Switching Capacity

1.19mpps (64-byte packets)

Spanning Tree Protocol

Standard 802.1d Spanning Tree support

Fast convergence using 802.1w (Rapid Spanning Tree [RSTP]), enabled by default

16 instances are supported

Multiple Spanning Tree instances using 802.1s (MSTP)

Port Grouping

Support for IEEE 802.3ad Link Aggregation Control Protocol (LACP)

-Up to 8 groups

-Up to 8 ports per group with 16 candidate ports for each (dynamic) 802.3ad link aggregation

VLANs

VLAN

Support for up to 4096 VLANs simultaneously

Port-based and 802.1Q tag-based VLANs

MAC-based VLAN

Management VLAN

Private VLAN Edge (PVE), also known as protected ports, with multiple uplinks

Guest VLAN

Unauthenticated VLAN

Dynamic VLAN assignment via Radius server along with 802.1x client authentication

Protocol-based VLAN

CPE VLAN

Voice VLAN

Voice traffic is automatically assigned to a voice-specific VLAN and treated with appropriate levels of QoS

Auto voice capabilities deliver network-wide zero touch deployment of voice endpoints and call control devices

Multicast TV VLAN

Multicast VLAN used for video applications (Also known as MVR)

Q-in-Q VLAN

VLANs transparently cross a service provider network while isolating traffic among customers

Generic VLAN Registration Protocol (GVRP)/Generic Attribute Registration Protocol (GARP)

Protocols for automatically propagating and configuring VLANs in a bridged domain

Dynamic Host Configuration Protocol (DHCP)

Relay at Layer 2

Relay of DHCP traffic to DHCP server in different VLAN Works with DHCP Option 82

IGMP Snooping

Versions 1, 2, and 3 Snooping

IGMP limits bandwidth-intensive multicast traffic to only the requesters; supports 1K multicast groups (source-specific multicasting is also supported)

IGMP Querier

IGMP querier is used to support a Layer 2 multicast domain of snooping switches in the absence of a multicast router

Head-of-Line (HOL) Blocking

HOL blocking prevention

Jumbo Frames

Up to 10K in length

IPv4 Routing

Wirespeed routing of IPv4 packets

Up to 32 static routes and up to 32 IP interfaces

DHCP

Relay at Layer 3

Relay of DHCP traffic across IP domains

Relay Mode

User Datagram Protocol (UDP)

Relay of broadcast information across Layer 3 domains for application discovery or relaying of BootP/DHCP packets

Reliability / Protection / Security

Security

Secure Shell (SSH) Protocol

SSH is a secure replacement for Telnet traffic. SCP also uses SSH. SSH v1 and v2 are supported

Secure Socket Layer (SSL)

SSL support: Encrypts all HTTPS traffic, allowing highly secure access to the browser-based management GUI in the switch

IEEE 802.1X (Authenticator Role)

802.1X: RADIUS authentication and accounting, MD5 hash; guest VLAN; unauthenticated VLAN, single/multiple host mode and single/multiple sessions

Supports time-based 802.1X

Dynamic VLAN assignment

STP Bridge Protocol Data Unit

A security mechanism to protect the network from invalid configurations. A port enabled for BPDU Guard is shut down if a BPDU message is received on that port

STP Root Guard

Prevents a port from being selected as a root port, effectively preventing bridges in the LAN segment connected to the port from being a root bridge

DHCP Snooping

Filters out DHCP messages with unregistered IP addresses and/or from unexpected or untrusted interfaces. This prevents rogue devices from behaving as a DHCP Server

IP Source Guard (IPSG)

When IP Source Guard is enabled at a port, the switch filters out IP packets received from the port if the source IP addresses of the packets have not been statically configured or dynamically learned from DHCP snooping. This prevents IP Address Spoofing

Dynamic ARP Inspection (DAI)

The switch discards ARP packets from a port if there is no static or dynamic IP/MAC bindings or if there is a discrepancy between the source or destination address in the ARP packet. This prevents man-in-the-middle attacks

IP/Mac/Port Binding (IPMB)

The features (DHCP Snooping, IP Source Guard, and Dynamic ARP Inspection) above work together to prevent DOS attacks in the network, thereby increasing network availability

Secure Core Technology(SCT)

Ensures that the switch will receive and process management and protocol traffic no matter how much traffic is received

Secure Sensitive Data (SSD)

A mechanism to manage sensitive data (such as passwords, keys, etc) securely on the switch, populating this data to other devices, and secure autoconfig. Access to view the sensitive data as plaintext or encrypted is provided according to the user configured access level and the access method of the user

