Cisco Systems 4500 IP Source Guard for Static Hosts, IP Source Guard, Local Authentication, RADIUS, and TACACS+ Authentication, Network Admission Control

1-27
Software Configuration Guide—Release 15.0(2)SG
OL-23818-01
Chapter 1 Product Overview Security Features
Catalyst 4500 supervisor engines. It supports various Layer 2 and Layer 3 control protocols, such as
CDP, EAP OL, STP, DTP, VTP, ICM P, CG MP, I GMP, DHCP, RIPv2, OSPF, PIM, TELNET, SNMP,
HTTP, and packets destined to 224.0.0.* multicast link local addresses. Predefined system policies or
user-configurable policies can be applied to those control protocols.
Through Layer 2 Control Packet QoS, you can police control packets arriving on a physical port or
VLAN; it enables you to apply QoS on Layer 2 control packets
For information on control plane policing and Layer 2 control packet QoS, see Chapter 44, “Configuring
Control Plane Policing and Layer 2 Control Packet QoS.”
IP Source Guard for Static Hosts
This feature allows you to secure the IP address learned from static hosts by using ARP packets and then
bind that IP address to a given MAC address using the device tracking database, allowing entries to
survive through link down events.
IP Source Guard (IPSG) for static hosts allows multiple bindings per-port per-MAC address for both
DHCP and static hosts, in both device tracking database and DHCP snooping binding database. The
feature allows you to take action when a limit is exceeded.
For information on configuring IPSG for static hosts, see Chapter 45, “Configuring DHCP Snooping, IP
Source Guard, and IPSG for Static Hosts.”
IP Source Guard
Similar to DHCP snooping, this feature is enabled on an untrusted Layer 2 port that is configured for
DHCP snooping. Initially all IP traffic on the port is blocked except for the DHCP packets, which are
captured by the DHCP snooping process. When a client receives a valid IP address from the DHCP
server, a PVACL is installed on the port, which restricts the client IP traffic only to clients with assigned
IP addresses, so any IP traffic with source IP addresses other than those assigned by the DHCP server
will be filtered out. This filtering prevents a malicious host from attacking a network by hijacking
neighbor host's IP address.
For information on configuring IP Source Guard, see Chapter 45, “Configuring DHCP Snooping, IP
Source Guard, and IPSG for Static Hosts.”
Local Authentication, RADIUS, and TACACS+ Authentication
Local Authentication, Remote Authentication Dial-In User Service (RADIUS), and Terminal Access
Controller Access Control System Plus (TACACS+) authentication methods control access to the switch.
For additional information, refer to the following URL:
http://www.cisco.com/en/US/docs/ios/sec_user_services/configuration/guide/sec_cfg_authentifcn_ps635
0_TSD_Products_Configuration_Guide_Chapter.html
Network Admission Control
Network Admission Control consists of two features:
• NAC Layer 2 IP validation