1-4
Catalyst 3550 Multilayer Switch Software Configuration Guide
78-11194-09
Chapter 1 Overview
Features
–
BPDU guard for shutting down Port Fast-enabled ports that receive BPDUs
–
BPDU filtering for preventing a Port Fast-enabled port from sending or receiving BPDUs
–
Root guard for preventing switches outside the network core from becoming the spanning-tree
root
–
Loop guard for preventing alternate or root ports from becoming designated ports because of a
failure that leads to a unidirectional link
Note The switch supports up to 128 spanning-tree instances.
VLAN Support
• Support for up to 1005 VLANs for assigning users to VLANs associated with appropriate network
resources, traffic patterns, and bandwidth
• Support for VLAN IDs in the full 1 to 4094 range allowed by the IEEE 802.1Q standard
• VLAN Query Protocol (VQP) for dynamic VLAN membership
• Inter-Switch Link (ISL) and IEEE 802.1Q trunking encapsulation on all ports for network moves,
adds, and changes; management and control of broadcast and multicast traffic; and network security
by establishing VLAN groups for high-security users and network resources
• Dynamic Trunking Protocol (DTP) for negotiating trunking on a link between two devices and for
negotiating the type of trunking encapsulation (802.1Q or ISL) to be used
• VLAN Trunking Protocol (VTP) and VTP pruning for reducing network traffic by restricting
flooded traffic to links destined for stations receiving the traffic
• Voice VLAN for creating subnets for voice traffic from Cisco IP Phones
• VLAN 1 minimization to reduce the risk of spanning-tree loops or storms by allowing VLAN 1 to
be disabled on any individual VLAN trunk link. With this feature enabled, no user traffic is sent or
received. The switch CPU continues to send and receive control protocol frames.
Security
• Password-protected access (read-only and read-write access) to management interfaces (CMS and
CLI) for protection against unauthorized configuration changes
• Multilevel security for a choice of security level, notification, and resulting actions
• Static MAC addressing for ensuring security
• Protected port option for restricting the forwarding of traffic to designated ports on the same switch
• Port security option for limiting and identifying MAC addresses of the stations allowed to access
the port
• Port security on trunk ports for limiting and identifying MAC addresses of the stations allowed to
access the VLAN
• Port security aging to set the aging time for secure addresses on a port
• DHCP snooping to filter untrusted DHCP messages between untrusted hosts and DHCP servers
• Bridge protocol data unit (BPDU) guard for shutting down a Port Fast-configured port when an
invalid configuration occurs
• Standard and extended IP access control lists (ACLs) for defining security policies in both directions
on routed interfaces (router ACLs) and inbound on Layer 2 interfaces (port ACLs)
To Next Page