Datasheet

Data Sheet
All contents are Copyright © 1992–2007 Cisco Systems, Inc. All rights reserved. This document is Cisco Public Information. Page 7 of 14
Feature Benefit

Internet Group Management Protocol (IGMP) version 3 snooping provides fast client joins and
leaves of multicast streams and limits bandwidth-intensive video traffic to only the requestors.

IGMP filtering provides multicast authentication by filtering out no subscribers and limits the
number of concurrent multicast streams available per port.

Multicast VLAN registration (MVR) continuously sends multicast streams in a multicast VLAN
while isolating e streams from subscriber VLANs for bandwidth and security reasons.
QoS and Control
Advanced QoS

Standard 802.1p CoS and DSCP field classification are provided, using marking and
reclassification on a per-packet basis by source and destination IP address, source and
destination MAC address, or Layer 4 TCP or UDP port number.

Cisco control-plane and data-plane QoS ACLs on all ports help ensure proper marking on a
per-packet basis.

Four egress queues per port enable differentiated management of up to four traffic types
across the stack.

SRR scheduling ensures differential prioritization of packet flows by intelligently servicing the
ingress and egress queues.

Weighted tail drop (WTD) provides congestion avoidance at the ingress and egress queues
before a disruption occurs.

Strict priority queuing guarantees that the highest-priority packets are serviced ahead of all
other traffic.

There is no performance penalty for highly granular QoS functions.
Granular Rate
Limiting

The Cisco CIR function guarantees bandwidth in increments as small as 1 Mbps.

Rate limiting is provided based on source and destination IP address, source and destination
MAC address, Layer 4 TCP and UDP information, or any combination of these fields, using
QoS ACLs (IP ACLs or MAC ACLs), class maps, and policy maps.

Asynchronous data flows upstream and downstream from the end station or on the uplink are
easily managed using ingress policing and egress shaping.

Up to 64 aggregate or individual polices are available per Fast Ethernet or Gigabit Ethernet
port.
Security
Networkwide
Security Features

IEEE 802.1x allows dynamic, port-based security, providing user authentication.

IEEE 802.1x with VLAN assignment allows a dynamic VLAN assignment for a specific
user regardless of where the user is connected.

IEEE 802.1x with voice VLAN permits an IP phone to access the voice VLAN irrespective
of the authorized or unauthorized state of the port.

IEEE 802.1x and port security are provided to authenticate the port and manage network
access for all MAC addresses, including those of the client.

IEEE 802.1x with Guest VLAN allows guests without 802.1x clients to have limited network
access on the guest VLAN.

Port-based ACLs for Layer 2 interfaces allow application of security policies on individual
switch ports.

Unicast MAC filtering prevents the forwarding of any type of packet with a matching
MAC address.

Unknown unicast and multicast port blocking allows tight control by filtering packets that the
switch has not already learned how to forward.

SSHv2 and SNMPv3 provide network security by encrypting administrator traffic during Telnet
and SNMP sessions. SSHv2 and the cryptographic version of SNMPv3 require a special
cryptographic software image because of U.S. export restrictions.

Bidirectional data support on the Switched Port Analyzer (SPAN) port allows the Cisco Secure
intrusion detection system (IDS) to take action when an intruder is detected.

TACACS+ and RADIUS authentication enable centralized control of the switch and restrict
unauthorized users from altering the configuration.

MAC address notification allows administrators to be notified of users added to or removed
from the network.

DHCP snooping allows administrators to ensure consistent mapping of IP to MAC addresses.
This can be used to prevent attacks that attempt to poison the DHCP binding database, and to
rate-limit the amount of DHCP traffic that enters a switch port.

DHCP Interface Tracker (Option 82) feature augments a host IP address request with the
switch port ID.

Port security secures the access to an access or trunk port based on MAC address.

After a specific timeframe, the aging feature removes the MAC address from the switch to
allow another device to connect to the same port.

Trusted Boundary provides the ability to trust the QoS priority settings if an IP phone is present
and to disable the trust setting if the IP phone is removed, thereby preventing a malicious user
from overriding prioritization policies in the network.

Multilevel security on console access prevents unauthorized users from altering the switch
configuration.