> ## Content Index > Fetch the complete content index at: https://www.pinglabz.com/llms.txt > Use this file to discover other available public pages before exploring further. # How to Check CDP Neighbors on Cisco ASA - URL: https://www.pinglabz.com/how-to-check-cdp-neighbors-on-cisco-asa/ - Published: 2024-12-23T06:39:31.000Z - Updated: 2026-08-22T18:15:06.000Z - Description: The Cisco ASA does not run CDP. Here is why, how to find the ASA from the connected switch with CDP, LLDP and the MAC table, and what to run on the ASA itself. - Author: Jaime - Tags: Fundamentals, ASA, #Import 2026-08-01 19:54 Here is the short version: the Cisco ASA does not run Cisco Discovery Protocol. There is no `cdp run` command, no `show cdp neighbors`, and nothing to enable. If you came here to turn on CDP and read a neighbor table on the firewall itself, that feature has never existed on the ASA platform, and any guide that shows `ciscoasa# show cdp` output is showing you something the box cannot produce. That is not a dead end though. You almost always want the ASA's neighbors for the same reasons you want anyone's: to confirm what is plugged into which port and to map the topology. You can get all of that, you just collect it from the switch the ASA is connected to, and from Layer 2 and Layer 3 on the ASA itself. This guide shows both, with real output from a lab ASAv 9.24 wired to a Cisco switch and router. If you want the bigger picture first, the [Cisco ASA complete guide](https://www.pinglabz.com/cisco-asa/) covers the architecture this article plugs into. ## Why the ASA has no CDP CDP is a Cisco proprietary Layer 2 protocol that IOS and NX-OS devices use to advertise themselves to directly connected neighbors: device ID, platform, port, IP, IOS version. Switches and routers run it by default. The ASA does not, and it is not a setting you have missed. The firewall's job is to be a security boundary, and a security appliance that broadcasts its model, software version, and management IP onto every connected segment would be handing that inventory to anything on the wire. So Cisco never put a CDP agent in the ASA data plane. The same reasoning is why the ASA also does not run LLDP in the general case. Practically, that means three things: the ASA never appears in a neighbor's `show cdp neighbors` output, the ASA cannot show you its own neighbors with CDP, and you discover the ASA the way you discover any non-CDP device, by its MAC address, its IP, and the switch port it lands on. ## See the ASA from the connected switch This is the method that actually answers "where is my ASA and what is it plugged into." Run it on the switch, not the firewall. In the lab, the ASA's inside interface (Gi0/0, 10.10.10.254) lands on switch port Ethernet0/0, and a router R1 sits on Ethernet0/1. Start with CDP on the switch: ``` SW1# show cdp neighbors Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone, D - Remote, C - CVTA, M - Two-port Mac Relay Device ID Local Intrfce Holdtme Capability Platform Port ID R1 Eth 0/1 151 R Linux Uni Eth 0/0 Total cdp entries displayed : 1 ``` Note what is missing. The router on Et0/1 shows up. The ASA on Et0/0 does not, even though it is up and passing traffic, because it never sent a CDP advertisement. LLDP on the switch tells the same story: it lists the router and stays silent about the firewall. So how do you confirm the ASA is on Et0/0? By MAC. The switch learns the ASA's MAC address the moment the firewall forwards a frame, CDP or no CDP: ``` SW1# show mac address-table Mac Address Table ------------------------------------------- Vlan Mac Address Type Ports ---- ----------- -------- ----- 1 5254.005e.8015 DYNAMIC Et0/0 1 aabb.cc00.0c00 DYNAMIC Et0/1 Total Mac Addresses for this criterion: 2 ``` There it is: `5254.005e.8015` on Ethernet0/0 is the ASA. Cross-check that MAC against the ASA's own `show interface` output (the inside interface's hardware address) and you have positively identified the port without any discovery protocol. This is the workflow: CDP and LLDP give you the easy Cisco-to-Cisco neighbors, and the MAC address table plus ARP fills in everything that does not speak them, the ASA included. ## Confirm the ASA from a neighbor router A router on the same segment sees the ASA at Layer 3 even though it cannot see it at CDP. From R1, a ping populates ARP, and ARP gives you the ASA's IP-to-MAC mapping: ``` R1# ping 10.10.10.254 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.10.10.254, timeout is 2 seconds: .!!!! Success rate is 80 percent (4/5), round-trip min/avg/max = 2/3/4 ms R1# show arp Protocol Address Age (min) Hardware Addr Type Interface Internet 10.10.10.1 - aabb.cc00.0c00 ARPA Ethernet0/0 Internet 10.10.10.254 0 5254.005e.8015 ARPA Ethernet0/0 ``` The first ICMP drops while ARP resolves, then the ASA answers. The ARP entry, 10.10.10.254 at `5254.005e.8015`, matches the MAC the switch learned on Et0/0\. And for completeness, R1's own `show cdp neighbors` lists only the switch, never the firewall, exactly as expected. ## What to run on the ASA itself You cannot ask the ASA for its neighbors, but you can ask it what it is connected to and how. These are the commands that replace `show cdp neighbors` when you are logged into the firewall: - `show interface ip brief` \- every interface, its IP, and line/protocol status, so you know which interfaces are actually up. - `show interface` \- per-interface detail including the hardware (MAC) address you cross-reference against the switch's MAC table. - `show arp` \- the ASA's own IP-to-MAC table for each segment, the closest thing to a neighbor list the firewall keeps. - `show nameif` \- maps physical interfaces to their security names (inside, outside, dmz) so the topology makes sense. - `show route` \- the next-hop routers the ASA forwards to, which is the Layer 3 version of "who is my neighbor." Between those five, you can reconstruct everything CDP would have told you: which ports are live, what is on them by MAC and IP, and where traffic goes next. It is a few more commands than a single neighbor table, but it is the honest answer, and it works. ## Key takeaways - The ASA does not support CDP. There is nothing to enable, and `show cdp neighbors` does not exist on the platform. The ASA also does not run LLDP in the general case. - To find the ASA and map its connections, run discovery on the connected switch: `show cdp neighbors` and `show lldp neighbors` for the Cisco neighbors, then `show mac address-table` to locate the ASA by MAC. - A neighbor router identifies the ASA at Layer 3 with `ping` plus `show arp`, matching the ASA's MAC to the switch port. - On the ASA itself, use `show interface ip brief`, `show interface`, `show arp`, `show nameif`, and `show route` to see interfaces, addresses, and next hops.