Layer 2 Isolation Private VLAN Edge (PVE) with Community VLAN

PVE (also known as protected ports) provides Layer 2 isolation between devices in the same VLAN, supports multiple uplinks

Port Security

Locks MAC addresses to ports, and limits the number of learned MAC addresses

RADIUS/TACACS+

Supports RADIUS and TACACS authentication. Switch functions as a client

Storm Control

Broadcast, multicast, and unknown unicast

RADIUS Accounting

The RADIUS accounting functions allow data to be sent at the start and end of services, indicating the amount of resources (such as time, packets, bytes, and so on) used during the session

DoS Prevention

DoS attack prevention

Congestion Avoidance

A TCP congestion avoidance algorithm is required to minimize and prevent global TCP loss synchronization

ACLs

Support for up to 512 rules

Drop or rate limit based on source and destination MAC, VLAN ID or IP address, protocol, port, differentiated services code point (DSCP)/IP precedence, TCP/ UDP source and destination ports, 802.1p priority, Ethernet type, Internet Control Message Protocol (ICMP) packets, IGMP packets, TCP flag, Time-based ACLs supported

Quality of Service

Priority Levels

4 hardware queues

Scheduling

Strict priority and weighted round-robin (WRR)

Queue assignment based on DSCP and class of service (802.1p/CoS)

Class of Service

Port based; 802.1p VLAN priority based; IPv4/v6 IP precedence/type of service (ToS)/DSCP based; Differentiated Services (DiffServ); classification and re-marking ACLs, trusted QoS

Rate Limiting

Ingress policer; egress shaping and rate control; per VLAN, per port, and flow based

IPv6

IPv6

IPv6 host mode

IPv6 over Ethernet

Dual IPv6/IPv4 stack

IPv6 neighbor and router discovery (ND)

IPv6 stateless address auto-configuration

Path maximum transmission unit (MTU) discovery

Duplicate address detection (DAD)

ICMP version 6

IPv6 over IPv4 network with Intra-Site Automatic Tunnel Addressing Protocol (ISATAP) support

USGv6 and IPv6 Gold Logo certified

IPv6 QoS

Prioritize IPv6 packets in hardware

IPv6 ACL

Drop or rate limit IPv6 packets in hardware

Multicast Listener Discovery (MLD) Snooping

Deliver IPv6 multicast packets only to the required receivers

IPv6 Applications

Web/SSL, Telnet server/SSH, ping, traceroute, Simple Network Time Protocol (SNTP), Trivial File Transfer Protocol (TFTP), SNMP, RADIUS, syslog, DNS client, protocol-based VLANs

IPv6 RFCs Supported

Management

Web User Interface

Built-in switch configuration utility for easy browser-based device configuration (HTTP/HTTPS). Supports configuration, system dashboard, system maintenance, and monitoring

SNMP

SNMP versions 1, 2c, and 3 with support for traps, and SNMP version 3 user-based security model (USM)

Standard MIBS

Remote Monitoring

Embedded RMON software agent supports 4 RMON groups (history, statistics, alarms, and events) for enhanced traffic management, monitoring, and analysis

IPv4 and IPv6 Dual Stack

Coexistence of both protocol stacks to ease migration

Firmware Upgrade

Web browser upgrade (HTTP/HTTPS) and TFTP

Upgrade can be initiated through console port as well

Dual images for resilient firmware upgrades

Port Mirroring

Traffic on a port can be mirrored to another port for analysis with a network analyzer or RMON probe. Up to 8 source ports can be mirrored to one destination port. A single session is supported

VLAN Mirroring

Traffic from a VLAN can be mirrored to a port for analysis with a network analyzer or RMON probe. Up to 8 source VLANs can be mirrored to one destination port. A single session is supported

Certifications

UL (UL 60950), CSA (CSA 22.2), CE mark, FCC Part 15 (CFR 47) Class A

Power

100-240V 47-63 Hz, internal, universal - SF300-24, SF300-24P, SG300-20, SG300-28, SG300-28P, SG300-52

100-240V 50-60 Hz, 0.5A, external - SF300-08, SF302-08, SG300-10

100-240V 50-60 Hz, 2A, external - SF302-08P, SG300-10P

100-240V 50-60 Hz, 2.5A, external - SF302-08MP, SG300-10MP

Dimensions (WxHxD)

11 x 1.45 x 6.7' / 279.4 x 44.45 x 170 mm

Weight

2.56 lb / 1.16 kg