Cisco Catalyst 2960-X User manual

Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS
Release 15.0(2)EX
First Published: July 10, 2013
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
Text Part Number: OL-29048-01

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS,
INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH
THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY,
CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version
of the UNIX operating system. All rights reserved. Copyright ©1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS.
CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT
LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS
HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network
topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional
and coincidental.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: http://
www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership
relationship between Cisco and any other company. (1110R)
©2013 Cisco Systems, Inc. All rights reserved.

CONTENTS
Preface Preface xxi
Document Conventions xxi
Related Documentation xxiii
Obtaining Documentation and Submitting a Service Request xxiii
CHAPTER 1 Using the Command-Line Interface 1
Information About Using the Command-Line Interface 1
Command Modes 1
Understanding Abbreviated Commands 3
No and Default Forms of Commands 3
CLI Error Messages 4
Configuration Logging 4
Using the Help System 4
How to Use the CLI to Configure Features 6
Configuring the Command History 6
Changing the Command History Buffer Size 6
Recalling Commands 6
Disabling the Command History Feature 7
Enabling and Disabling Editing Features 7
Editing Commands Through Keystrokes 8
Editing Command Lines That Wrap 9
Searching and Filtering Output of show and more Commands 10
Accessing the CLI on a Switch Stack 11
Accessing the CLI Through a Console Connection or Through Telnet 11
CHAPTER 2 Security Features Overview 13
Security Features Overview 13
Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX
OL-29048-01 iii

CHAPTER 3 Preventing Unauthorized Access 17
Finding Feature Information 17
Preventing Unauthorized Access 17
CHAPTER 4 Controlling Switch Access with Passwords and Privilege Levels 19
Finding Feature Information 19
Restrictions for Controlling Switch Access with Passwords and Privileges 19
Information About Passwords and Privilege Levels 20
Default Password and Privilege Level Configuration 20
Additional Password Security 20
Password Recovery 21
Terminal Line Telnet Configuration 21
Username and Password Pairs 21
Privilege Levels 22
How to Control Switch Access with Passwords and Privilege Levels 22
Setting or Changing a Static Enable Password 22
Protecting Enable and Enable Secret Passwords with Encryption 24
Disabling Password Recovery 26
Setting a Telnet Password for a Terminal Line 27
Configuring Username and Password Pairs 29
Setting the Privilege Level for a Command 31
Changing the Default Privilege Level for Lines 33
Logging into and Exiting a Privilege Level 34
Monitoring Switch Access 35
Configuration Examples for Setting Passwords and Privilege Levels 35
Example: Setting or Changing a Static Enable Password 35
Example: Protecting Enable and Enable Secret Passwords with Encryption 35
Example: Setting a Telnet Password for a Terminal Line 36
Example: Setting the Privilege Level for a Command 36
Additional References 36
CHAPTER 5 Configuring TACACS+ 39
Finding Feature Information 39
Prerequisites for TACACS+ 39
Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX
iv OL-29048-01
Contents

Information About TACACS+ 41
TACACS+ and Switch Access 41
TACACS+ Overview 41
TACACS+ Operation 43
Method List 44
TACACS+ Configuration Options 44
TACACS+ Login Authentication 44
TACACS+ Authorization for Privileged EXEC Access and Network Services 44
TACACS+ Accounting 45
Default TACACS+ Configuration 45
How to Configure TACACS+ 45
Identifying the TACACS+ Server Host and Setting the Authentication Key 45
Configuring TACACS+ Login Authentication 47
Configuring TACACS+ Authorization for Privileged EXEC Access and Network Services 50
Starting TACACS+ Accounting 52
Establishing a Session with a Router if the AAA Server is Unreachable 53
Monitoring TACACS+ 54
Additional References 54
Feature Information for TACACS+ 55
CHAPTER 6 Configuring RADIUS 57
Finding Feature Information 57
Prerequisites for Configuring RADIUS 57
Restrictions for Configuring RADIUS 58
Information about RADIUS 59
RADIUS and Switch Access 59
RADIUS Overview 59
RADIUS Operation 60
RADIUS Change of Authorization 61
Change-of-Authorization Requests 62
RFC 5176 Compliance 63
Preconditions 64
CoA Request Response Code 64
Session Identification 64
CoA ACK Response Code 65
Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX
OL-29048-01 v
Contents

