-
IPv6 First Hop
Security—A suite of security features to be applied at the first hop switch to
protect against vulnerabilities inherent in IPv6 networks. These include,
Binding Integrity Guard (Binding Table), Router Advertisement Guard (RA Guard),
DHCP Guard, IPv6 Neighbor Discovery Inspection (ND Guard),
and IPv6 Source Guard.
This feature is not supported on LanLite images on Catalyst
2960-X Series Switches.
-
Web
Authentication—Allows a supplicant (client) that does not support IEEE 802.1x
functionality to be authenticated using a web browser.
-
Local Web
Authentication Banner—A custom banner or an image file displayed at a web
authentication login screen.
-
IEEE 802.1x
Authentication with ACLs and the RADIUS Filter-Id Attribute
-
Password-protected
access (read-only and read-write access) to management interfaces (device
manager, Network Assistant, and the CLI) for protection against unauthorized
configuration changes
-
Multilevel
security for a choice of security level, notification, and resulting actions
-
Static MAC
addressing for ensuring security
-
Protected port
option for restricting the forwarding of traffic to designated ports on the
same switch
-
Port security
option for limiting and identifying MAC addresses of the stations allowed to
access the port
-
VLAN aware port
security option to shut down the VLAN on the port when a violation occurs,
instead of shutting down the entire port.
-
Port security
aging to set the aging time for secure addresses on a port.
-
Protocol storm
protection to control the rate of incoming protocol traffic to a switch by
dropping packets that exceed a specified ingress rate.
-
BPDU guard for
shutting down a Port Fast-configured port when an invalid configuration occurs.
-
Standard and
extended IP access control lists (ACLs) for defining inbound security policies
on Layer 2 interfaces (port ACLs).
-
Extended MAC
access control lists for defining security policies in the inbound direction on
Layer 2 interfaces.
-
Source and
destination MAC-based ACLs for filtering non-IP traffic.
-
DHCP snooping to
filter untrusted DHCP messages between untrusted hosts and DHCP servers.
-
IP source guard to
restrict traffic on nonrouted interfaces by filtering traffic based on the DHCP
snooping database and IP source bindings.
-
Dynamic ARP
inspection to prevent malicious attacks on the switch by not relaying invalid
ARP requests and responses to other ports in the same VLAN.
This feature is not supported on LanLite images on Catalyst
2960-X Series Switches.
-
IEEE 802.1x
port-based authentication to prevent unauthorized devices (clients) from
gaining access to the network. These 802.1x features are supported:
-
Multidomain
authentication (MDA) to allow both a data device and a voice device, such as an
IP phone (Cisco or non-Cisco), to independently authenticate on the same IEEE
802.1x-enabled switch port.
-
Dynamic voice
virtual LAN (VLAN) for MDA to allow a dynamic voice VLAN on an MDA-enabled
port.
-
VLAN
assignment for restricting 802.1x-authenticated users to a specified VLAN.
-
Support for
VLAN assignment on a port configured for multi-auth mode. The RADIUS server
assigns a VLAN to the first host to authenticate on the port, and subsequent
hosts use the same VLAN. Voice VLAN assignment is supported for one IP phone.
-
Port security
for controlling access to 802.1x ports.
-
Voice VLAN to
permit a Cisco IP Phone to access the voice VLAN regardless of the authorized
or unauthorized state of the port.
-
IP phone
detection enhancement to detect and recognize a Cisco IP phone.
-
Guest VLAN to
provide limited services to non-802.1x-compliant users.
-
Restricted
VLAN to provide limited services to users who are 802.1x compliant, but do not
have the credentials to authenticate via the standard 802.1x processes.
-
802.1x
accounting to track network usage.
-
802.1x with
wake-on-LAN to allow dormant PCs to be powered on based on the receipt of a
specific Ethernet frame.
-
802.1x
readiness check to determine the readiness of connected end hosts before
configuring IEEE 802.1x on the switch.
-
Voice aware
802.1x security to apply traffic violation actions only on the VLAN on which a
security violation occurs.
-
MAC
authentication bypass (MAB) to authorize clients based on the client MAC
address.
