Security: IPv6 First Hop Security
Policies, Global Parameters and System Defaults
Cisco 350XG & 550XG Series 10G Stackable Managed Switches
511
24
Protection against DHCPv6 Server Spoofing
An IPv6 host can use the DHCPv6 protocol for:
•
Stateless Information configuration
•
Statefull address configuration
A malicious host could send DHCPv6 reply messages advertising itself as a
DHCPv6 server and providing counterfeit stateless information and IPv6
addresses. DHCPv6 Guard provides protection against such attacks by
configuring the interface role as a client port for all ports to which DHCPv6 servers
cannot be connected.
Protection Against NBD Cache Spoofing
An IPv6 router supports the Neighbor Discovery Protocol (NDP) cache that maps
the IPv6 address to the MAC address for the last hop routing.
A malicious host could send IPv6 messages with a different destination IPv6
address for the last hop forwarding, causing overflow of the NBD cache.
An embedded mechanism in the NDP implementation limits the number of entries
allowed in the INCOMPLETE state in the Neighbor Discovery cache. This provides
protection against the table being flooded by hackers.
Policies, Global Parameters and System Defaults
Each feature of FHS can be enabled or disabled individually. No feature is enabled
by default.
Features must initially be enabled on specific VLANs. When you enable the
feature, you can also define global configuration values for that feature’s rules of
verification. If you do not define a policy that contain different values for these
verification rules, the global values are used to apply the feature to packets.
Policies
Policies contain the rules of verification that are performed on input packets. They
can be attached to VLANs and also to ports and LAGs. If the feature is not enabled
on a VLAN, the policies have no effect.
