Catalyst Ws-c2960x-24ts-l - 24-port Gigabit Switch
Features and Benefits
24 Ports gigabit POE+ Stackable Switch
Network Security
Cisco Catalyst 2960-X and 2960-XR Series Switches provide a range ofsecurity features to limit access to the network and mitigate threats,including:
& acirc; & mdash; MAC-based VLAN assignment, enabling different users toauthenticate on different VLANs. This feature enables each user to havea different data VLAN on the same interface.
& acirc; & mdash; Cisco TrustSec & Atilde; & sbquo;, which uses Security Group ExchangeProtocol (SXP) to simplify security and policy enforcement throughoutthe network. For more information about Cisco TrustSec securitysolutions, visit
network, including Flexible Authentication, 802.1X monitor mode, and
RADIUS Change of Authorization.
& acirc; & mdash; IPv6 First-Hop Security enhances Layer 2 and Layer 3network access for proliferating IPv6 devices, especially BYOD devices.It protects against rogue router advertisements, address spoofing, fakeDynamic Host Configuration Protocol (DHCP) replies, and other risksintroduced by IPv6 technology.
& acirc; & mdash; Device sensor and device classifier, enabling seamlessversatile device profiles, including BYOD devices. They also enable theCisco Identity Services Engine (ISE) to provision identity-basedsecurity policies. This feature is available on both the 2960-X and2960-XR Series switches.
& acirc; & mdash; Cisco Trust Anchor Technology, enabling easy distributionof a single universal image for all models of the 2960-X and 2960-XRSeries by verifying the authenticity of Cisco IOS Software images. Thistechnology allows the switch to perform Cisco IOS integrity checks atboot-up by verifying the signature, verifying the trusted asset undermanagement, and authenticating the license.
& acirc; & mdash; Cisco Threat Defense features, including Port Security,Dynamic ARP Inspection (DAI), and IP Source Guard.
& acirc; & mdash; Private VLANs that restrict traffic between hosts in acommon segment by segregating traffic at Layer 2, turning a broadcastsegment into a nonbroadcast multiaccess-like segment. This feature issupported on both 2960-X and 2960-XR Series and is available in bothLAN Base and IP Lite feature sets.
& acirc; & mdash; & brvbar; Private VLAN Edge to provide security andisolation between switch ports, which helps ensure that users cannotsnoop on other users & Atilde; & cent; traffic.
& acirc; & mdash; Unicast Reverse Path Forwarding (uRPF) to help mitigateproblems caused by the introduction of malformed or forged (spoofed) IPsource addresses into a network by discarding IP packets that lack averifiable IP source address. This feature is available in the IP Litefeature set only.
& acirc; & mdash; Multidomain Authentication to allow an IP phone and a PCto authenticate on the same switch port while being placed onappropriate voice and data VLANs.
& acirc; & mdash; Access Control Lists (ACLs) for IPv6 and IPv4 forsecurity and QoS ACL elements (ACEs).
& acirc; & mdash; & brvbar; VLAN ACLs on all VLANs to preventunauthorized data flows from being bridged within VLANs.
& acirc; & mdash; & brvbar; Router ACLs that define security policies onrouted interfaces for control-plane and data-plane traffic. IPv6 ACLscan be applied to filter IPv6 traffic.
& acirc; & mdash; & brvbar; Port-based ACLs for Layer 2 interfaces toallow security policies to be applied on individual switch ports.
& acirc; & mdash; & brvbar; Downloadable ACLs (dACLs) to download ACLsfrom a RADIUS server during 802.1X authentication.
& acirc; & mdash; SSH, Kerberos, and SNMPv3, providing network security byencrypting administrator traffic during Telnet and SNMP sessions. SSH,Kerberos, and the cryptographic version of SNMPv3 require a specialcryptographic software image because of U.S. export restrictions.
& acirc; & mdash; SPAN, with bidirectional data support, to allow CiscoIntrusion Detection System (IDS) to take action when an intruder isdetected.
& acirc; & mdash; TACACS+ and RADIUS authentication to facilitatecentralized control of the switch and restrict unauthorized users fromaltering the configuration.
& acirc; & mdash; MAC address Notification to notify administrators aboutusers added to or removed from the network.
& acirc; & mdash; Multilevel security on console access to preventunauthorized users from altering the switch configuration.
& acirc; & mdash; BPDU Guard to shut down Spanning-Tree Port Fast-enabledinterfaces when BPDUs are received to avoid accidental topology loops.
& acirc; & mdash; Spanning Tree Root Guard (STRG) to prevent edge devicesthat are not in the network administrator & Atilde; & cent;s control from becomingSpanning Tree Protocol (STP) root nodes.
& acirc; & mdash; Internet Group Management Protocol (IGMP) filtering toprovide multicast authentication by filtering out nonsubscribers and tolimit the number of concurrent multicast streams available per port.
& acirc; & mdash; Dynamic VLAN assignment through implementation of VLANMembership Policy Server client capability to provide flexibility inassigning ports to VLANs. Dynamic VLAN facilitates the fast assignmentof IP addresses.
& acirc; & mdash; Cisco Identity Services Engine (ISE) support to enablethe 2960-XR Series switches to offer security management for allconnected devices.
Enhanced QoS
The Cisco Catalyst 2960-X and 2960-XR Series Switches offer intelligenttraffic management that keeps everything flowing smoothly. Flexiblemechanisms for marking, classification, and scheduling deliver superiorperformance for data, voice, and video traffic, all at wire speed.Primary QoS features include:
& acirc; & mdash; Up to eight egress queues per port and strict priorityqueuing so that the highest-priority packets are serviced ahead of allother traffic.
& acirc; & mdash; Shaped Round Robin (SRR) scheduling and Weighted TailDrop (WTD) congestion avoidance.
& acirc; & mdash; Flow-based rate limiting and up to 256 aggregate orindividual policers per port.
& acirc; & mdash; 802.1p Class of Service (CoS) and Differentiated ServicesCode Point (DSCP) classification, with marking and reclassification ona per-packet basis by source and destination IP address, MAC address,or Layer 4 TCP/UDP port number.
& acirc; & mdash; Cross-stack QoS to allow QoS to be configured across astack of 2960-X and 2960-XR Series switches.
& acirc; & mdash; Cisco Committed Information Rate (CIR) function,providing bandwidth in increments as low as 8 Kbps.
& acirc; & mdash; Rate limiting based on source and destination IP address,source and destination MAC address, Layer 4 TCP/UDP information, or anycombination of these fields, using QoS ACLs (IP ACLs or MAC ACLs),class maps, and policy maps.