: ```bash # Enable LLDP if it is disabled set service lldp # Make sure the interface is not disabled delete service lldp interface eth0 disable # Verify that the interface is up show interfaces ethernet eth0 commit save # Restart the LLDP daemon (if needed) sudo systemctl restart lldpd ``` ### Problem: LLDP works, but the required information is not transmitted **Cause**: Some information may not be transmitted by default. **Solution**: ```bash # Make sure the management address is set set service lldp management-address 192.168.1.1 # Set the location set service lldp snmp location "Building-A, Floor-2" commit save ``` ### Problem: LLDP does not work with Cisco devices **Cause**: Cisco may use CDP instead of LLDP. **Solution**: On VyOS: ```bash # Enable CDP compatibility set service lldp legacy-protocols cdp commit save ``` On Cisco: ``` # Enable LLDP (if not enabled) lldp run # On the interfaces interface GigabitEthernet1/0/1 lldp transmit lldp receive ``` ### Problem: LLDP neighbors appear and disappear **Cause**: The TTL (Time To Live) expires faster than new packets arrive. **Diagnosis**: ```bash # Check the TTL in the detailed information show lldp neighbors detail # Monitor disappearances watch -n 5 'show lldp neighbors' ``` **Solution**: The problem is usually on the neighbor's side. Check: - The LLDP packet send interval on the neighboring device - The CPU load on the neighboring device - Cable or port issues ### Problem: LLDP shows incorrect information **Cause**: Cached information from an old neighbor. **Solution**: ```bash # Restart LLDP to clear the cache sudo systemctl restart lldpd # Wait 30-60 seconds to receive new LLDP packets sleep 60 # Verification show lldp neighbors ``` ### Problem: SNMP does not return LLDP information **Diagnosis**: ```bash # Check the SNMP configuration show configuration service snmp # Test SNMP access snmpwalk -v2c -c public localhost SNMPv2-MIB::sysDescr # Check the LLDP MIB snmpwalk -v2c -c public localhost LLDP-MIB::lldpLocChassisId ``` **Solution**: ```bash # Make sure SNMP is enabled set service snmp community public authorization ro set service snmp listen-address 0.0.0.0 commit save # Restart SNMP sudo systemctl restart snmpd ``` ## Integration with monitoring systems ### LibreNMS LibreNMS automatically discovers and visualizes LLDP topology. **VyOS configuration**: ```bash set service lldp set service lldp management-address 192.168.1.1 set service snmp community librenms authorization ro set service snmp listen-address 0.0.0.0 commit save ``` **In LibreNMS**: 1. Add the device through the Web UI or CLI 2. LibreNMS automatically discovers LLDP neighbors 3. The topology map is built automatically (Map → Topology) ### Observium **VyOS configuration**: ```bash set service lldp set service lldp management-address 192.168.1.1 set service snmp community observium authorization ro set service snmp listen-address 0.0.0.0 commit save ``` Observium uses the LLDP MIB to build the network map. ### Zabbix **VyOS configuration**: ```bash set service lldp set service lldp management-address 192.168.1.1 set service snmp community zabbix authorization ro set service snmp v3 user zabbix auth type sha set service snmp v3 user zabbix auth plaintext-password 'AuthPassword123!' set service snmp v3 user zabbix privacy type aes set service snmp v3 user zabbix privacy plaintext-password 'PrivPassword123!' commit save ``` The Zabbix template for LLDP monitoring uses SNMP discovery to automatically discover neighbors. ### Netbox Netbox can import LLDP data via the API or scripts. **Script for exporting LLDP to JSON**: ```bash #!/bin/bash # Retrieve LLDP neighbors in JSON format vtysh -c "show lldp neighbors detail json" > /tmp/lldp_neighbors.json # Send to Netbox via the API curl -X POST https://netbox.example.com/api/dcim/cables/ \ -H "Authorization: Token YOUR_TOKEN" \ -H "Content-Type: application/json" \ -d @/tmp/lldp_neighbors.json ``` ### Grafana + Prometheus LLDP data can be exported via an SNMP exporter for Prometheus. **Prometheus SNMP exporter config**: ```yaml modules: lldp: walk: - 1.0.8802.1.1.2 # LLDP-MIB metrics: - name: lldpRemSysName oid: 1.0.8802.1.1.2.1.4.1.1.9 type: DisplayString ``` ## Best practices ### 1. Always enable LLDP Enable LLDP on all network devices for automatic documentation: ```bash set service lldp set service lldp management-address ``` ### 2. Set an informative location Use a detailed description of the physical placement: ```bash set service lldp snmp location "DC-Moscow, Building-2, Floor-3, Rack-A15, RU-42" ``` ### 3. Disable LLDP on untrusted