Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

Cisco: vlan access port configured with switchport mode dynamic desirable

Posted on 2013-06-28
3
Medium Priority
?
1,073 Views
Last Modified: 2013-07-01
Can someone tell me why a port on a switch would be configured with:

interface FastEthernet 0/12
switchport access vlan 10
switchport mode dynamic desirable
end


I'm asking this because the "switchport mode dynamic desirable" is considered a security vulnerability in our scans, and I'm wondering what the risk is of removing the "switchport mode dynamic desirable" would be?

Thank you,
Dave
0
Comment
Question by:dsterling
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
3 Comments
 
LVL 50

Assisted Solution

by:Don Johnston
Don Johnston earned 664 total points
ID: 39286687
With the port configured as "dynamic desirable", the port will become a trunk if it can successfully negotiate with another device that is running DTP.  This is done so when a switch is connected to the port, it automatically becomes a switch. Which means that other device (usually a switch but not necessarily) would be able to communicate with all VLANs. So if it's NOT a switch, then you've just provided that device access to all your VLANs.

Forcing the port to access mode is a best practice on ports that are not connected to other switches and supposed to be trunk links.

So configuring the port with "switchport mode access" would be prudent... Unless you want it to be a trunk.
0
 
LVL 47

Accepted Solution

by:
Craig Beck earned 668 total points
ID: 39288301
Further to what donjohnston said, if you really don't want DTP on that port (or your security scan still flags it as a risk) you should use the nonegotiate command to disable DTP on that port...

interface FastEthernet 0/12
switchport access vlan 10
switchport nonegotiate
end
0
 
LVL 18

Assisted Solution

by:Akinsd
Akinsd earned 668 total points
ID: 39288723
To answer your questions.

Can someone tell me why a port on a switch would be configured with:

interface FastEthernet 0/12
switchport access vlan 10
switchport mode dynamic desirable
end

The ports were probably never fully configured aside from assigning vlans to them
All switches (at least Cisco) are configured to dynamic desirable by default. Cisco intended to make the switches usable out of the box especially for less experienced engineers.

I'm wondering what the risk is of removing the "switchport mode dynamic desirable" would be?

There is no risk removing it. It is actually safer and best practice to configure all designated ports as access ports and shutdown all unused ports.
0

Featured Post

NEW Veeam Agent for Microsoft Windows

Backup and recover physical and cloud-based servers and workstations, as well as endpoint devices that belong to remote users. Avoid downtime and data loss quickly and easily for Windows-based physical or public cloud-based workloads!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Creating an OSPF network that automatically (dynamically) reroutes network traffic over other connections to prevent network downtime.
In the world of WAN, QoS is a pretty important topic for most, if not all, networks. Some WAN technologies have QoS mechanisms built in, but others, such as some L2 WAN's, don't have QoS control in the provider cloud.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

610 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question