-
Network
Admission Control (NAC) Layer 2 802.1x validation of the antivirus condition or
posture of endpoint systems or clients before granting the devices network
access.
![](/c/dam/en/us/td/i/templates/note.gif) Note |
NAC is not
supported on LanLite images.
|
-
Network Edge
Access Topology (NEAT) with 802.1X switch supplicant, host authorization with
CISP, and auto enablement to authenticate a switch outside a wiring closet as a
supplicant to another switch.
![](/c/dam/en/us/td/i/templates/note.gif) Note |
NEAT is
not supported on LanLite images.
|
-
IEEE 802.1x
with open access to allow a host to access the network before being
authenticated.
![](/c/dam/en/us/td/i/templates/note.gif) Note |
This
feature is not supported on LanLite images.
|
-
IEEE 802.1x
authentication with downloadable ACLs and redirect URLs to allow per-user ACL
downloads from a Cisco Secure ACS server to an authenticated switch.
-
Support for
dynamic creation or attachment of an auth-default ACL on a port that has no
configured static ACLs.
![](/c/dam/en/us/td/i/templates/note.gif) Note |
This
feature is not supported on LanLite images.
|
-
Flexible-authentication sequencing to configure the order of the
authentication methods that a port tries when authenticating a new host.
-
Multiple-user
authentication to allow more than one host to authenticate on an 802.1x-enabled
port.
-
TACACS+, a
proprietary feature for managing network security through a TACACS server for
both IPv4 and IPv6.
-
RADIUS for
verifying the identity of, granting access to, and tracking the actions of
remote users through authentication, authorization, and accounting (AAA)
services for both IPv4 and IPv6.
-
Enhancements to
RADIUS, TACACS+, and SSH to function over IPv6.
-
Secure Socket
Layer (SSL) Version 3.0 support for the HTTP 1.1 server authentication,
encryption, and message integrity and HTTP client authentication to allow
secure HTTP communications (requires the cryptographic version of the
software).
-
IEEE 802.1x
Authentication with ACLs and the RADIUS Filter-Id Attribute.
-
Support for IP
source guard on static hosts.
-
RADIUS Change of
Authorization (CoA) to change the attributes of a certain session after it is
authenticated. When there is a change in policy for a user or user group in
AAA, administrators can send the RADIUS CoA packets from the AAA server, such
as Cisco Identity Services Engine, or Cisco Secure ACS to reinitialize
authentication, and apply to the new policies.
-
IEEE 802.1x User
Distribution to allow deployments with multiple VLANs (for a group of users) to
improve scalability of the network by load balancing users across different
VLANs. Authorized users are assigned to the least populated VLAN in the group,
assigned by RADIUS server.
![](/c/dam/en/us/td/i/templates/note.gif) Note |
This feature
is not supported on LanLite images.
|
-
Support for
critical VLAN with multiple-host authentication so that when a port is
configured for multi-auth, and an AAA server becomes unreachable, the port is
placed in a critical VLAN in order to still permit access to critical
resources.
![](/c/dam/en/us/td/i/templates/note.gif) Note |
This feature
is not supported on LanLite images.
|
-
Support for
Network Edge Access Topology (NEAT) to change the port host mode and to apply a
standard port configuration on the authenticator switch port.
-
VLAN-ID based MAC
authentication to use the combined VLAN and MAC address information for user
authentication to prevent network access from unauthorized VLANs.
-
MAC move to allow
hosts (including the hosts connected behind an IP phone) to move across ports
within the same switch without any restrictions to enable mobility. With MAC
move, the switch treats the reappearance of the same MAC address on another
port in the same way as a completely new MAC address.
-
Support for 3DES
and AES with version 3 of the Simple Network Management Protocol (SNMPv3). This
release adds support for the 168-bit Triple Data Encryption Standard (3DES) and
the 128-bit, 192-bit, and 256-bit Advanced Encryption Standard (AES) encryption
algorithms to SNMPv3.
-
Support for Cisco
TrustSec SXP protocol. This feature is not supported on LanLite images.