Cisco Enhances Security Features Amidst Patch Absence

Cisco has introduced a series of advancements in the networking sector, notably unveiling new Smart Switches from the Catalyst 9000 series specifically designed for campus environments. This announcement follows earlier developments in the data center segment with the Nexus 9000 Smart Switches, created in collaboration with AMD Pensando. Aimed at bolstering network security, Cisco is implementing its Hypershield security solution to better manage data traffic between end devices.

The Catalyst 9350 Smart Switches, designed for access areas, and the Catalyst 9610 Smart Switches, which cater to core and distribution layers, represent the latest offerings. Both models are built on the unified Silicon One architecture, allowing for programmable application slices on the ASIC, which enables specific applications to run directly on the ASIC, supported by a co-processor.

One of the significant features highlighted is the Hypershield security solution, which operates as an agent on these switches. In instances where a component has a security vulnerability without an available patch, Hypershield can implement compensatory controls and segmentation policies at the switch level to block malicious traffic patterns. This functionality allows the switches to act as enforcement points within the Universal Zero Trust Network Access (UZTNA) framework. For highly sensitive data flows, Cisco is introducing a feature called Security Service Insertion, which facilitates the directed traffic flow to specialized next-generation firewalls equipped with Layer 7 intelligence, such as integrated Intrusion Prevention Systems (IPS). This approach maximizes the utilization of existing security and network resources and integrates with platforms like ThousandEyes and Splunk to enhance visibility into network and application performance and security.

In addition to these security enhancements, the new switches bring several upgrades over their predecessors in the 9300 and 9600 series. The 9350 series features a rack unit design supporting UPoE+ with power up to 90 watts, compliant with the 802.3bt Class 8 standard, and offers MultiGigabit Ethernet capabilities of up to 10G in downlink and 100G in uplinks, addressing the increasing demands for bandwidth and power in Wi-Fi environments. However, it is noted that VXLAN is not supported by these switches. Furthermore, they are expected to support post-quantum resistant algorithms for MACsec, IPsec, and WAN MACsec for link encryption.

Within the UZTNA framework, these new switches serve as enforcement points, rigorously applying security policies. The Catalyst 9610 switches feature a modular chassis with ten slots across 18 rack units, capable of supporting throughput of up to 6.4 terabits per second per slot. Weighing over 120 kilograms, these switches are designed for integration into large-scale installations. They support dual redundant supervisors and StackWise Virtual technology, allowing two chassis to operate as a single logical unit, with connectivity options including up to 256 × 100G QSFP28 or 16 × 400G QSFP-DD ports. Each switch is equipped with eight power supplies and four fan units, along with 8GB of Quality of Service (QoS) buffer with hierarchical QoS, and compatibility with MACsec and VXLAN for Cisco's Software Defined Access (SDA) or BGP-EVPN environments. Both models run on the reliable IOS-XE operating system.

Another notable product launch is Cisco's CW9179F Wi-Fi 7 Access Point series, tailored for high-density user environments such as stadiums. This series is designed to adapt flexibly using software-controlled beam switching, allowing for adjustable radio coverage in three configurations, enabling dynamic responses to changing user behavior and device distribution. The access points feature dual 4x4:4 antennas in the 5 GHz band and single 4x4:4 antennas in both 2.4 GHz and 6 GHz bands, providing both unidirectional and non-omnidirectional coverage, along with two 10G uplinks for redundancy and link aggregation.

With the introduction of the Cisco Campus Gateway, customers currently utilizing on-premises controllers for centralized traffic management can seamlessly transition to the Meraki platform without altering their existing network architecture. This setup allows access points to tunnel traffic to the central Campus Gateway, which then directs the data centrally. This change enhances the ability to support up to 5,000 access points and 50,000 clients, making it particularly advantageous for guest Wi-Fi networks by efficiently tunneling traffic into designated WLAN DMZs.

Furthermore, Cisco is standardizing management processes by launching a new unified interface for both on-premises and Meraki cloud management. This initiative represents a long-anticipated consolidation following the alignment of access points and licensing models.