Cisco Catalyst 2960X-48LPD-L

Network Security

• Cisco TrustSec uses SXP to simplify security and policy enforcement across the network
• Comprehensive 802.1X capabilities to control network access, including Flexible Authentication, 802.1x Monitor Mode, and RADIUS Change of Authorization
• IPv6 First-Hop Security improves the security of Layer 2 and Layer 3 network access in the context of the proliferation of IPv6 devices, especially in BYOD environments. This feature set will protect the network from misrouted advertisements, address theft, false DHCP responses and all other risks introduced by IPv6
• Device Sensor and Device Classifier allow the profiling of devices connected to the network by integrating BYOD terminals. These solutions integrate with Cisco Identity Services Engine (ISE) to provide automatic and secure access to connected devices
• Cisco Trust Anchor Technology (TAT) enables the simple distribution of a single IOS image for all models in the Catalyst 2960-X family by verifying the authenticity of IOS software. This technology allows the switch to verify the integrity of the software image at boot time and authenticate the licenses in place
• Cisco Threat Defense includes Port Security, Dynamic ARP Inspection (DAI), and IP Source Guard
• Private VLAN Edge provides security and waterproofing between ports on a single switch, preventing one user connected to the network from seeing another's traffic
• Multi-domain authentication allows an IP phone and a PC to authenticate on the same port and place them on their respective VLAN
• Access Control Lists for IPv6 and IPv4 filtering and QoS policy definition
  • VLAN ACLs on all VLANs will prevent unauthorised traffic from being switched to other VLANs
  • Router ACLs define security policies on the routed interfaces for data and control plane traffic. IPv6 ACLs can apply to IPv6 traffic
  • Port-based ACLs allow filtering for each Layer 2 port on the network
• Secure Shell (SSH) Protocol, Kerberos, and Simple Network Management Protocol Version 3 (SNMPv3) improve security by encrypting management traffic during Telnet and SNMP sessions. SSH Protocol, Kerberos, and the cryptographic version SNMPv3 require a special software image due to export restrictions from the United States
• Switched Port Analyzer (SPAN), with support for bi-directional traffic, allows easy interconnection to an Intrusion Detection System (IDS) that can detect and take action on intrusions/abuses
• TACACS+ and RADIUS authentication facilitate centralized control of the switch and prevent unauthorized users from changing the configuration
• MAC Address Notification notifies the administrator when users log on or off the network
• Multiple levels of security on console access prevent unauthorised users from changing the configuration
• Bridge protocol data unit (BPDU) Guard shuts down interfaces where Spanning Tree Port Fast is enabled when BPDUs are received to prevent loops
• Spanning Tree Root Guard (STRG) allows third-party managed switches to connect to the network while preventing them from becoming Spanning Tree root nodes
• IGMP filtering provides multicast authentication by filtering subscriptions and limiting the number of concurrent multicast streams per port
• Dynamic VLAN allocation is supported through the implementation of the integrated VLAN Membership Policy Server (VMPS) client which allows ports to be flexibly assigned to VLANs. Dynamic VLANs facilitate fast IP address allocation

Resiliency and redundancy mechanisms

• Cross-stack EtherChannel provides the ability to configure the Cisco Etherchannel solution on different switch ports in a stack for greater availability
• Flexlink provides a link redundancy mechanism with a convergence time of less than 100 milliseconds
• IEEE 802.1s/w Rapid Spanning Tree Protocol (RSTP) and Multiple Spanning Tree Protocol (MSTP) provide fast spanning-tree convergence independent of conventional counts, and allow Layer 2 traffic to be distributed across the network. A switch stack behaves as a single spanning-tree node
• Per-VLAN Rapid Spanning Tree (PVRST+) enables rapid spanning-tree convergence and the topologies associated with each VLAN, without requiring the implementation of multiple spanning-tree instances
• Switch-port auto-recovery (Error Disable) will automatically attempt to reactivate a link after it is disabled due to a network error
• Power supply redundancy with an optional second power supply on 2960-XRmodels, or with an external RPS on 2960-Xmodels

Improved quality of service

• Up to eight output queues per port (four when stacked)
• Strict priority queuing ensures that higher priority packets are always processed before other traffic
• Shaped Round Robin (SRR) and Weighted Tail Drop (WTD) mechanisms
• Flow-based rate limiting and up to 256 aggregated or individual policers per port
• 802.1p class of service (CoS) and Differentiated Services Code Point (DSCP) classification, with per-packet marking and reclassification based on source and destination IP addresses, MAC addresses, or TCP/UDP port numbers
• Cross-stack QoS will configure QoS across a stack of 2960-Xswitches
• The Cisco committed information rate (CIR) feature provides the ability to set bandwidths in increments as low as 8 kbps
• Rate limiting can be configured for source and destination IP addresses, source and destination MAC addresses, TCP/UDP information, or any combination of these fields, using ACLs (IP or MAC), class maps, and policy maps

