1-6
Cisco ME 3800X and 3600X Switch Software Configuration Guide
OL-23400-01
Chapter 1 Overview
Features
•
IEEE 802.1Q trunking encapsulation on all ports for network moves, adds, and changes;
management and control of broadcast and multicast traffic; and network security by establishing
VLAN groups for high-security users and network resources
•
VLAN 1 minimization for reducing the risk of spanning-tree loops or storms by allowing VLAN 1
to be disabled on any individual VLAN trunk link. With this feature enabled, no user traffic is sent
or received on the trunk. The switch CPU continues to send and receive control protocol frames.
•
VLAN Flex Link Load Balancing on physical interfaces to provide Layer 2 redundancy without
requiring Spanning Tree Protocol (STP). A pair of interfaces configured as primary and backup links
can load balance traffic based on VLAN.
Security Features
Switch Security
Note
The Kerberos feature listed in this section is only available on the cryptographic versions of the switch
software.
•
Password-protected access (read-only and read-write access) to management interfaces for
protection against unauthorized configuration changes
•
Configuration file security so that only authenticated and authorized users have access to the
configuration file, preventing users from accessing the configuration file by using the password
recovery process
•
Multilevel security for a choice of security level, notification, and resulting actions
•
MAC security option for limiting and identifying MAC addresses of the stations allowed to access
Ethernet Flow Points (EFPs)
•
MAC security aging to set the aging time for secure addresses on a service instance
•
LLDP (Link Layer Discovery Protocol) and LLLDP-MED (Media Extensions)—Adds support for
IEEE 802.1AB link layer discovery protocol for interoperability in multi-vendor networks. Switches
exchange speed, duplex, and power settings with end devices such as IP Phones.
•
, a proprietary feature for managing network security through a TACACS server
•
RADIUS for verifying the identity of, granting access to, and tracking the actions of remote users
through authentication, authorization, and accounting (AAA) services
•
Kerberos security system to authenticate requests for network resources by using a trusted third
party (requires the cryptographic versions of the switch software)
Network Security
•
Standard and extended IP access control lists (ACLs) for defining security policies in both directions
on routed interfaces (router ACLs) and VLANs and inbound on Layer 2 interfaces (port ACLs)
•
Extended MAC access control lists for defining security policies in the inbound direction on Layer 2
interfaces
•
VLAN ACLs (VLAN maps) for providing intra-VLAN security by filtering traffic based on
information in the MAC, IP, and TCP/UDP headers
