Top Recommended Models
Cisco Catalyst 9300
The default for campus switching, with UADP ASICs that extract Encrypted Traffic Analytics metadata in silicon rather than on the CPU. Be precise about what ETA does, because the marketing is not: it does not identify malware in TLS streams. It exports handshake and flow characteristics — packet length and timing sequences, the initial data packet, ClientHello attributes — which a separate analytics platform scores against known behaviour. The switch produces evidence; something else, licensed separately, produces the verdict. Without that second half you have telemetry nobody reads.
Juniper EX4400
The Junos alternative, with Group-Based Policy for segmentation that follows the endpoint rather than the port, and a hard separation between the routing engine and the packet forwarding engines. That separation is the property worth paying for — a forwarding-plane flood does not take the control plane with it. The practical cost of GBP, as with any identity-based segmentation, is that policy now depends on classification being right, and a device that classifies into the wrong group gets the wrong access silently. Segmentation failures do not throw errors; they just permit.
Under the Hood Architecture
Dynamic Shared Buffers (Cisco)
Shared buffers allocated dynamically across ports absorb microbursts — the sub-millisecond spikes from storage arrays and backup jobs that never appear in a five-minute utilisation graph. This matters more than it sounds for security work, because buffer exhaustion drops packets silently, and packets dropped at the switch never reach your sensor. An IDS blind spot created by a busy backup window looks exactly like a quiet night.
PFE Micro-Architecture (Juniper)
Forwarding decisions resolve in the PFE against hardware MAC tables, so a broadcast storm is absorbed in silicon instead of climbing onto the routing engine. The limit is table size, and it is a real one: MAC and TCAM tables are finite, and a switch that overflows its MAC table falls back to flooding — which is both a performance problem and, from an attacker's point of view, the entire objective. MAC flooding is an old technique that still works wherever port security is not configured.
Real-World Attack Surface
Layer 2 Trusts By Default
Every protocol that makes a switched network work — ARP, DHCP, STP, CDP/LLDP, DTP — was designed for a trusted medium and authenticates nothing. An unconfigured access port will accept a rogue DHCP server, believe a forged ARP reply, and in some default configurations negotiate a trunk with whatever plugs into it. None of that requires a vulnerability; it is the protocols working as specified. The controls below exist because the defaults do not defend anything.
Crafted Packets Reach Real Code
Both vendors ship regular advisories for crashes reachable by adjacent, unauthenticated attackers sending malformed protocol packets — multicast handling and tunnel parsing are recurring themes on both platforms. Switch firmware is software, and it is software that almost nobody patches on a schedule because the maintenance window is disruptive and the device has been up for four years. That uptime is the risk, not the achievement.
Mandatory Hardening Baseline
- Disable Web UI:
no ip http serverandno ip http secure-server, SSHv2 only. Switch web interfaces have a long advisory history and exist for a workflow nobody in a managed estate uses — you are deleting attack surface you were not using. - Control Plane Protection: CoPP limits what can reach the switch's own CPU. Build the policy from measured baselines, not from an example config — a limit set too aggressively drops your own routing protocol packets during convergence, which is the one moment you cannot afford it, and the outage will not look like a CoPP problem.
- Port-Level 802.1X: the only control that actually answers "who plugged that in", with MACsec on top where physical access to cabling is in scope. Budget properly for the rollout, because the hard part is not the switches — it is the printers, badge readers, cameras and lab equipment that cannot do 802.1X and end up on MAB, and a MAB exemption list is a list of MAC addresses anyone can spoof. Keep it short and review it, or you have deployed the friction without the control.
- DHCP Snooping and DAI: snooping builds the binding table of which address belongs to which port, and Dynamic ARP Inspection uses it to reject forged ARP replies — together they close off the classic on-path attack. Two things to get right: uplinks must be trusted or you will break DHCP for the whole floor, and DAI depends entirely on the binding table, so statically addressed hosts need manual entries or they lose ARP silently after the next reboot.
Architecture Comparison
| Component | Cisco Catalyst 9300 | Juniper EX4400 |
|---|---|---|
| Packet Buffer | Dynamic shared buffers in ASIC | PFE-managed discrete port queuing |
| Encrypted Traffic Analytics | Native hardware ETA | Requires external NDR/telemetry |
| Control Plane Policing | Hardcoded micro-queues to CPU | Strict RE/PFE separation |
| Backplane | StackWise-1T (1 TB bandwidth) | Virtual Chassis (VC) over QSFP |