CoA NAK Response Code 65
CoA Request Commands 65
Session Reauthentication 66
Session Reauthentication in a Switch Stack 66
Session Termination 67
CoA Disconnect-Request 67
CoA Request: Disable Host Port 67
CoA Request: Bounce-Port 68
Stacking Guidelines for Session Termination 68
Stacking Guidelines for CoA-Request Bounce-Port 68
Stacking Guidelines for CoA-Request Disable-Port 69
Default RADIUS Configuration 69
RADIUS Server Host 69
RADIUS Login Authentication 70
AAA Server Groups 70
AAA Authorization 71
RADIUS Accounting 71
Vendor-Specific RADIUS Attributes 71
Vendor-Proprietary RADIUS Server Communication 83
How to Configure RADIUS 83
Identifying the RADIUS Server Host 83
Configuring RADIUS Login Authentication 86
Defining AAA Server Groups 88
Configuring RADIUS Authorization for User Privileged Access and Network Services 90
Starting RADIUS Accounting 92
Establishing a Session with a Router if the AAA Server is Unreachable 93
Configuring Settings for All RADIUS Servers 93
Configuring the Switch to Use Vendor-Specific RADIUS Attributes 95
Configuring the Switch for Vendor-Proprietary RADIUS Server Communication 97
Configuring CoA on the Switch 98
Configuring RADIUS Server Load Balancing 101
Monitoring CoA Functionality 101
Configuration Examples for Controlling Switch Access with RADIUS 102
Examples: Identifying the RADIUS Server Host 102
Example: Using Two Different RADIUS Group Servers 102
Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX
vi OL-29048-01
Contents

Examples: Configuring the Switch to Use Vendor-Specific RADIUS Attributes 103
Example: Configuring the Switch for Vendor-Proprietary RADIUS Server Communication 103
Additional References 104
Feature Information for RADIUS 105
CHAPTER 7 Configuring Local Authentication and Authorization 107
Finding Feature Information 107
How to Configure Local Authentication and Authorization 107
Configuring the Switch for Local Authentication and Authorization 107
Monitoring Local Authentication and Authorization 110
Additional References 110
Feature Information for Local Authentication and Authorization 111
CHAPTER 8 Configuring Secure Shell (SSH) 113
Finding Feature Information 113
Prerequisites for Configuring Secure Shell 113
Restrictions for Configuring Secure Shell 114
Information about SSH 114
SSH and Switch Access 115
SSH Servers, Integrated Clients, and Supported Versions 115
SSH Configuration Guidelines 115
Secure Copy Protocol Overview 116
Secure Copy Protocol 116
How to Configure SSH 117
Setting Up the Switch to Run SSH 117
Configuring the SSH Server 118
Monitoring the SSH Configuration and Status 121
Additional References 121
Feature Information for SSH 122
CHAPTER 9 Configuring Secure Socket Layer HTTP 125
Finding Feature Information 125
Information about Secure Sockets Layer (SSL) HTTP 125
Secure HTTP Servers and Clients Overview 125
Certificate Authority Trustpoints 126
Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX
OL-29048-01 vii
Contents

CipherSuites 127
Default SSL Configuration 128
SSL Configuration Guidelines 128
How to Configure Secure HTTP Servers and Clients 129
Configuring a CA Trustpoint 129
Configuring the Secure HTTP Server 131
Configuring the Secure HTTP Client 134
Monitoring Secure HTTP Server and Client Status 135
Additional References 136
Feature Information for Secure Socket Layer HTTP 137
CHAPTER 10 Configuring IPv4 ACLs 139
Finding Feature Information 139
Prerequisites for Configuring IPv4 Access Control Lists 139
Restrictions for Configuring IPv4 Access Control Lists 140
Information about Network Security with ACLs 141
Cisco TrustSec and ACLs 141
ACL Overview 141
Access Control Entries 142
ACL Supported Types 142
Supported ACLs 142
ACL Precedence 142
Port ACLs 143
Router ACLs 144
VLAN Maps 145
ACEs and Fragmented and Unfragmented Traffic 145
ACEs and Fragmented and Unfragmented Traffic Examples 146
ACLs and Switch Stacks 146
Active Switch and ACL Functions 146
Stack Member and ACL Functions 147
Active Switch Failure and ACLs 147
Standard and Extended IPv4 ACLs 147
IPv4 ACL Switch Unsupported Features 147
Access List Numbers 148
Numbered Standard IPv4 ACLs 149
Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX
viii OL-29048-01
Contents

