Cisco Catalyst 2960 Series, Configuration Manual

Page: 764 / 2288

Purpose Command or Action
• (Optional) default — Sets all to default options.
| inspect } ] | [ tracking { disable [ stale-lifetime
[ seconds | infinite ] | enable
• (Optional)
device-role
{
node
] |
switch
} — Specifies the role of the
device attached to the port. Default is node .
[ reachable-lifetime [ seconds | infinite ] } ] |
[ trusted-port ] }
•
(Optional) limit address-count value
—
Limits the number of
addresses allowed per target.
Example:
Switch(config-ipv6-snooping)# security-level
inspect
• (Optional)
no
— Negates a command or sets it to defaults.
•
(Optional) protocol { dhcp | ndp }
—
Specifies which protocol should
be redirected to the snooping feature for analysis. The default, is dhcp
and ndp . To change the default, use the no protocol command.
Example:
Switch(config-ipv6-snooping)# trusted-port
• (Optional)
security-level
{
glean
|
guard
|
inspect
} — Specifies the level
of security enforced by the feature. Default is guard.
glean
—
Gleans addresses from messages and populates the binding
table without any verification.
guard
—
Gleans addresses and inspects messages. In addition, it
rejects RA and DHCP server messages. This is the default option.
inspect
— Gleans addresses, validates messages for consistency
and conformance, and enforces address ownership.
•
(Optional) tracking { disable | enable }
—
Overrides the default
tracking behavior and specifies a tracking option.
• (Optional) trusted-port — Sets up a trusted port. It disables the guard
on applicable targets. Bindings learned through a trusted port have
preference over bindings learned through any other port. A trusted
port is given preference in case of a collision while making an entry
in the table.
Exits configuration modes to Privileged EXEC mode.
end
Example:
Switch(config-ipv6-snooping)# exit
Step 4
Displays the snooping policy configuration. show ipv6 snooping policy policy-name
Example:
Switch# show ipv6 snooping policy
example_policy
Step 5
What to Do Next
Attach an IPv6 Snooping policy to interfaces or VLANs.
Related Topics
Information about First Hop Security in IPv6, on page 678
Consolidated Platform Configuration Guide, Cisco IOS Release 15.2(4)E (Catalyst 2960-X Switches)
682
How to Configure an IPv6 Snooping Policy