Overview
Automatic port configuration classifies each switch interface on a Virtual Edge Node as a User Network Interface (UNI) or a Network-to-Network Interface (NNI). When a Cisco Discovery Protocol (CDP) or Link Layer Discovery Protocol (LLDP) neighbor on a port advertises switch or router capability, the port is classified as NNI and Endpoint Discovery and Flow Telemetry are disabled on it. Devices behind an unmanaged or unauthorized switch on that port are then not discovered, and policy is not applied to them.
Access Port Discovery Protection keeps interfaces configured in access mode classified as UNI when a downstream switch is detected, so device discovery, flow collection, and policy enforcement continue on those ports. Interfaces in trunk mode are not affected and follow standard classification.
The setting is off by default and takes effect on Cisco, Aruba CX, and Arista switch Virtual Edge Nodes. Configure it for all Virtual Edge Nodes in Edge Settings, or for an individual node in its configuration.
For the full set of rules that determine UNI and NNI classification, see Criteria for Automatic Port Configuration in Onboarding Cisco Switches as Virtual Edge Nodes.
Prerequisites
- A Cisco, Aruba CX, or Arista switch onboarded as a Virtual Edge Node, or ready to be onboarded.
- Access ports configured in access mode on the switch.
- Administrator access to Cloud Control Center.
How Access Port Discovery Protection Classifies Interfaces
The following table lists what qualifies an interface as access mode on each platform, and the neighbor capabilities that classify a port as NNI when the setting is off.
| Switch Platform | Interface Treated as Access Mode | Neighbor Capabilities That Trigger NNI |
|---|---|---|
| Cisco | The interface configuration does not contain switchport mode trunk. |
Router, Switch (Bridge for LLDP), or IGMP |
| Aruba CX | The interface Mode is access in the show interface brief output. |
Router or Switch |
| Arista | The interface is a bridged access port, neither trunk nor routed. | Router, Bridge, or IGMP |
The following conditions continue to apply to access-mode interfaces when the setting is on:
- Other NNI rules — An interface that matches a Disable Discovery and Telemetry description keyword, belongs to a VRF, is administratively shut down, or is a Cisco FortyGigabit or HundredGigabit interface is classified as NNI. The Source column shows the matching condition instead of Access Mode.
- Port-channels — On Cisco and Arista, a port-channel is evaluated on its own configured mode, so a port-channel not configured as a trunk stays UNI. On Aruba CX, LAG interfaces and their members stay NNI regardless of the setting.
- Wireless access points — On Cisco and Arista, a wireless access point neighbor keeps the port UNI. On Aruba CX, a wireless access point neighbor classifies the port as NNI regardless of the setting.
- Manual configuration — Interfaces in manual configuration on the Endpoint Discovery or Flow Telemetry tab keep their manual setting, which overrides automatic classification.
Important: On Cisco switches, a port with no explicit switchport mode line that has negotiated a trunk is treated as access mode. Configure port modes explicitly with switchport mode access or switchport mode trunk so that classification matches the intended role of each port.
Enabling Access Port Discovery Protection for All Virtual Edge Nodes
The global setting applies to every Virtual Edge Node and becomes the default for nodes added later.
Step 1. Open Edge Settings
Navigate to Edge Management > Edge Settings and select the Advanced Settings tab.
Step 2. Turn on the setting
In the Interface Auto-Detection section, below the Enable Discovery and Telemetry and Disable Discovery and Telemetry keyword fields, turn on Access Port Discovery Protection.
Step 3. Save and confirm the change
Click Save Changes. The Update all Virtual Edge Nodes? dialog states: "Access Port Discovery Protection will be enabled on every Virtual Edge Node, now and in the future. Individual Nodes can be changed later in their VEN settings."
Click Enable On All Nodes to apply the setting. The change overwrites the value on every Virtual Edge Node, including nodes configured individually. To use a different value on a specific node, change it afterward in that node's configuration.
Configuring Access Port Discovery Protection for a Virtual Edge Node
The setting is available for switch Virtual Edge Nodes, including switches with the aggregation role, in the Add Virtual Edge Node workflow and in the Edit workflow.
Step 1. Open the Virtual Edge Node workflow
Navigate to Edge Management > Virtual Edge Nodes. For a node you are onboarding, select Add Virtual Edge Node and continue to the Virtual Edge Node Configuration step. For an existing node, select the switch Virtual Edge Node and click Edit.
Step 2. Set the option in Advanced Settings
On the Virtual Edge Node Configuration step, expand Advanced Settings and turn Enable Access Port Discovery Protection on or off. In the Add Virtual Edge Node workflow, the toggle starts at the current global value.
Step 3. Save the configuration
Complete the remaining wizard steps. The Summary step shows Access Port Discovery Protection as Enabled or Disabled. Select Finish to apply the setting.
The bulk import template, the bulk import view, and the configuration export also include an Access Port Discovery Protection column. For the full import workflow, see Bulk Onboarding Virtual Edges and Virtual Edge Nodes.
Verifying Interface Classification
Changes apply on the next classification cycle, usually within a few minutes, without restarting the Virtual Edge.
Navigate to Edge Management > Virtual Edge Nodes, select the node to open Virtual Edge Node Details, and open the Endpoint Discovery or Flow Telemetry tab. For an access-mode interface kept as UNI by the setting, the Source column shows Access Mode, with the tooltip "Access-mode port kept as UNI by Access Port Discovery Protection."
Disabling Access Port Discovery Protection
To disable the setting for all Virtual Edge Nodes, turn off Access Port Discovery Protection in Edge Management > Edge Settings > Advanced Settings, click Save Changes, and confirm the change in the Update all Virtual Edge Nodes? dialog. To disable it for one node, turn off Enable Access Port Discovery Protection in the node's Edit workflow and select Finish.
Important: When the setting is disabled, affected access-mode interfaces return to NNI on the next classification cycle. Endpoint Discovery and Flow Telemetry stop on those interfaces, and devices discovered behind the downstream switch go offline. When disabling globally, the dialog warns: "Access ports with a downstream switch will stop discovering devices, collecting flows, and applying policy."
Monitoring Interfaces Reclassified by a Downstream Switch
When automatic classification changes an interface from UNI to NNI because of a CDP or LLDP neighbor, Cloud Control Center records an event in Monitoring > Events for each capability the interface loses, one for Endpoint Discovery and one for Flow Telemetry. Each event names the Virtual Edge Node and interface, states whether a CDP or LLDP neighbor triggered the reclassification, and describes the effect on discovery or flow collection.
Cloud Control Center can also raise one Endpoint Discovery Automatically Disabled alert per Virtual Edge Node that lists each affected interface, its previous and new role, and whether CDP or LLDP triggered the change. It can be used in notifications, forwarding to external monitors, and export like other alerts. The alert is disabled by default; contact Elisity Support to enable it.
No event or alert is recorded for interfaces in manual configuration, for reclassification caused by an interface description, VRF membership, or shutdown state, or for interfaces first detected as NNI. Because protected access-mode interfaces are not reclassified, these records identify trunk interfaces or nodes where the setting is off. For the full event and alert catalog, see Monitoring (Logs and Events) Reference.
For onboarding guidance, see Onboarding Cisco Switches as Virtual Edge Nodes, Onboarding Arista Switches as Virtual Edge Nodes, and Onboarding HPE Aruba CX Switches as Virtual Edge Nodes. For Aruba CX classification details, see Aruba CX Switch Onboarding - Technical Reference.