Cisco Systems 2960 Manuale Utente

1-11

Catalyst 2960 and 2960-S Switch Software Configuration Guide

OL-8603-09

Chapter 1 Overview

Features

•

Dynamic ARP inspection to prevent malicious attacks on the switch by not relaying invalid ARP
requests and responses to other ports in the same VLAN

•

IEEE 802.1x port-based authentication to prevent unauthorized devices (clients) from gaining
access to the network. These features are supported:

–

Multidomain authentication (MDA) to allow both a data device and a voice device, such as an
IP phone (Cisco or non-Cisco), to independently authenticate on the same IEEE 802.1x-enabled
switch port

Note

To use MDA, the switch must be running the LAN Base image.

–

Dynamic voice virtual LAN (VLAN) for MDA to allow a dynamic voice VLAN on an
MDA-enabled port

–

VLAN assignment for restricting 802.1x-authenticated users to a specified VLAN

–

Support for VLAN assignment on a port configured for multi-auth mode. The RADIUS server
assigns a VLAN to the first host to authenticate on the port, and subsequent hosts use the same
VLAN. Voice VLAN assignment is supported for one IP phone.

Note

To use this feature, the switch must be running the LAN Base image.

–

Port security for controlling access to 802.1x ports

–

Voice VLAN to permit a Cisco IP Phone to access the voice VLAN regardless of the authorized
or unauthorized state of the port

–

IP phone detection enhancement to detect and recognize a Cisco IP phone.

–

Guest VLAN to provide limited services to non-802.1x-compliant users

–

Restricted VLAN to provide limited services to users who are 802.1x compliant, but do not have
the credentials to authenticate via the standard 802.1x processes

Note

To use authentication with restricted VLANs, the switch must be running the LAN Base
image.

–

802.1x accounting to track network usage

–

802.1x with wake-on-LAN to allow dormant PCs to be powered on based on the receipt of a
specific Ethernet frame

Note

To use authentication with wake-on-LAN, the switch must be running the LAN Base image

–

802.1x readiness check to determine the readiness of connected end hosts before configuring
IEEE 802.1x on the switch

Note

To use 802.1x readiness check, the switch must be running the LAN Base image.

–

Voice aware 802.1x security to apply traffic violation actions only on the VLAN on which a
security violation occurs.