Cisco Catalyst 2960 Series, Configuration Manual

Page: 778 / 2288

Purpose Command or Action
Specifies the RA Guard policy name and enters RA Guard Policy
configuration mode. [ no ] ipv6 nd raguard policy policy-name
Example:
Switch(config)# ipv6 nd raguard policy
example_policy
Step 2
Specifies the role of the device attached to the port. The default is
host .
[ no ] device-role { host | monitor | router |
switch }
Example:
Switch(config-nd-raguard)# device-role
switch
Step 3
(1
–
255) Range for Maximum and Minimum Hop Limit values.
[
no
]
hop-limit
{
maximum
|
minimum
} value
Example:
Switch(config-nd-raguard)#
hop-limit
maximum 33
Step 4
Enables filtering of Router Advertisement messages by the Hop Limit
value. A rogue RA message may have a low Hop Limit value
(equivalent to the IPv4 Time to Live) that when accepted by the host,
prevents the host from generating traffic to destinations beyond the
rogue RA message generator. An RA message with an unspecified
Hop Limit value is blocked.
If not configured, this filter is disabled. Configure minimum to block
RA messages with Hop Limit values lower than the value you specify.
Configure
maximum to block RA messages with Hop Limit values
greater than the value you specify.
Enables filtering of Router Advertisement messages by the Managed
Address Configuration, or "M" flag field. A rouge RA message with [ no ] managed-config-flag { off | on }
Example:
Switch(config-nd-raguard)#
managed-config-flag on
Step 5
an M field of 1 can cause a host to use a rogue DHCPv6 server. If not
configured, this filter is disabled.
On
—
Accepts and forwards RA messages with an M value of 1, blocks
those with 0.
Off
—
Accepts and forwards RA messages with an M value of 0, blocks
those with 1.
Matches a specified prefix list or access list. [ no ] match { ipv6 access-list list | ra prefix-list
list }
Step 6
Example:
Switch(config-nd-raguard)# match ipv6
access-list example_list
Enables filtering of Router Advertisement messages by the Other
Configuration, or "O" flag field. A rouge RA message with an O field [ no ] other-config-flag { on | off }
Example:
Switch(config-nd-raguard)#
other-config-flag on
Step 7
of 1 can cause a host to use a rogue DHCPv6 server. If not configured,
this filter is disabled.
On
—
Accepts and forwards RA messages with an O value of 1, blocks
those with 0.
Off — Accepts and forwards RA messages with an O value of 0, blocks
those with 1.
Consolidated Platform Configuration Guide, Cisco IOS Release 15.2(4)E (Catalyst 2960-X Switches)
696
How to Configure an IPv6 Router Advertisement Guard Policy