Every switch port known — and changed the same way everywhere

Contents

1. 1Executive summary
2. 2The challenge
3. 3Architecture
4. 4How it works
5. 5Capabilities in detail
6. 6Security and data handling
7. 7Where it fits
8. 8Deployment and system requirements
9. 9Technical specifications
10. 10Getting started

1Executive summary

CampusGrid reads every switch, access point and controller over SNMP and applies port profiles over SSH in each vendor’s own commands, shown before they are sent and kept after.

2The challenge

Switches are configured port by port over SSH, by whoever has the password; nobody knows which port the conference-room phone is on, how much PoE is left, or which firmware each switch runs, and a typo on one port is found weeks later.

The TotalHeal approach. CampusGrid reads every switch, access point and controller over SNMP from a TotalHeal agent at the site, and applies port profiles over SSH as the commands an engineer would type for that vendor — shown before they are sent, with the switch’s answer kept.

3Architecture

4How it works

1. AddAdd a switch with its address, SNMP community and the site agent that polls it.
2. SeePorts, VLANs, PoE, firmware and neighbours appear within a minute.
3. ProfileMake port profiles: VLAN, voice VLAN, PoE, 802.1X.
4. ApplyTick ports, preview the commands, apply; the switch’s answer is kept.
5. SecureNetworkGate signs devices in on the profiled ports.

5Capabilities in detail

• Every portModel, firmware, uptime, and for each port its state, speed, VLAN, errors and PoE, read every minute over SNMP v2c.
• What is plugged in whereThe topology from LLDP: which switch and port each neighbour is on.
• Port profilesAccess VLAN, voice VLAN for phones, PoE on or off, 802.1X with MAB through NetworkGate, a description, shut down — applied to ticked ports as Cisco IOS / IOS-XE, Aruba AOS-CX or Juniper Junos commands.
• Nothing hiddenThe exact commands are shown before they are sent; the switch’s answer is kept; a refused command fails the change; the switch’s SSH key is pinned on first use.
• Wi-FiOn the Professional tier, clients per wireless network and per access point from NetworkGate sign-ins.
• Four-eyesOn the Elite tier every switch change waits for a second administrator.

6Security and data handling

• You see the commandsExactly what is typed on the switch is shown before it is sent.
• Credentials sealedCommunities and passwords are sealed and never shown again.
• The right switchA switch’s SSH key is pinned on first use; a different key is refused.
• Refusals fail loudlyA command the switch refuses fails the change with its answer.

7Where it fits

8Deployment and system requirements

9Technical specifications

10Getting started

• SNMP v2c read access on the devices
• An SSH login on the switches for changes
• A TotalHeal server agent at the site

Start a 30 days, up to 10 network devices trial in the TotalHeal console with a Sttiz account. For a quote, an on-premises installation or the procurement dossier (compliance matrix, bill of materials, architecture and hardening, SLA, OEM authorisation letter), write to business@totalhealsecurity.com.