Cisco Catalyst 2960-XR Security Configuration Manual page 37

Security Features Overview
OL-29434-01
◦ Support for VLAN assignment on a port configured for multi-auth mode. The RADIUS server
assigns a VLAN to the first host to authenticate on the port, and subsequent hosts use the same
VLAN. Voice VLAN assignment is supported for one IP phone.
To use this feature, the switch must be running the LAN Base image.
Note
◦ Port security for controlling access to 802.1x ports.
◦ Voice VLAN to permit a Cisco IP Phone to access the voice VLAN regardless of the authorized
or unauthorized state of the port.
◦ IP phone detection enhancement to detect and recognize a Cisco IP phone.
◦ Guest VLAN to provide limited services to non-802.1x-compliant users.
◦ Restricted VLAN to provide limited services to users who are 802.1x compliant, but do not have
the credentials to authenticate via the standard 802.1x processes.
To use authentication with restricted VLANs, the switch must be running the LAN Base
Note
image.
◦ 802.1x accounting to track network usage.
◦ 802.1x with wake-on-LAN to allow dormant PCs to be powered on based on the receipt of a specific
Ethernet frame.
◦ 802.1x readiness check to determine the readiness of connected end hosts before configuring IEEE
802.1x on the switch.
Note To use 802.1x readiness check, the switch must be running the LAN Base image.
◦ Voice aware 802.1x security to apply traffic violation actions only on the VLAN on which a security
violation occurs.
To use voice aware 802.1x authentication, the switch must be running the LAN Base
Note
image.
◦ MAC authentication bypass (MAB) to authorize clients based on the client MAC address.
To use MAC authentication bypass, the switch must be running the LAN Base image.
Note
◦ Network Admission Control (NAC) Layer 2 802.1x validation of the antivirus condition or posture
of endpoint systems or clients before granting the devices network access.
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
Security Features Overview
15