Here is the short version: the Cisco ASA does not run Cisco Discovery Protocol. There is no cdp run command, no show cdp neighbors, and nothing to enable. If you came here to turn on CDP and read a neighbor table on the firewall itself, that feature has never existed on the ASA platform, and any guide that shows ciscoasa# show cdp output is showing you something the box cannot produce.
That is not a dead end though. You almost always want the ASA's neighbors for the same reasons you want anyone's: to confirm what is plugged into which port and to map the topology. You can get all of that, you just collect it from the switch the ASA is connected to, and from Layer 2 and Layer 3 on the ASA itself. This guide shows both, with real output from a lab ASAv 9.24 wired to a Cisco switch and router.
If you want the bigger picture first, the Cisco ASA complete guide covers the architecture this article plugs into.
Why the ASA has no CDP
CDP is a Cisco proprietary Layer 2 protocol that IOS and NX-OS devices use to advertise themselves to directly connected neighbors: device ID, platform, port, IP, IOS version. Switches and routers run it by default. The ASA does not, and it is not a setting you have missed. The firewall's job is to be a security boundary, and a security appliance that broadcasts its model, software version, and management IP onto every connected segment would be handing that inventory to anything on the wire. So Cisco never put a CDP agent in the ASA data plane. The same reasoning is why the ASA also does not run LLDP in the general case.
Practically, that means three things: the ASA never appears in a neighbor's show cdp neighbors output, the ASA cannot show you its own neighbors with CDP, and you discover the ASA the way you discover any non-CDP device, by its MAC address, its IP, and the switch port it lands on.
See the ASA from the connected switch
This is the method that actually answers "where is my ASA and what is it plugged into." Run it on the switch, not the firewall. In the lab, the ASA's inside interface (Gi0/0, 10.10.10.254) lands on switch port Ethernet0/0, and a router R1 sits on Ethernet0/1.
Start with CDP on the switch:
SW1# show cdp neighbors
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone,
D - Remote, C - CVTA, M - Two-port Mac Relay
Device ID Local Intrfce Holdtme Capability Platform Port ID
R1 Eth 0/1 151 R Linux Uni Eth 0/0
Total cdp entries displayed : 1Note what is missing. The router on Et0/1 shows up. The ASA on Et0/0 does not, even though it is up and passing traffic, because it never sent a CDP advertisement. LLDP on the switch tells the same story: it lists the router and stays silent about the firewall.
So how do you confirm the ASA is on Et0/0? By MAC. The switch learns the ASA's MAC address the moment the firewall forwards a frame, CDP or no CDP:
SW1# show mac address-table
Mac Address Table
-------------------------------------------
Vlan Mac Address Type Ports
---- ----------- -------- -----
1 5254.005e.8015 DYNAMIC Et0/0
1 aabb.cc00.0c00 DYNAMIC Et0/1
Total Mac Addresses for this criterion: 2There it is: 5254.005e.8015 on Ethernet0/0 is the ASA. Cross-check that MAC against the ASA's own show interface output (the inside interface's hardware address) and you have positively identified the port without any discovery protocol. This is the workflow: CDP and LLDP give you the easy Cisco-to-Cisco neighbors, and the MAC address table plus ARP fills in everything that does not speak them, the ASA included.
Confirm the ASA from a neighbor router
A router on the same segment sees the ASA at Layer 3 even though it cannot see it at CDP. From R1, a ping populates ARP, and ARP gives you the ASA's IP-to-MAC mapping:
R1# ping 10.10.10.254
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.10.254, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 2/3/4 ms
R1# show arp
Protocol Address Age (min) Hardware Addr Type Interface
Internet 10.10.10.1 - aabb.cc00.0c00 ARPA Ethernet0/0
Internet 10.10.10.254 0 5254.005e.8015 ARPA Ethernet0/0The first ICMP drops while ARP resolves, then the ASA answers. The ARP entry, 10.10.10.254 at 5254.005e.8015, matches the MAC the switch learned on Et0/0. And for completeness, R1's own show cdp neighbors lists only the switch, never the firewall, exactly as expected.
What to run on the ASA itself
You cannot ask the ASA for its neighbors, but you can ask it what it is connected to and how. These are the commands that replace show cdp neighbors when you are logged into the firewall:
show interface ip brief- every interface, its IP, and line/protocol status, so you know which interfaces are actually up.show interface- per-interface detail including the hardware (MAC) address you cross-reference against the switch's MAC table.show arp- the ASA's own IP-to-MAC table for each segment, the closest thing to a neighbor list the firewall keeps.show nameif- maps physical interfaces to their security names (inside, outside, dmz) so the topology makes sense.show route- the next-hop routers the ASA forwards to, which is the Layer 3 version of "who is my neighbor."
Between those five, you can reconstruct everything CDP would have told you: which ports are live, what is on them by MAC and IP, and where traffic goes next. It is a few more commands than a single neighbor table, but it is the honest answer, and it works.
Key takeaways
- The ASA does not support CDP. There is nothing to enable, and
show cdp neighborsdoes not exist on the platform. The ASA also does not run LLDP in the general case. - To find the ASA and map its connections, run discovery on the connected switch:
show cdp neighborsandshow lldp neighborsfor the Cisco neighbors, thenshow mac address-tableto locate the ASA by MAC. - A neighbor router identifies the ASA at Layer 3 with
pingplusshow arp, matching the ASA's MAC to the switch port. - On the ASA itself, use
show interface ip brief,show interface,show arp,show nameif, andshow routeto see interfaces, addresses, and next hops.