VLAN: Support for up to 256 VLANs simultaneously (out of 4096 VLAN IDs)
Port-based and 802.1Q tag-based VLANs
MAC-based VLAN
Management VLAN
Private VLAN Edge, also known as protected ports, with multiple uplinks
Guest VLAN
Unauthenticated VLAN

Voice VLAN: Voice traffic is automatically assigned to a voice-specific VLAN and treated with appropriate levels of QoS

Q-in-Q VLAN: VLANs transparently cross a service provider network while isolating traffic among customers

Generic VLAN Registration Protocol/Generic Attribute Registration Protocol: Protocols for automatically propagating and configuring VLANs in a bridged domain

Dynamic Host Configuration Protocol Relay at Layer 2: Relay of DHCP traffic to DHCP server in different VLAN. Works with DHCP Option 82

Internet Group Management Protocol Versions 1, 2 and 3 snooping: IGMP limits bandwidth-intensive multicast traffic to only the requesters; supports 256 multicast groups (source-specific multicasting is also supported)

IGMP Querier: IGMP querier is used to support a Layer 2 multicast domain of snooping switches in the absence of a multicast router

Head-of-Line (HOL) Blocking: HOL blocking prevention

DHCP Relay at Layer 3: Relay of DHCP traffic across IP domains

User Datagram Protocol Relay: Relay of broadcast information across Layer 3 domains for application discovery or relaying of BootP/DHCP packets

Secure Sockets Layer: SSL support: Encrypts all HTTPS traffic, allowing highly secure access to the browser-based management GUI in the switch

IEEE 802.1X (Authenticator role): RADIUS authentication and accounting, MD5 hash; guest VLAN; unauthenticated VLAN, single/multiple host mode and single/multiple sessions
Supports time-based 802.1X
Dynamic VLAN assignment

STP Bridge Protocol Data Unit Guard: A security mechanism to protect the network from invalid configurations.
A port enabled for BPDU Guard is shut down if a BPDU message is received on that port

Secure Core Technology: Ensures that the switch will receive and process management and protocol traffic no matter how much traffic is received

Layer 3 Isolation: Allow/disallow routing between IP subnets or directly connected IP networks

Layer 2 Isolation Private VLAN Edge (PVE) with community VLAN: PVE (also known as protected ports) provides Layer 2 isolation between devices in the same VLAN, supports multiple uplinks

Port Security: Locks MAC addresses to ports, and limits the number of learned MAC addresses

RADIUS/TACACS+: Supports RADIUS and TACACS authentication. Switch functions as a client

Storm Control: Broadcast, multicast and unknown unicast

DoS Prevention: DoS attack prevention

Congestion Avoidance: A TCP congestion avoidance algorithm is required to minimize and prevent global TCP loss synchronization.

ACLs: Support for up to 512 rules
Drop or rate limit based on source and destination MAC, VLAN ID or IP address, protocol, port, differentiated services code point/IP precedence, TCP/ UDP source and destination ports, 802.1p priority, Ethernet type, Internet Control Message Protocol packets, IGMP packets, TCP flag

Scheduling: Strict priority and weighted round-robin
Queue assignment based on DSCP and class of service (802.1p/CoS)

Class of Service: Port based; 802.1p VLAN priority based; IPv4/v6 IP precedence/type of service/DSCP based; Differentiated Services (DiffServ); classification and re-marking ACLs, trusted QoS

Rate Limiting: Ingress policer; egress shaping and rate control; per VLAN, per port and flow based

IPv6 ACL: Drop or rate limit IPv6 packets in hardware

Multicast Listener Discovery Snooping: Deliver IPv6 multicast packets only to the required receivers

IPv6 Applications: Web/SSL, Telnet server/SSH, ping, traceroute, Simple Network Time Protocol, Trivial File Transfer Protocol, SNMP, RADIUS, syslog, DNS client, protocol-based VLANs

IPv6 RFCs Supported: RFC 2463 - ICMP version 6
RFC 3513 - IPv6 address architecture
RFC 4291 - IPv6 addressing architecture
RFC 2460 - IPv6 specification
RFC 2461 - Neighbor discovery for IPv6
RFC 2462 - IPv6 stateless address auto-configuration
RFC 1981 - Path MTU discovery
RFC 4007 - IPv6 scoped address architecture
RFC 3484 - Default address selection mechanism
RFC 4214 - ISATAP tunneling
RFC 4293 - MIB IPv6: Textual conventions and general group
RFC 3595 - Textual conventions for IPv6 flow label

SNMP: SNMP versions 1, 2c, and 3 with support for traps, and SNMP version 3 user-based security model

Remote Monitoring: Embedded RMON software agent supports 4 RMON groups (history, statistics, alarms and events) for enhanced traffic management, monitoring and analysis

IPv4 and IPv6 Dual Stack: Coexistence of both protocol stacks to ease migration

Firmware Upgrade: Web browser upgrade (HTTP/HTTPS) and TFTP
Upgrade can be initiated through console port as well
Dual images for resilient firmware upgrades

Port Mirroring: Traffic on a port can be mirrored to another port for analysis with a network analyzer or RMON probe. Up to 8 source ports can be mirrored to one destination port. A single session is supported

VLAN Mirroring: Traffic from a VLAN can be mirrored to a port for analysis with a network analyzer or RMON probe. Up to 8 source VLANs can be mirrored to one destination port. A single session is supported

Dynamic Host Configuration Protocol (Options 66, 67, 82, 129 and 150): DHCP Options facilitate tighter control from a central point (DHCP server) to obtain IP address, auto-configuration (with configuration file download) and DHCP relay

Text-Editable Config Files: Config files can be edited with a text editor and downloaded to another switch, facilitating easier mass deployment

Smartports: Simplified configuration of QoS and security capabilities

Auto Smartports: Applies the intelligence delivered through the Smartport roles and applies it automatically to the port based on the devices discovered over CDP or LLDP-MED. This facilitates zero touch deployments

Textview CLI: Scriptable command-line interface. A full CLI as well as a menu-based CLI is supported

Cloud Services: Support for Cisco Small Business FindIT Network Discovery Utility

Localization: Localization of GUI and documentation into multiple languages

Other Management: Traceroute; single IP management; HTTP/HTTPS; SSH; RADIUS; port mirroring; TFTP upgrade; DHCP client; BOOTP; SNTP; Xmodem upgrade; cable diagnostics; ping; syslog; Telnet client (SSH secure support)

MAC Table: Up to 8000 MAC addresses

Link Layer Discovery Protocol (802.1ab) with LLDP-MED extensions: LLDP allows the switch to advertise its identification, configuration, and capabilities to neighboring devices that store the data in a MIB. LLDP-MED is an enhancement to LLDP that adds the extensions needed for IP phones

Cisco Discovery Protocol: The switch advertises itself using the Cisco Discovery Protocol

Number of Ports That Support PoE: 8