Numbered Extended IPv4 ACLs 149
Named IPv4 ACLs 150
ACL Logging 150
Smart Logging 151
Hardware and Software Treatment of IP ACLs 151
VLAN Map Configuration Guidelines 151
VLAN Maps with Router ACLs 152
VLAN Maps and Router ACL Configuration Guidelines 152
Time Ranges for ACLs 153
IPv4 ACL Interface Considerations 153
How to Configure ACLs 154
Configuring IPv4 ACLs 154
Creating a Numbered Standard ACL 154
Creating a Numbered Extended ACL 156
Creating Named Standard ACLs 160
Creating Extended Named ACLs 161
Configuring Time Ranges for ACLs 163
Applying an IPv4 ACL to a Terminal Line 165
Applying an IPv4 ACL to an Interface 167
Creating Named MAC Extended ACLs 168
Applying a MAC ACL to a Layer 2 Interface 170
Configuring VLAN Maps 172
Creating a VLAN Map 174
Applying a VLAN Map to a VLAN 176
Configuring VACL Logging 177
Monitoring IPv4 ACLs 179
Configuration Examples for ACLs 180
Examples: Using Time Ranges with ACLs 180
Examples: Including Comments in ACLs 180
Examples: Troubleshooting ACLs 181
IPv4 ACL Configuration Examples 182
ACLs in a Small Networked Office 182
Examples: ACLs in a Small Networked Office 183
Example: Numbered ACLs 183
Examples: Extended ACLs 183
Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX
OL-29048-01 ix
Contents

Examples: Named ACLs 184
Examples: Time Range Applied to an IP ACL 185
Examples: Configuring Commented IP ACL Entries 185
Examples: ACL Logging 186
Configuration Examples for ACLs and VLAN Maps 187
Example: Creating an ACL and a VLAN Map to Deny a Packet 187
Example: Creating an ACL and a VLAN Map to Permit a Packet 187
Example: Default Action of Dropping IP Packets and Forwarding MAC Packets 187
Example: Default Action of Dropping MAC Packets and Forwarding IP Packets 188
Example: Default Action of Dropping All Packets 188
Configuration Examples for Using VLAN Maps in Your Network 189
Example: Wiring Closet Configuration 189
Example: Restricting Access to a Server on Another VLAN 190
Example: Denying Access to a Server on Another VLAN 190
Configuration Examples of Router ACLs and VLAN Maps Applied to VLANs 191
Example: ACLs and Switched Packets 191
Example: ACLs and Bridged Packets 192
Example: ACLs and Routed Packets 193
Example: ACLs and Multicast Packets 193
Additional References 194
Feature Information for IPv4 Access Control Lists 195
CHAPTER 11 Configuring IPv6 ACLs 197
Finding Feature Information 197
IPv6 ACLs Overview 197
Switch Stacks and IPv6 ACLs 198
Interactions with Other Features and Switches 198
Restrictions for IPv6 ACLs 199
Default Configuration for IPv6 ACLs 199
Configuring IPv6 ACLs 200
Attaching an IPv6 ACL to an Interface 203
Monitoring IPv6 ACLs 205
Additional References 206
CHAPTER 12 Configuring DHCP 209
Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX
xOL-29048-01
Contents

Finding Feature Information 209
Information About DHCP 209
DHCP Server 209
DHCP Relay Agent 209
DHCP Snooping 210
Option-82 Data Insertion 211
Cisco IOS DHCP Server Database 214
DHCP Snooping Binding Database 214
DHCP Snooping and Switch Stacks 216
How to Configure DHCP Features 216
Default DHCP Snooping Configuration 216
DHCP Snooping Configuration Guidelines 217
Configuring the DHCP Server 217
DHCP Server and Switch Stacks 217
Configuring the DHCP Relay Agent 218
Specifying the Packet Forwarding Address 219
Prerequisites for Configuring DHCP Snooping and Option 82 221
Enabling DHCP Snooping and Option 82 222
Enabling the Cisco IOS DHCP Server Database 226
Monitoring DHCP Snooping Information 226
Configuring DHCP Server Port-Based Address Allocation 226
Information About Configuring DHCP Server Port-Based Address Allocation 226
Default Port-Based Address Allocation Configuration 227
Port-Based Address Allocation Configuration Guidelines 227
Enabling the DHCP Snooping Binding Database Agent 227
Enabling DHCP Server Port-Based Address Allocation 229
Monitoring DHCP Server Port-Based Address Allocation 231
Additional References 231
Feature Information for DHCP Snooping and Option 82 232
CHAPTER 13 Configuring IP Source Guard 235
Finding Feature Information 235
Information About IP Source Guard 235
IP Source Guard 235
IP Source Guard for Static Hosts 236
Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX
OL-29048-01 xi
Contents