Cisco FlexStack-Plus

Power supplies

Intelligent Power over Ethernet Plus

Application Visibility

Cisco Catalyst SmartOperations

• Cisco Smart Install enables automatic switch deployment (Cisco IOS software installation, configuration download when a new switch is added to the network). This allows remote control and simplification of deployment procedures
• Cisco Auto SmartPorts enables automatic configurations on the switch ports when endpoints connect to the switch, with settings optimised for the type of equipment connected. This allows for full automation of switch port configurations
• Cisco Auto QoS automatically enables QoS rules on the switch ports
• Cisco Smart Troubleshooting is a comprehensive set of diagnostic and system verification commands within the switch, including Smart Call Home. Cisco GOLD (Generic Online Diagnostics) and other commands available on the switch will help anticipate and detect faults faster

Other features to simplify operations

• Dynamic Host Configuration Protocol (DHCP) auto-configuration of multiple switches via a boot server simplifies deployment
• Stacking master configuration management and Cisco FlexStack Plus technology help ensure that all switches in a stack are updated when the stack master is updated. Automatic checks will ensure that the various software in the stack has the same software version
• Autonegotiation on all ports of the half- or full-duplex transmission mode will ensure the highest possible bandwidth
• Dynamic Trunking Protocol (DTP) facilitates dynamic trunk configuration on all ports of the switch
• Port Aggregation Protocol (PAgP) automates the creation of Etherchannels to other switches, routers or terminals
• Link Aggregation Control Protocol (LACP) allows the aggregation of Ethernet links with devices that are IEEE 802.3ad compliant. This feature is similar to Etherchannel and PagP
• Automatic media-dependent interface crossover (MDIX) automatically adjusts the transmit and receive connectors of packets on the port if an incorrect cable (e.g. a crossover cable) is connected
• Unidirectional Link Detection Protocol (UDLD) and Aggressive UDLD will detect unidirectional links (due to incorrect cabling or some other problem) and disable the associated interfaces
• Switching Database Manager (SDM) templates will allow the administrator to optimise the memory allocation of the switch according to the type of deployment desired and the associated functionalities (access mode, routing or VLAN deployment, etc.)
• Local Proxy Address Resolution Protocol (ARP) works in conjunction with Private VLAN Edge to limit broadcasts on links and not use their bandwidth unnecessarily
• VLAN1 minimization allows the disabling of VLAN 1 on each trunk
• Smart Multicast, in combination with Cisco FlexStack-Plus technology, allows the Cisco Catalyst 2960-X to offer greater efficiency in multicast delivery, with each stream being transported only once within the switch stack. This also allows more multicast streams to be delivered simultaneously
• Internet Group Management Protocol (IGMP) Snooping for IPv4 and IPv6 MLD v1 and v2 Snooping will enable endpoints to join and leave multicast streams faster while limiting unnecessary video broadcasts on ports where no subscriber is present
• Multicast VLAN Registration (MVR) will send multicast streams in a dedicated VLAN while keeping subscribers in separate VLANs for security and bandwidth optimisation
• Broadcast, multicast, and unicast storm control per port will prevent a misbehaving endpoint from degrading the performance of the entire network
• Voice VLAN simplifies the installation of IP telephony systems by keeping voice streams separate on a dedicated VLAN to simplify administration and troubleshooting
• Cisco VLAN Trunking Protocol (VTP) enables dynamic configuration of VLANs and trunks on different switches in the network
• Remote Switch Port Analyzer (RSPAN) allows administrators to remotely control/supervise a switch port from any other switch on the same network
• Remote Monitoring Embedded Agent (RMON) provides advanced traffic management, monitoring and analysis. Four groups are supported (history, statistics, alarms, and events)
• Level 2 Traceroute facilitates performance troubleshooting by identifying the physical path a packet follows from its source to its destination
• Trivial File Transfer Protocol (TFTP) reduces the cost of software updates by allowing them to be downloaded from a central server on the network
• Network Timing Protocol (NTP) will ensure that all switches on the network have the same time

Power Management

• Switch Hibernation Mode (SHM) is a Cisco innovation available on all 2960-X switches. This feature will put the switch into hibernation and thus considerably reduce its power consumption during shutdown periods (evenings and weekends for example). The switch hibernation can be controlled by any EnergyWise
• IEEE 802.3az EEE (Energy Efficient Ethernet) allows the switch to dynamically detect periods of inactivity on ports and switches and place them in a lower power mode, thereby reducing overall power consumption
• Cisco EnergyWise policies can be used to control the power supply and power consumption of PoE-powered endpoints and many other commercially available endpoints. For more information on Cisco EnergyWise, visit cisco.com/go/energywise

Network Management