|
Security
- Control Plane Policing set rate limit on control protocols to protect CPU overload from DOS attacks
- Multiple user authentication methods
- uses an IEEE 802.1X supplicant on the client in conjunction with a RADIUS server to authenticate in accordance with industry standards
- supports Web-based authentication
- supports MAC-based authentication
- Authentication flexibility
- Multiple IEEE 802.1X users per port
provides authentication of multiple devices on a single port; prevents a user from "piggybacking" on another user's IEEE 802.1X authentication
- Concurrent IEEE 802.1X, Web, and MAC authentication schemes per port
switch port will accept up to 32 sessions of IEEE 802.1X, Web, and MAC authentications
includes a Trusted Platform Module (TPM) for secure hardware-based generation and storage of cryptographic keys that can be used for a variety of authentication purposes
- Access control lists (ACLs)
provide IP Layer 3 filtering based on source/destination IP address/subnet and source/destination TCP/UDP port number
allows only specified ports to communicate with each other
eases switch management security administration by using a password authentication server
encrypts all transmitted data for secure remote CLI access over IP networks
- Secure Sockets Layer (SSL)
encrypts all HTTP traffic, allowing secure access to the browser-based management GUI in the switch
allows access only to specified MAC addresses, which can be learned or specified by the administrator
allows users to use a more secure and reliable mode of communications between switch and radius servers over unsecure networks
prevents particular configured MAC addresses from connecting to the network
allows secure file transfer to and from the switch; protects against unwanted file downloads or unauthorized copying of a switch configuration file
- Switch management logon security
helps secure switch CLI logon by optionally requiring either RADIUS or TACACS+ authentication
displays security policy when users log in to the switch
blocks Bridge Protocol Data Units (BPDUs) on ports that do not require BPDUs, preventing forged BPDU attacks
blocks DHCP packets from unauthorized DHCP servers, preventing denial-of-service attacks
blocks ARP broadcasts from unauthorized hosts, preventing eavesdropping or theft of network data
protects the root bridge from malicious attacks or configuration mistakes
enables implementation of a highly granular and flexible access security policy and VLAN assignment specific to each authenticated network user
- Per-port broadcast throttling
Configures broadcast control selectively on heavy traffic port uplinks
provides network security by restricting peer-to-peer communication to prevent a variety of malicious attacks; typically a switch port can only communicate with other ports in the same community and/or an uplink port, regardless of VLAN ID or destination MAC address
simplifies first-time deployment of AAA in brownfield deployments by allowing full network access for failed clients and provides instant connectivity as soon as a client is plugged-in
- Critical authentication role
ensures that important infrastructure devices such as IP phones are allowed network access even in the absence of a RADIUS server
allows non-chatty legacy devices to stay authenticated by pinning client MAC addresses to the port until the clients logoff or get disconnected
- Enrollment over Secure Transport (EST)
enhances the switch PKI infrastructure with a simpler, scalable and more secure method of certificate provisioning, re-enrollment and renewal
|
![Multishoping.eu [logo]](https://www.multishoping.eu/Images/loga/td.jpg)
