Security for Cisco 3650 from Attack

[CSCO12094806]

Hi, we are in the process of rebuilding our datacenter.

we are planning to use Cisco 3650 switch (WS-C3650-24TD-S, with UNIVERSAL ios) will handle the L2 role (only vlan switching).

HL Network Diagram is attached below.

all devices have ha (two perimeter firewall, two 3650 switch, 2 vmware host server).

internal /data-center firewall as a virtual firewall running on vmware cluster, and its handle data-center intervlan routing (Vlan 110, 120, 140).

So CISCO 3650 only take Layer2 role (Vlan Tagging).

KINDLY HELP US /ADVICE HOW WE CAN PROTECT OUR INTERNAL SWITCH FROM ATTACK (like DoS /suggest possible protections to internal switch for our design)

[Julio E. Moisa]

Hi,

You can:

- configure storm-control under the interfaces

- configuring CoPP policy https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3650/software/release/16-1/configuration_guide/b_161_consolidated_3650_cg/b_161_consolidated_3650_cg_chapter_010001101.pdf

Hope it is useful

:-)

[Francesco Molino]

Hi

In addition to what Julio said, you can harden your switch using different features like:
- storm-control
- CoPP policy for traffic
- Control-plan host to force only a dedicated interface as management with specific features..
- ....

Take a look on official Cisco doc: https://www.cisco.com/c/en/us/support/docs/ip/access-lists/13608-21.html