1-7
Security Overview
Network Security Features
Network Security Features
This section outlines features and defence mechanisms for protecting access
through the switch to the network. For more detailed information, see the
indicated chapters.
Table 1-2. Network Security—Default Settings and Security Guidelines
Feature Default
Setting
Security Guidelines More Information and
Configuration Details
Secure File
Transfers
not
applicable
Secure Copy and SFTP provide a secure alternative to
TFTP and auto-TFTP for transferring sensitive
information such as configuration files and log
information between the switch and other devices.
Management and
Configuration Guide,
Appendix A “File Transfers”,
refer to the section “Using
Secure Copy and SFTP”
Traffic/Security
Filters
none These statically configured filters enhance in-band
security (and improve control over access to network
resources) by forwarding or dropping inbound network
traffic according to the configured criteria. Filter options
include:
• source-port filters: Inbound traffic from a
designated, physical source-port will be forwarded
or dropped on a per-port (destination) basis.
Chapter 12, “Traffic/Security
Filters and Monitors”
Port Security,
MAC Lockdown,
and MAC
Lockout
none The features listed below provide device-based access
security in the following ways:
• Port security: Enables configuration of each switch
port with a unique list of the MAC addresses of
devices that are authorized to access the network
through that port. This enables individual ports to
detect, prevent, and log attempts by unauthorized
devices to communicate through the switch. Some
switch models also include eavesdrop prevention in
the port security feature.
• MAC lockdown: This “static addressing” feature is
used as an alternative to port security to prevent
station movement and MAC address “hijacking” by
allowing a given MAC address to use only one
assigned port on the switch. MAC lockdown also
restricts the client device to a specific VLAN.
• MAC lockout: This feature enables blocking of a
specific MAC address so that the switch drops all
traffic to or from the specified address.
Chapter 11, “Configuring and
Monitoring Port Security”
See also “Precedence of
Port-Based Security
Options” on page 1-17