IP Source Guard Configuration Guidelines 237
How to Configure IP Source Guard 238
Enabling IP Source Guard 238
Configuring IP Source Guard for Static Hosts on a Layer 2 Access Port 239
Monitoring IP Source Guard 241
Additional References 242
CHAPTER 14 Configuring Dynamic ARP Inspection 243
Finding Feature Information 243
Restrictions for Dynamic ARP Inspection 243
Understanding Dynamic ARP Inspection 245
Interface Trust States and Network Security 246
Rate Limiting of ARP Packets 247
Relative Priority of ARP ACLs and DHCP Snooping Entries 248
Logging of Dropped Packets 248
Default Dynamic ARP Inspection Configuration 248
Relative Priority of ARP ACLs and DHCP Snooping Entries 249
Configuring ARP ACLs for Non-DHCP Environments 249
Configuring Dynamic ARP Inspection in DHCP Environments 252
Limiting the Rate of Incoming ARP Packets 255
Performing Dynamic ARP Inspection Validation Checks 257
Monitoring DAI 259
Verifying the DAI Configuration 260
Additional References 260
CHAPTER 15 Configuring IEEE 802.1x Port-Based Authentication 263
Finding Feature Information 263
Information About 802.1x Port-Based Authentication 263
Port-Based Authentication Process 264
Port-Based Authentication Initiation and Message Exchange 266
Authentication Manager for Port-Based Authentication 268
Port-Based Authentication Methods 268
Per-User ACLs and Filter-Ids 269
Port-Based Authentication Manager CLI Commands 269
Ports in Authorized and Unauthorized States 270
Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX
xii OL-29048-01
Contents

Port-Based Authentication and Switch Stacks 271
802.1x Host Mode 272
802.1x Multiple Authentication Mode 273
Multi-auth Per User VLAN assignment 273
Limitation in Multi-auth Per User VLAN assignment 274
MAC Move 275
MAC Replace 275
802.1x Accounting 276
802.1x Accounting Attribute-Value Pairs 276
802.1x Readiness Check 277
Switch-to-RADIUS-Server Communication 278
802.1x Authentication with VLAN Assignment 278
802.1x Authentication with Per-User ACLs 280
802.1x Authentication with Downloadable ACLs and Redirect URLs 281
Cisco Secure ACS and Attribute-Value Pairs for the Redirect URL 282
Cisco Secure ACS and Attribute-Value Pairs for Downloadable ACLs 282
VLAN ID-based MAC Authentication 283
802.1x Authentication with Guest VLAN 283
802.1x Authentication with Restricted VLAN 284
802.1x Authentication with Inaccessible Authentication Bypass 285
Inaccessible Authentication Bypass Support on Multiple-Authentication Ports 285
Inaccessible Authentication Bypass Authentication Results 286
Inaccessible Authentication Bypass Feature Interactions 286
802.1x Critical Voice VLAN 287
802.1x User Distribution 287
802.1x User Distribution Configuration Guidelines 288
IEEE 802.1x Authentication with Voice VLAN Ports 288
IEEE 802.1x Authentication with Port Security 289
IEEE 802.1x Authentication with Wake-on-LAN 289
IEEE 802.1x Authentication with MAC Authentication Bypass 290
Network Admission Control Layer 2 IEEE 802.1x Validation 291
Flexible Authentication Ordering 291
Open1x Authentication 292
Multidomain Authentication 292
Limiting Login for Users 294
Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX
OL-29048-01 xiii
Contents

