Selection & Interfaces

Chapter 5 — Core Switch Security Hardening Design Guide

Selecting the right core switch platform is a foundational decision that determines which security features are available, how they can be configured, and what limitations must be worked around. Not all enterprise-grade core switches support the full spectrum of hardening controls described in this guide. Platform selection must therefore be driven not only by performance and port density requirements, but also by the security feature set, software quality, and vendor security posture.

This chapter presents the core product categories, their typical security feature capabilities, and the interface and port logic that governs how security zones are physically and logically implemented. The interface logic diagram provides a visual reference for understanding how port groups map to security zones and which security policies apply to each port type.

5.1 Core Product Introduction

Core switches for security-hardened deployments fall into three primary categories based on chassis architecture and port density. Each category has distinct security feature capabilities, scalability characteristics, and operational considerations. The following figure illustrates representative products from each category.

Figure 5.1: Core Switch Product Categories — Left: 400G Modular Chassis Core Switch (10U, multi-line-card); Center: 25G/100G Fixed-Configuration Leaf/Aggregation Switch (2U); Right: 100G Fixed-Configuration Spine Switch (2U, 64-port)

Core Product Feature Comparison Table

The following table provides a comprehensive comparison of security-relevant features across the three core switch product categories. Features marked as "Full" are natively supported with hardware acceleration. "Partial" indicates software-only support or limited scale. "N/A" indicates the feature is not available on that platform category.

5.2 Interface and Port Logic Diagram

The interface and port logic diagram provides a comprehensive view of how physical ports are organized into security zones, what naming conventions apply, and which security policies are assigned to each port group. This diagram serves as the definitive reference for port configuration and security policy assignment during deployment.

Figure 5.2: Interface and Port Logic Diagram — Front Panel Port Groups (Uplink/Orange, Peer-Link/Red, Production/Blue, OOB/Green), Logical Security Zone Mapping, Interface Naming Convention, and Port Security Policy Assignment Matrix

Interface Security Policy Assignment

The following table defines the mandatory security policies for each interface type. These policies must be applied consistently across all core switches in the deployment. Deviations from this table require documented risk acceptance and compensating controls.

5.3 TCAM Capacity Planning

TCAM (Ternary Content-Addressable Memory) is a finite hardware resource that stores ACL entries, routing table entries, ARP/MAC tables, and other forwarding state. Security hardening features such as extended ACLs, IP Source Guard, and RPKI route origin validation all consume TCAM entries. TCAM exhaustion causes security features to fail silently or fall back to software processing, which can dramatically impact performance and security posture. TCAM capacity planning must be performed before enabling security features in production.