Omissions like this typically mean that the switches have not gone through ISE QA testing even if individual product teams have validated security functions. I do know the 9k series are being qualified but cannot provide date and specific release at this time.
The switches are certainly supported with ISE, but it becomes more of a question of which features will function based on the particular model and feature set. For example, the 2960-L is based on LAN Lite. This feature set does not include all of the Identity features of LAN Base, for example, but does support standard RADIUS and TACACS+ auth. Per 2960-L data sheet:
- Comprehensive 802.1X features to control access to the network, including flexible authentication, 802.1X monitor mode, and RADIUS change of authorization.
- Multi-domain authentication allows an IP phone and a PC to authenticate on the same switch port while placing them on appropriate voice and data VLANs.
- Access control lists (ACLs) for IPv6 and IPv4 for security and quality-of-service (QoS) ACL elements (ACEs):
- Port-based ACLs for Layer 2 interfaces allow security policies to be applied on individual switch ports.
Past versions of LAN Lite did not include RADIUS CoA support, so that is a big plus for the 2960-L.
For both series of switches, I recommend the capabilities of the feature set to determine if they will meet your needs both now and in the future. Another useful tool is Feature Navigator.
Craig