802.1x Supplicant and Authenticator Switches with Network Edge Access Topology
(NEAT) 294
Voice Aware 802.1x Security 295
Common Session ID 296
How to Configure 802.1x Port-Based Authentication 296
Default 802.1x Authentication Configuration 296
802.1x Authentication Configuration Guidelines 298
802.1x Authentication 298
VLAN Assignment, Guest VLAN, Restricted VLAN, and Inaccessible Authentication
Bypass 299
MAC Authentication Bypass 300
Maximum Number of Allowed Devices Per Port 300
Configuring 802.1x Readiness Check 300
Configuring Voice Aware 802.1x Security 302
Configuring 802.1x Violation Modes 304
Configuring 802.1x Authentication 306
Configuring 802.1x Port-Based Authentication 307
Configuring the Switch-to-RADIUS-Server Communication 309
Configuring the Host Mode 311
Configuring Periodic Re-Authentication 312
Changing the Quiet Period 313
Changing the Switch-to-Client Retransmission Time 314
Setting the Switch-to-Client Frame-Retransmission Number 316
Setting the Re-Authentication Number 317
Enabling MAC Move 318
Enabling MAC Replace 319
Configuring 802.1x Accounting 321
Configuring a Guest VLAN 323
Configuring a Restricted VLAN 324
Configuring Number of Authentication Attempts on a Restricted VLAN 326
Configuring 802.1x Inaccessible Authentication Bypass with Critical Voice VLAN 328
Example of Configuring Inaccessible Authentication Bypass 331
Configuring 802.1x Authentication with WoL 332
Configuring MAC Authentication Bypass 333
Formatting a MAC Authentication Bypass Username and Password 334
Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX
xiv OL-29048-01
Contents

Configuring 802.1x User Distribution 335
Example of Configuring VLAN Groups 336
Configuring NAC Layer 2 802.1x Validation 337
Configuring Limiting Login for Users 339
Configuring an Authenticator Switch with NEAT 340
Configuring a Supplicant Switch with NEAT 342
Configuring 802.1x Authentication with Downloadable ACLs and Redirect URLs 345
Configuring Downloadable ACLs 345
Configuring a Downloadable Policy 347
Configuring VLAN ID-based MAC Authentication 350
Configuring Flexible Authentication Ordering 350
Configuring Open1x 352
Disabling 802.1x Authentication on the Port 354
Resetting the 802.1x Authentication Configuration to the Default Values 355
Monitoring 802.1x Statistics and Status 356
Additional References 357
Feature Information for 802.1x Port-Based Authentication 358
CHAPTER 16 Configuring Web-Based Authentication 359
Finding Feature Information 359
Web-Based Authentication Overview 359
Device Roles 360
Host Detection 361
Session Creation 361
Authentication Process 362
Local Web Authentication Banner 362
Web Authentication Customizable Web Pages 365
Guidelines 365
Authentication Proxy Web Page Guidelines 367
Redirection URL for Successful Login Guidelines 368
Web-based Authentication Interactions with Other Features 368
Port Security 368
LAN Port IP 368
Gateway IP 369
ACLs 369
Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX
OL-29048-01 xv
Contents

Context-Based Access Control 369
EtherChannel 369
How to Configure Web-Based Authentication 369
Default Web-Based Authentication Configuration 369
Web-Based Authentication Configuration Guidelines and Restrictions 370
Web-Based Authentication Configuration Task List 371
Configuring the Authentication Rule and Interfaces 371
Configuring AAA Authentication 373
Configuring Switch-to-RADIUS-Server Communication 375
Configuring the HTTP Server 377
Customizing the Authentication Proxy Web Pages 378
Specifying a Redirection URL for Successful Login 380
Configuring the Web-Based Authentication Parameters 381
Configuring a Web-Based Authentication Local Banner 382
Configuring Web-Based Authentication without SVI 384
Configuring Web-Based Authentication with VRF Aware 385
Removing Web-Based Authentication Cache Entries 387
Monitoring Web-Based Authentication Status 387
Feature Information for Web-Based Authentication 388
CHAPTER 17 Configuring Port-Based Traffic Control 389
Overview of Port-Based Traffic Control 390
Finding Feature Information 390
Information About Storm Control 390
Storm Control 390
How Traffic Activity is Measured 391
Traffic Patterns 391
How to Configure Storm Control 392
Configuring Storm Control and Threshold Levels 392
Configuring Small-Frame Arrival Rate 395
Finding Feature Information 397
Information About Protected Ports 397
Protected Ports 397
Default Protected Port Configuration 398
Protected Ports Guidelines 398
Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX
xvi OL-29048-01
Contents