interfaces Disable LLDP on ports accessible to end users (security): ```bash set service lldp interface eth2 disable # User-facing port set service lldp interface eth3 disable # Guest network ``` ### 4. CDP compatibility for mixed environments In networks with Cisco equipment, enable CDP: ```bash set service lldp legacy-protocols cdp ``` ### 5. SNMP integration for monitoring Always configure SNMP to access the LLDP MIB: ```bash set service snmp community monitoring authorization ro ``` ### 6. Regularly check the topology Periodically check LLDP neighbors to detect changes: ```bash show lldp neighbors ``` Use automation (Ansible, Python) for regular audits. ### 7. Documentation through interface descriptions Use interface descriptions together with LLDP: ```bash set interfaces ethernet eth0 description "Uplink to switch-core-01 Gi1/0/1" ``` ### 8. Monitoring topology changes Configure alerts on LLDP neighbor changes in your monitoring systems to detect: - Unauthorized connections - Equipment replacement - Cable issues ### 9. Using a management VLAN Configure the management address from a dedicated management VLAN: ```bash set interfaces ethernet eth0 vif 99 address 10.255.255.1/24 set service lldp management-address 10.255.255.1 ``` ### 10. Backing up LLDP data Periodically save the LLDP output for documentation: ```bash show lldp neighbors detail > /config/lldp-backup-$(date +%Y%m%d).txt ``` ## Useful commands ```bash # Show all LLDP neighbors show lldp neighbors # Detailed information show lldp neighbors detail # Neighbors on a specific interface show lldp neighbors interface eth0 # Local LLDP information show lldp interface # LLDP configuration show configuration service lldp # LLDP logs show log | match lldp # Capture LLDP packets sudo tcpdump -i eth0 ether proto 0x88cc # SNMP query for LLDP data snmpwalk -v2c -c public localhost LLDP-MIB::lldpRemTable # LLDP daemon status sudo systemctl status lldpd # Restart LLDP sudo systemctl restart lldpd # Save LLDP information to a file show lldp neighbors detail > /tmp/lldp-neighbors.txt ``` ## Integration with automation ### Python script for collecting LLDP data ```python #!/usr/bin/env python3 import subprocess import json import re def get_lldp_neighbors(): """Retrieve LLDP neighbors from a VyOS router""" try: # Run the command via SSH or locally result = subprocess.run( ['vtysh', '-c', 'show lldp neighbors detail'], capture_output=True, text=True ) # Parse the output neighbors = [] current = {} for line in result.stdout.splitlines(): if line.startswith('Interface:'): if current: neighbors.append(current) current = {'interface': line.split(':')[1].strip()} elif 'System Name:' in line: current['system_name'] = line.split(':')[1].strip() elif 'Port ID:' in line: current['port_id'] = line.split(':')[1].strip() elif 'Management Address:' in line: current['mgmt_address'] = line.split(':')[1].strip() if current: neighbors.append(current) return neighbors except Exception as e: print(f"Error: {e}") return [] if __name__ == '__main__': neighbors = get_lldp_neighbors() print(json.dumps(neighbors, indent=2)) ``` ### Ansible playbook for LLDP auditing ```yaml - name: LLDP Topology Audit hosts: vyos_routers gather_facts: no tasks: - name: Collect LLDP neighbors vyos.vyos.vyos_command: commands: - show lldp neighbors detail register: lldp_data - name: Parse and validate topology set_fact: lldp_neighbors: "{{ lldp_data.stdout[0] | parse_lldp }}" - name: Check for unexpected neighbors debug: msg: "WARNING: Unexpected neighbor detected!" when: "'unknown' in lldp_neighbors" - name: Generate topology report template: src: topology_report.j2 dest: "./reports/{{ inventory_hostname }}_lldp.html" ``` ## Conclusion LLDP (Link Layer Discovery Protocol) is an important tool for automatically discovering and documenting network topology. VyOS provides full LLDP support with additional compatibility for Cisco CDP. Key benefits of LLDP: - Automatic discovery of neighboring devices - A standardized protocol (IEEE 802.1AB) - Integration with monitoring systems via SNMP - Simplified infrastructure documentation - Diagnostics of connection problems Recommendations for production: - Enable LLDP on all network devices - Disable LLDP on untrusted ports for security - Use detailed location descriptions - Integrate with monitoring systems (LibreNMS, Zabbix, Observium) - Regularly audit the topology using LLDP data - Document changes in the topology LLDP in VyOS provides reliable topology discovery and integrates with all modern monitoring systems, making network infrastructure management more efficient.