Send Initials Protocol with airSlate SignNow

Send initials protocol

[Music] hello my name is bill Claunch and I'm with Palo Alto Networks in this video I'll discuss link layer discovery protocol or lldp I'll talk about what lldp is and how it's used I'll talk about how to configure a Palo Alto network firewall to participate in an lldp environment and then I'll show you how to verify that the firewall is sending and receiving lldp to and from directly connected neighbors what is lldp lldp is a vendor-neutral layer 2 discovery protocol used by network devices for advertising their identity capabilities and neighbors lldp is similar to cisco discovery protocol or CDP the big difference between the two is that lldp is an open standard while CDP is a cisco proprietary protocol lldp allows devices to send and receive lldp data units to and from neighbors receiving device stores the information in a mid or management information base which can be accessed using SNMP what does lldp look like first off lldp uses Ethernet type 0 X 88 CC and if we look at a packet capture we can see that information here each lldp data unit contains information about the sending device lldp uses attributes that contain a type length and value description these are called tlvs for type length value devices that support lldp use tlvs to send and receive information to their directly connected neighbors if we look at a packet capture from a firewall we can see examples of basic tlvs that are included in each lldp data unit that the firewall sends out some examples include the system name system description system capabilities and we'll come back to this one later because it can be helpful to determine how a firewall is deployed and management address how is lldp used each lldp enabled device will send out lldp data units to its directly connected neighbor each neighbor stores this information in the database and network administrators can use SNMP to query each device for details about what that device is and what it's connected to lldp can make troubleshooting easier on a Palo Alto Networks firewall especially for Vee wire deployments where the firewall would typically go undetected by ping or trace route the following tlvs are supported on palo alto network devices chassis ID port ID port description time to live end of L LD PDU system name system description system capabilities management address so let's take a look at how to configure lldp on a Palo Alto Networks firewall there are three basic steps to configuring lldp first enable lldp globally and this is done under network lldp second define at least one lldp profile this is done under network network profiles lldp profile and third assign the profile to one or more interfaces this is done under network interfaces Ethernet you edit the interface itself go to the Advanced tab and select lldp I'll walk through these steps with you now first we go to Network lldp and edit the lldp general section enable lldp you can make changes to the different default intervals but I'm going to leave these set to the defaults for now the next step is to define at least one lldp profile this is done under network network profiles lldp profile I'll click Add profile needs a name I'll use lldp one the mode determines whether the firewall will transmit and receive or transmit only or receive only for this example I'll set it to transmit and receive depending on your environment you might want to firewall only to send lldp from an interface or only receive lldp from other devices on that interface under the optional tlvs i can enable additional information that the firewall will send out in its lldp packets including the management address which i will add here give it a name select the interface and then enter the management IP address here the last step is to assign an lldp profile to an interface so we go to network interfaces and I'm going to select Ethernet 1/2 which is the internal interface of the V wire on this firewall and at the entry select the Advanced tab enable lldp and select the profile that I just defined click OK and then commit the changes if I want to see statistics about lldp I can do so under Network lldp under status I can see that this particular interface even at 1/2 is in fact sending lldp I can clear the statistics if I need to by highlighting the entry and using the clear lldp statistics button button down here at the bottom I can use the peers tab to see what other devices have been sending lldp information to the firewall in this case I've got two firewalls and one host running Linux with two interfaces that are both sending lldp I can use the more info link here to see details about those peers including interfaces system name system description etc now I'm going to take a look at a hose that is connected to the firewall also running lldp this is a linux host i'll use a command line tool called lldp CTL and i can see information being sent by this particular firewall including the management IP address the system name and the capabilities what's interesting here about the information in the capability section is that for a firewall running in l3 mode for an interface running in l3 mode the TLV would indicate router in this case router is off if the firewall interface is set to l2 mode the capability for bridge will be set to on and if the firewall is running in v wire mode as this firewall interface is the repeater capability is set to on so you can see how administrators could use this information from lldp to determine how devices are connected to one another and how a particular firewall running in v wire mode would be displayed in information set by lldp and now you know how to configure a Palo Alto Networks firewall to participate in an lldp environment