How to Configure Protected Ports 398
Configuring a Protected Port 398
Monitoring Protected Ports 400
Where to Go Next 400
Additional References 400
Feature Information 401
Finding Feature Information 401
Information About Port Blocking 402
Port Blocking 402
How to Configure Port Blocking 402
Blocking Flooded Traffic on an Interface 402
Monitoring Port Blocking 404
Where to Go Next 404
Additional References 404
Feature Information 405
Prerequisites for Port Security 406
Restrictions for Port Security 406
Information About Port Security 406
Port Security 406
Types of Secure MAC Addresses 406
Sticky Secure MAC Addresses 407
Security Violations 407
Port Security Aging 408
Port Security and Switch Stacks 408
Default Port Security Configuration 409
Port Security Configuration Guidelines 409
Overview of Port-Based Traffic Control 411
How to Configure Port Security 411
Enabling and Configuring Port Security 411
Enabling and Configuring Port Security Aging 415
Finding Feature Information 417
Information About Storm Control 418
Storm Control 418
How Traffic Activity is Measured 418
Traffic Patterns 419
Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX
OL-29048-01 xvii
Contents

How to Configure Storm Control 419
Configuring Storm Control and Threshold Levels 419
Configuring Small-Frame Arrival Rate 422
Finding Feature Information 424
Information About Protected Ports 424
Protected Ports 424
Default Protected Port Configuration 425
Protected Ports Guidelines 425
How to Configure Protected Ports 425
Configuring a Protected Port 425
Monitoring Protected Ports 427
Where to Go Next 427
Additional References 427
Feature Information 428
Finding Feature Information 428
Information About Port Blocking 429
Port Blocking 429
How to Configure Port Blocking 429
Blocking Flooded Traffic on an Interface 429
Monitoring Port Blocking 431
Where to Go Next 431
Additional References 431
Feature Information 432
Configuration Examples for Port Security 432
Additional References 433
Finding Feature Information 434
Information About Protocol Storm Protection 434
Protocol Storm Protection 434
Default Protocol Storm Protection Configuration 435
How to Configure Protocol Storm Protection 435
Enabling Protocol Storm Protection 435
Monitoring Protocol Storm Protection 436
Additional References 437
CHAPTER 18 Configuring IPv6 First Hop Security 439
Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX
xviii OL-29048-01
Contents

Finding Feature Information 439
Prerequisites for First Hop Security in IPv6 439
Restrictions for First Hop Security in IPv6 440
Information about First Hop Security in IPv6 440
How to Configure an IPv6 Snooping Policy 442
How to Attach an IPv6 Snooping Policy to an Interface 444
How to Attach an IPv6 Snooping Policy to a Layer 2 EtherChannel Interface 445
How to Attach an IPv6 Snooping Policy to VLANs Globally 446
How to Configure the IPv6 Binding Table Content 447
How to Configure an IPv6 Neighbor Discovery Inspection Policy 449
How to Attach an IPv6 Neighbor Discovery Inspection Policy to an Interface 451
How to Attach an IPv6 Neighbor Discovery Inspection Policy to a Layer 2 EtherChannel
Interface 452
How to Attach an IPv6 Neighbor Discovery Inspection Policy to VLANs Globally 453
How to Configure an IPv6 Router Advertisement Guard Policy 454
How to Attach an IPv6 Router Advertisement Guard Policy to an Interface 456
How to Attach an IPv6 Router Advertisement Guard Policy to a Layer 2 EtherChannel Interface
458
How to Configure an IPv6 DHCP Guard Policy 459
How to Attach an IPv6 DHCP Guard Policy to an Interface or a VLAN on an Interface 461
How to Attach an IPv6 DHCP Guard Policy to a Layer 2 EtherChannel Interface 462
How to Attach an IPv6 DHCP Guard Policy to VLANs Globally 463
How to Configure IPv6 Source Guard 464
How to Attach an IPv6 Source Guard Policy to an Interface 466
Additional References 467
Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX
OL-29048-01 xix
Contents

Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX
xx OL-29048-01
Contents