What is the effect if a Cisco router is transmitting PDUs to an ISP?

Question

I was recently tipped off by our ISP that our router is transmitting PDUs to their switch, and told that if we don't turn it off they might be able to penetrate our LAN. What do they mean that we are transmitting PDUs? If we do turn off the PDUs transmission, won't it affect any services that the router transmits?

Answer 1

I think what they mean is BPDUs, or Bridge Protocol Data Units, not PDUs. PDUs are just Protocol Data Units, ie layer 2 frames or layer 3 packets. The ISP seeing BPDUs means that the interface that connects to your ISP is likely set as a trunk port, and it is transmitting more than one VLAN's frames to it. If this is an actual router it won't do this unless you've configured more than one subinterface and you are tagging the packets with those vlans, but I think it is more likely you are using a switch not a router. If that's the case you need to ensure that the interface is not set as a trunk, or dynamic (the default). Do a "show run int " to see. If you see no switchport mode statement then it is set to dynamic, if it says switchport trunk then it's a trunk. I think it's probably set to dynamic in which case you need to change it to mode access:

1. Arrange for an outage, and get your ISP involved in case you need some help from them. Make sure you have a console connection to the device available in case you lose connectivity. Don't do this without having a console connection! During the outage:
2. do a "copy run start" and then copy the running config to a notepad
3. Set the port to switchport mode access conf t interface shut switchport mode access no shut
4. ping across the connection, and ensure you have internet access. If not check the config to make sure the change took
5. Have the ISP confirm that they no longer see BPDUs
6. If there are no more BPDUs and internet access works then "copy run start" and monitor for awhile. Then go home.