Brocade Communications Systems ICX 7250 series, Configuration Manual

Page: 155 / 483

FIGURE 13 Neighbor discovery inspection
Though you can configure interfaces in “trust” or “untrust” mode, ND inspection is performed only on untrusted ports that are part of the
ND inspection-enabled VLAN. When you enable ND inspection on a VLAN, by default, all the interfaces and member ports are
considered as untrusted. When configured, ND inspection protects the directly connected hosts from ND cache poisoning; the hosts
connected across the switches are not insulated from any attack.
When configured, ND inspection performs the following functions:
• Intercepts and inspects the IPv6 packets that carry neighbor discovery messages on untrusted ports.
• Validates the source IP addresses and the source MAC addresses of the intercepted packets against the IP-to-MAC address
bindings stored in a trusted binding database.
• Forwards the packets which have valid IP-to-MAC address bindings to the destination host and discards the invalid packets.
The ICMPv6 packets with auto-generated link-local address (from the MAC address) are also forwarded, provided there is a
match between MAC address and the auto-generated link-local address. Hence, there is no need of separate configuration of
auto-generated link-local address in the ND inspection database.
IPv6 neighbor discovery inspection
Brocade FastIron Layer 3 Routing Configuration Guide
53-1003903-04 155