Cisco CATALYST 3550 24 PORT 10/100 2 PORT GBIC STANDALONE SWITCH SMI SOFTWARE Техническое Руководство

Important notices, privacy statements, and trademarks of Cisco Systems, Inc. can be found on cisco.com.

Page 4 of 18

aggregator switch. If one of the uplinks fails, quicker failover to the redundant uplink can be achieved via a scalable routing protocol such as Open

Shortest Path First (OSPF) or Enhanced Interior Gateway Routing Protocol (EIGRP) rather than relying on standard Spanning-Tree Protocol

convergence. Redirection of a packet after a link failure via a routing protocol results in faster failover than a solution that uses Layer 2 Spanning

Tree enhancements. Additionally, routed uplinks allow better bandwidth utilization by implementing equal cost routing (ECR) on the uplinks to

perform load balancing. This results in dynamic load balancing in a part of the network that often acts as the bottleneck. And, routed uplinks

optimize the utility of uplinks out of the wiring closet by eliminating unnecessary broadcast data flows into the network backbone.

The Catalyst 3550 also offers dramatic bandwidth savings as a stackable wiring closet switch in a multicast environment. Using routed uplinks to the

network core will eliminate the requirement to transmit multiple streams of the same multicast from the upstream content servers to the wiring closet.

For example, if three users are assigned to three separate virtual LANs (VLANs) and they all want to view multicast ABC, then three streams of

multicast ABC are required to be transmitted from the upstream router to the wiring closet switch—assuming the wiring closet switch is not capable

of routed uplinks. Deploying IP routing to the core with Catalyst 3550 switches allows users to create a scalable, multicast- rich network.

NETWORK SECURITY THROUGH ENHANCED SECURITY FEATURES

The Cisco Catalyst 3550 Series switches offer enhanced data security through a wide range of security features that protect network management

and administrative traffic, secure the network from unauthorized users, provide granular levels of network access to users, and track where users

are located.

Secure Shell (SSH), Kerberos, and Simple Network Management Protocol version 3 (SNMPv3) encrypt administrative and network management

information, thereby protecting it from tampering or eavesdropping. Terminal Access Controller Access Control System (TACACS+) or Remote

Access Dial-In User Service (RADIUS) authentication enables centralized access control of switches and restricts unauthorized users from altering

the configurations. Alternatively, a local username and password database can be configured on the switch itself. Fifteen levels of authorization on

the switch console and two levels on the web-based management interface provide the ability to give different levels of configuration capabilities

to different administrators.

Port security and 802.1x provide the ability to keep unauthorized users from accessing the network. Port security limits access on an Ethernet port

based on the MAC address of the device that is connected to it. It can also be used to limit the total number of devices plugged into a switch port,

thereby reducing the risks of rogue wireless access points or hubs. 802.1x can be used to authenticate users based on username and password (or

other credentials) via a centralized RADIUS server. This is particularly useful for a mobile workforce because the authentication will be executed

regardless of where the user connects to the network.

ACLs restrict access to sensitive portions of the network by denying packets based on source and destination MAC addresses, IP addresses, or

TCP/UDP ports. ACL lookups are done in hardware; therefore, forwarding and routing performance is not compromised when implementing ACL-

based security in the network. Catalyst 3550 Series switches offer VLAN, router and port-based ACLs. Deploying ACLs can be done through Cisco

CMS Software Security Wizards, which in a few easy steps can restrict user access to a server, a portion of the network, or the usage of certain

applications.

Identity-based Networking Services (IBNS) provide the ability to dynamically administer granular levels of network access. Leveraging the 802.1x

standard and Cisco’s Access Control Server (ACS), when users authenticate they can be assigned a VLAN and/or an ACL regardless of where they

connect to the network. This functionality allows IT departments to enable strong security policies without compromising user mobility and with

minimal administrative overhead.

The MAC Address Notification feature can be used to monitor the network and track users by sending an alert to a management station so that

network administrators know when and where users entered the network. The Dynamic Host Configuration Protocol (DHCP) Interface Tracker

(Option 82) feature tracks where a user is physically connected on a network by providing both switch and port ID to a DHCP Server.