Network Security

MAC-based VLAN assignment enables different users to authenticate on different VLANs. This feature enables each user to have a different data VLAN on the same interface.

Cisco TrustSec uses SXP to simplify security and policy enforcement throughout the network.

Comprehensive 802.1x features to control access to the network, including flexible authentication, 802.1x monitor mode, and RADIUS change of authorization.

IPv6 first-hop security enhances layer-2 and layer-3 network access from proliferating IPv6 devices especially BYOD devices. It protects against rogue router advertisements, address spoofing, fake DHCP replies, and other risks introduced by IPv6 technology.

Device sensor and device classifier enable seamless versatile device profiles including BYOD devices. They also enable Cisco Identity Services Engine (ISE) to provision identity based security policies.

Cisco Trust Anchor technology enables easy distribution of a single universal image by verifying the authenticity of iOS images. This technology allows the switch to perform iOS integrity checks at boot-up by verifying the signature, verifying the trusted asset under management and authenticating the license.

Cisco threat defense features including port security, dynamic ARP inspection, and IP source guard.

Multi-domain authentication allows an IP phone and a PC to authenticate on the same switch port while placing them on appropriate voice and data VLAN.

Access Control Lists (ACLs) for IPv6 and IPv4 for security and QoS ACEs: -VLAN ACLs on all VLANs prevent unauthorized data flows from being bridged within VLANs. -Router ACLs define security policies on routed interfaces for control-plane and data-plane traffic. IPv6 ACLs can be applied to filter IPv6 traffic. -Port-based ACLs for layer 2 interfaces allow security policies to be applied on individual switch ports.

Secure Shell (SSH) Protocol, Kerberos, and Simple Network Management Protocol Version 3 (SNMPv3) provide network security by encrypting administrator traffic during telnet and SNMP sessions. SSH Protocol, Kerberos, and the cryptographic version of SNMPv3 require a special cryptographic software image because of U.S. export restrictions.

Switched Port Analyzer (SPAN), with bidirectional data support, allows Cisco Intrusion Detection System (IDS) to take action when an intruder is detected.

TACACS+ and RADIUS authentication facilitates centralized control of the switch and restricts unauthorized users from altering the configuration.

MAC Address Notification allows administrators to be notified of users added to or removed from the network.

Multi-level security on console access prevents unauthorized users from altering the switch configuration.

Bridge Protocol Data Unit (BPDU) guard shuts down spanning tree port fast-enabled interfaces when BPDUs are received to avoid accidental topology loops.

Spanning Tree Root Guard (STRG) prevents edge devices not in the network administrator's control from becoming spanning tree protocol root nodes.

IGMP filtering provides multi-cast authentication by filtering out non-subscribers and limits the number of concurrent multi-cast streams available per port.

Dynamic VLAN assignment is supported through implementation of VLAN membership policy server client capability to provide flexibility in assigning ports to VLANs. Dynamic VLAN facilitates the fast assignment of IP addresses.

Redundancy and Resiliency

Cross-stack EtherChannel provides the ability to configure Cisco EtherChannel technology across different members of the stack for high resiliency.

Flexlink provides link redundancy with convergence time less than 100 milliseconds.

IEEE 802.1s/w Rapid Spanning Tree Protocol (RSTP) and Multiple Spanning Tree Protocol (MSTP) provide rapid spanning-tree convergence independent of spanning-tree timers and also offer the benefit of Layer 2 load balancing and distributed processing.

Per-VLAN Rapid Spanning Tree (PVRST+) allows rapid spanning-tree re-convergence on a per-VLAN spanning-tree basis, without requiring the implementation of spanning-tree instances.

Switch-port auto-recovery (error disable) automatically attempts to reactivate a link that is disabled because of a network error.

Enhanced Quality of Service

Up to eight egress queues per port and strict priority queuing so that the high priority packets are serviced ahead of all other traffic.

Shaped Round Robin (SRR) scheduling and Weighted Tail Drop (WTD) congestion avoidance.

Flow-based rate limiting and up to 256 aggregate or individual polices per port.

802.1p Class of Service (CoS) and Differentiated Services Code Point (DSCP) classification, with marking and reclassification on a per-packet basis by source and destination IP address, MAC address, or Layer 4 TCP/UDP port number.

The Cisco Committed Information Rate (CIR) function provides bandwidth in increments as low as 8 Kb/s.

Rate limiting is provided based on source and destination IP address, source, and destination MAC address, Layer 4 TCP/UDP information, or any combination of these fields, using QoS ACLs (IP ACLs or MAC ACLs), class maps, and policy maps.

Application Visibility

The switch supports NetFlow Lite, which enables IT teams to understand the mix of traffic on their network and identify anomalies by capturing and recording specific packet flows. NetFlow Lite supports flexible sampling of the traffic, and exports flow data in the NetFlow Version 9 format for analysis on a wide range of Cisco and third-party collectors.

Cisco Catalyst SmartOperations

Cisco AutoConfig services determine the level of network access provided to an endpoint based on the type of the endpoint device. This feature also permits hard-binding between the end device and the interface.

Cisco Smart Install services enable minimal-touch deployment by providing automated Cisco iOS software image installation and configuration when new switches are connected to the network. This enables network administrators to remotely manage Cisco IOS software image installs and upgrades.

