Solved

Cisco: vlan access port configured with switchport mode dynamic desirable

Posted on 2013-06-28
3
955 Views
Last Modified: 2013-07-01
Can someone tell me why a port on a switch would be configured with:

interface FastEthernet 0/12
switchport access vlan 10
switchport mode dynamic desirable
end


I'm asking this because the "switchport mode dynamic desirable" is considered a security vulnerability in our scans, and I'm wondering what the risk is of removing the "switchport mode dynamic desirable" would be?

Thank you,
Dave
0
Comment
Question by:dsterling
3 Comments
 
LVL 50

Assisted Solution

by:Don Johnston
Don Johnston earned 166 total points
ID: 39286687
With the port configured as "dynamic desirable", the port will become a trunk if it can successfully negotiate with another device that is running DTP.  This is done so when a switch is connected to the port, it automatically becomes a switch. Which means that other device (usually a switch but not necessarily) would be able to communicate with all VLANs. So if it's NOT a switch, then you've just provided that device access to all your VLANs.

Forcing the port to access mode is a best practice on ports that are not connected to other switches and supposed to be trunk links.

So configuring the port with "switchport mode access" would be prudent... Unless you want it to be a trunk.
0
 
LVL 45

Accepted Solution

by:
Craig Beck earned 167 total points
ID: 39288301
Further to what donjohnston said, if you really don't want DTP on that port (or your security scan still flags it as a risk) you should use the nonegotiate command to disable DTP on that port...

interface FastEthernet 0/12
switchport access vlan 10
switchport nonegotiate
end
0
 
LVL 18

Assisted Solution

by:Akinsd
Akinsd earned 167 total points
ID: 39288723
To answer your questions.

Can someone tell me why a port on a switch would be configured with:

interface FastEthernet 0/12
switchport access vlan 10
switchport mode dynamic desirable
end

The ports were probably never fully configured aside from assigning vlans to them
All switches (at least Cisco) are configured to dynamic desirable by default. Cisco intended to make the switches usable out of the box especially for less experienced engineers.

I'm wondering what the risk is of removing the "switchport mode dynamic desirable" would be?

There is no risk removing it. It is actually safer and best practice to configure all designated ports as access ports and shutdown all unused ports.
0

Featured Post

Announcing the Most Valuable Experts of 2016

MVEs are more concerned with the satisfaction of those they help than with the considerable points they can earn. They are the types of people you feel privileged to call colleagues. Join us in honoring this amazing group of Experts.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Netgear switch to Cisco switch VLAN not passing traffic 8 52
LLDP and CDP neighbors on HP Procurve switches 3 31
managing a small network 6 86
Cisco Policy based routing 2 42
Problem Description:   Couple of months ago we upgraded the ADSL line at our branch office from Home to Business line. The purpose of transforming the service to have static public IP’s. We were in need for public IP’s to publish our web resour…
Tired of waiting for your show or movie to load?  Are buffering issues a constant problem with your internet connection?  Check this article out to see if these simple adjustments are the solution for you.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

825 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question