Cisco auto SmartPorts services enable automatic configuration of switch ports as devices connect to the switch, with settings optimized for the device type resulting in zero-touch port-policy provisioning.

Cisco auto QoS is a service that automatic configuration of QoS that allows switch to manage QoS policies based on traffic types resulting in zero-touch traffic engineering. Auto-QoS supports 8 egress queues.

Cisco Smart Troubleshooting is an extensive array of diagnostic commands and system health checks within the switch, including smart call home. The Cisco GOLD (Generic Online Diagnostics) and Cisco online diagnostics on switches in live networks help predicting and detecting failures quickly.

Operational Simplicity Features

Cisco AutoSecure provides a single-line CLI to enable base line security features (port security, DHCP snooping, DAI). This feature simplifies security configurations with a single touch.

Dynamic Host Configuration Protocol (DHCP) auto-configuration of multiple switches through a boot server eases switch deployment.

Stacking master configuration management and Cisco FlexStack Plus technology helps ensure that all switches are automatically upgraded when the master switch receives a new software version. Automatic software version checking and updating help ensure that all stack members have the same software version.

Auto-negotiation on all ports automatically selects half- or full-duplex transmission mode to optimize bandwidth.

Dynamic Trunking Protocol (DTP) facilitates dynamic trunk configuration across all switch ports.

Port Aggregation Protocol (PAgP) automates the creation of Cisco Fast EtherChannel groups or Gigabit EtherChannel groups to link to another switch, router, or server.

Link Aggregation Control Protocol (LACP) allows the creation of Ethernet channeling with devices that conform to IEEE 802.3ad.

Automatic media-dependent interface crossover (MDIX) automatically adjusts transmit and receive pairs if an incorrect cable type (crossover or straight-through) is installed.

Unidirectional Link Detection Protocol (UDLD) and aggressive UDLD allow unidirectional links caused by incorrect fiber-optic wiring or port faults to be detected and disabled on fiber-optic interfaces.

Switching Database Manager (SDM) templates for access, routing, and VLAN deployment allow the administrator to easily maximize memory allocation to the desired features based on deployment-specific requirements.

Local Proxy Address Resolution Protocol (ARP) works in conjunction with private VLAN edge to minimize broadcasts and maximize available bandwidth.

VLAN1 minimization allows VLAN1 to be disabled on any individual VLAN trunk.

Smart Multicast, with Cisco FlexStack-Plus technology, allows the Cisco Catalyst 2960-X to offer enhanced efficiency and support for more multi-cast data streams such as video by putting each data packet onto the backplane only once.

Internet Group Management Protocol (IGMP) snooping for IPv4 and IPv6 MLD v1 and v2 snooping provide fast client joins and leaves of multicast streams and limit bandwidth-intensive video traffic to only the requestors.

Multicast VLAN Registration (MVR) continuously sends multi-cast streams in a multi-cast VLAN while isolating the streams from subscriber VLANs for bandwidth and security reasons.

Per-port broadcast, multi-cast, and unicast storm control prevents faulty end stations from degrading overall systems performance.

Voice VLAN simplifies telephony installations by keeping voice traffic on a separate VLAN for easy administration and troubleshooting.

Cisco VLAN Trunking Protocol (VTP) supports dynamic VLANs and dynamic trunk configuration across all switches.

Remote Switch Port Analyzer (RSPAN) allows administrators to remotely monitor ports in a Layer 2 switch network from any other switch in the same network.

For enhanced traffic management, monitoring, and analysis, the Embedded Remote Monitoring (RMON) software agent supports four RMON groups (history, statistics, alarms, and events).

Layer 2 trace route eases troubleshooting by identifying the physical path that a packet takes from source to destination.

Trivial File Transfer Protocol (TFTP) reduces the cost of administering software upgrades by downloading from a centralized location.

Network Timing Protocol (NTP) provides an accurate and consistent timestamp to all intranet switches.

Power Management

Switch Hibernation Mode (SHM) puts the switch in a low power mode during periods of non-operation such as nights or weekends. Switch Hibernation Mode on the 2960-X can be scheduled using EnergyWise compliant management software.

IEEE 802.3az EEE (Energy Efficient Ethernet) enables ports to dynamically sense idle periods between traffic bursts and quickly switch the interfaces into a low power idle mode, reducing power consumption.

Cisco EnergyWise policies can be used to control the power consumed by PoE-powered endpoints, desktop and data-center IT equipment, and a wide range of building infrastructure.

Cisco Prime Infrastructure

Cisco Prime network management solutions provide comprehensive network life-cycle management. Cisco Prime Infrastructure provides an extensive library of easy-to-use features to automate the initial and day-to-day management of your Cisco network. Cisco Prime integrates hardware and software platform expertise and operational experience into a set of workflow-driven configuration, monitoring, troubleshooting, reporting, and administrative tools.

Cisco Network Assistant

A Cisco network management application designed for small and medium-sized business (SMB) networks with up to 250 users that runs on PCs, tablets, and even SmartPhones, Cisco Network assistant offers centralized network management and configuration capabilities. This application also features an intuitive GUI where users can easily apply common services across Cisco switches, routers, and access points.